kernel-packages team mailing list archive

Thread
Date
[Bug 1457807] Re: CVE-2015-4036

To: kernel-packages@xxxxxxxxxxxxxxxxxxx
From: Launchpad Bug Tracker <1457807@xxxxxxxxxxxxxxxxxx>
Date: Wed, 10 Jun 2015 15:26:42 -0000
Reply-to: Bug 1457807 <1457807@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx
This bug was fixed in the package linux - 3.13.0-54.91

---------------
linux (3.13.0-54.91) trusty; urgency=medium

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1458618

  [ Upstream Kernel Changes ]

  * [3.13-stable only] Revert "gianfar: Carefully free skbs in functions
    called by netpoll."
    - LP: #1454746

linux (3.13.0-54.90) trusty; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1458618

  [ Andy Whitcroft ]

  * [Config] push off linux-lts-{utopic, vivid}-tools-common
    - LP: #1405807

  [ Brad Figg ]

  * hyper-v -- add hid and fb drivers to linux-virtual
    - LP: #1444179

  [ Upstream Kernel Changes ]

  * DT doc: net: cpsw mac-address is optional
    - LP: #1452628
  * net: cpsw: Add missing return value
    - LP: #1452628
  * net: cpsw: header, Add missing include
    - LP: #1452628
  * net: cpsw: Add am33xx MACID readout
    - LP: #1452628
  * am33xx: define syscon control module device node
    - LP: #1452628
  * arm: dts: am33xx, Add syscon phandle to cpsw node
    - LP: #1452628
  * net: cpsw: do not register cpts twice
    - LP: #1452620
  * x86: kvm: Revert "remove sched notifier for cross-cpu migrations"
    - LP: #1450584
  * x86: vdso: fix pvclock races with task migration
    - LP: #1450584
  * n_tty: Fix read buffer overwrite when no newline
    - LP: #1381005, #1454746
  * KVM: x86: Fix lost interrupt on irr_pending race
    - LP: #1454746
  * writeback: add missing INITIAL_JIFFIES init in
    global_update_bandwidth()
    - LP: #1454746
  * nbd: fix possible memory leak
    - LP: #1454746
  * mfd: kempld-core: Fix callback return value check
    - LP: #1454746
  * KVM: nVMX: mask unrestricted_guest if disabled on L0
    - LP: #1454746
  * spi: trigger trace event for message-done before mesg->complete
    - LP: #1454746
  * powerpc/pseries: Little endian fixes for post mobility device tree
    update
    - LP: #1454746
  * net: ethernet: pcnet32: Setup the SRAM and NOUFLO on Am79C97{3, 5}
    - LP: #1454746
  * perf: Fix irq_work 'tail' recursion
    - LP: #1454746
  * arm64: Use the reserved TTBR0 if context switching to the init_mm
    - LP: #1454746
  * selinux: fix sel_write_enforce broken return value
    - LP: #1454746
  * mm: fix anon_vma->degree underflow in anon_vma endless growing
    prevention
    - LP: #1454746
  * mm/memory hotplug: postpone the reset of obsolete pgdat
    - LP: #1454746
  * hfsplus: fix B-tree corruption after insertion at position 0
    - LP: #1454746
  * ARC: SA_SIGINFO ucontext regs off-by-one
    - LP: #1454746
  * writeback: fix possible underflow in write bandwidth calculation
    - LP: #1454746
  * iio: fix drivers that check buffer->scan_mask
    - LP: #1454746
  * iio: inv_mpu6050: Clear timestamps fifo while resetting hardware fifo
    - LP: #1454746
  * iio: core: Fix double free.
    - LP: #1454746
  * USB: ftdi_sio: Added custom PID for Synapse Wireless product
    - LP: #1454746
  * iwlwifi: dvm: run INIT firmware again upon .start()
    - LP: #1454746
  * USB: keyspan_pda: add new device id
    - LP: #1454746
  * cifs: smb2_clone_range() - exit on unhandled error
    - LP: #1454746
  * cifs: fix use-after-free bug in find_writable_file
    - LP: #1454746
  * can: flexcan: Deferred on Regulator return EPROBE_DEFER
    - LP: #1454746
  * usb: xhci: handle Config Error Change (CEC) in xhci driver
    - LP: #1454746
  * usb: xhci: apply XHCI_AVOID_BEI quirk to all Intel xHCI controllers
    - LP: #1454746
  * USB: ftdi_sio: Use jtag quirk for SNAP Connect E10
    - LP: #1454746
  * tty: serial: fsl_lpuart: clear receive flag on FIFO flush
    - LP: #1454746
  * radeon: Do not directly dereference pointers to BIOS area.
    - LP: #1454746
  * iio: imu: Use iio_trigger_get for indio_dev->trig assignment
    - LP: #1454746
  * dmaengine: edma: fix memory leak when terminating running transfers
    - LP: #1454746
  * dmaengine: omap-dma: Fix memory leak when terminating running transfer
    - LP: #1454746
  * x86/reboot: Add ASRock Q1900DC-ITX mainboard reboot quirk
    - LP: #1454746
  * mac80211: fix RX A-MPDU session reorder timer deletion
    - LP: #1454746
  * tcp: prevent fetching dst twice in early demux code
    - LP: #1454746
  * net: use for_each_netdev_safe() in rtnl_group_changelink()
    - LP: #1454746
  * xen-netfront: transmit fully GSO-sized packets
    - LP: #1454746
  * tcp: fix FRTO undo on cumulative ACK of SACKed range
    - LP: #1454746
  * PCI: cpcihp: Add missing curly braces in cpci_configure_slot()
    - LP: #1454746
  * sh_veu: v4l2_dev wasn't set
    - LP: #1454746
  * media: s5p-mfc: fix mmap support for 64bit arch
    - LP: #1454746
  * cpuidle: ACPI: do not overwrite name and description of C0
    - LP: #1454746
  * ioctx_alloc(): fix vma (and file) leak on failure
    - LP: #1454746
  * ALSA: hda/realtek - Make more stable to get pin sense for ALC283
    - LP: #1454746
  * be2iscsi: Fix kernel panic when device initialization fails
    - LP: #1454746
  * Defer processing of REQ_PREEMPT requests for blocked devices
    - LP: #1454746
  * ALSA: hda - Fix headphone pin config for Lifebook T731
    - LP: #1454746
  * ocfs2: _really_ sync the right range
    - LP: #1454746
  * ALSA: usb - Creative USB X-Fi Pro SB1095 volume knob support
    - LP: #1454746
  * iscsi target: fix oops when adding reject pdu
    - LP: #1454746
  * net/mlx4_en: Call register_netdevice in the proper location
    - LP: #1454746
  * ipv6: protect skb->sk accesses from recursive dereference inside the
    stack
    - LP: #1454746
  * tcp: tcp_make_synack() should clear skb->tstamp
    - LP: #1454746
  * 8139cp: Call dev_kfree_skby_any instead of kfree_skb.
    - LP: #1454746
  * 8139too: Call dev_kfree_skby_any instead of dev_kfree_skb.
    - LP: #1454746
  * r8169: Call dev_kfree_skby_any instead of dev_kfree_skb.
    - LP: #1454746
  * bonding: Call dev_kfree_skby_any instead of kfree_skb.
    - LP: #1454746
  * bnx2: Call dev_kfree_skby_any instead of dev_kfree_skb.
    - LP: #1454746
  * tg3: Call dev_kfree_skby_any instead of dev_kfree_skb.
    - LP: #1454746
  * ixgb: Call dev_kfree_skby_any instead of dev_kfree_skb.
    - LP: #1454746
  * benet: Call dev_kfree_skby_any instead of kfree_skb.
    - LP: #1454746
  * gianfar: Carefully free skbs in functions called by netpoll.
    - LP: #1454746
  * ip_forward: Drop frames with attached skb->sk
    - LP: #1454746
  * tcp: fix possible deadlock in tcp_send_fin()
    - LP: #1454746
  * tcp: avoid looping in tcp_send_fin()
    - LP: #1454746
  * net: do not deplete pfmemalloc reserve
    - LP: #1454746
  * net: fix crash in build_skb()
    - LP: #1454746
  * ipv4: Missing sk_nulls_node_init() in ping_unhash().
    - LP: #1454746
  * Linux 3.13.11-ckt20
    - LP: #1454746
  * of: Add support for ePAPR "stdout-path" property
    - LP: #1438585
  * lib: add glibc style strchrnul() variant
    - LP: #1438585
  * of: Create unlocked version of for_each_child_of_node()
    - LP: #1438585
  * of: Make of_find_node_by_path() handle /aliases
    - LP: #1438585
  * of: Create of_console_check() for selecting a console specified in
    /chosen
    - LP: #1438585
  * of: Enable console on serial ports specified by /chosen/stdout-path
    - LP: #1438585
  * of: correct of_console_check()'s return value
    - LP: #1438585
  * of: Add bindings for chosen node, stdout-path
    - LP: #1438585
  * of: add optional options parameter to of_find_node_by_path()
    - LP: #1438585
  * of: support passing console options with stdout-path
    - LP: #1438585
  * (upstream) net/mlx4_core: Adjust command timeouts to conform to the
    firmware spec
    - LP: #1455121
  * arm64: kernel: add MPIDR_EL1 accessors macros
    - LP: #1455372
  * of: reimplement the matching method for __of_match_node()
    - LP: #1455372
  * arm64: remove redundant "psci:" prefixes
    - LP: #1455372
  * arm64: remove return value form psci_init()
    - LP: #1455372
  * arm: KVM: Don't return PSCI_INVAL if waitqueue is inactive
    - LP: #1455372
  * KVM: Add capability to advertise PSCI v0.2 support
    - LP: #1455372
  * ARM/ARM64: KVM: Add common header for PSCI related defines
    - LP: #1455372
  * ARM/ARM64: KVM: Add base for PSCI v0.2 emulation
    - LP: #1455372
  * KVM: Documentation: Add info regarding KVM_ARM_VCPU_PSCI_0_2 feature
    - LP: #1455372
  * ARM/ARM64: KVM: Make kvm_psci_call() return convention more flexible
    - LP: #1455372
  * KVM: Add KVM_EXIT_SYSTEM_EVENT to user space API header
    - LP: #1455372
  * ARM/ARM64: KVM: Emulate PSCI v0.2 SYSTEM_OFF and SYSTEM_RESET
    - LP: #1455372
  * ARM/ARM64: KVM: Emulate PSCI v0.2 AFFINITY_INFO
    - LP: #1455372
  * ARM/ARM64: KVM: Emulate PSCI v0.2 MIGRATE_INFO_TYPE and related
    functions
    - LP: #1455372
  * ARM/ARM64: KVM: Fix CPU_ON emulation for PSCI v0.2
    - LP: #1455372
  * ARM/ARM64: KVM: Emulate PSCI v0.2 CPU_SUSPEND
    - LP: #1455372
  * ARM/ARM64: KVM: Advertise KVM_CAP_ARM_PSCI_0_2 to user space
    - LP: #1455372
  * PSCI: Add initial support for PSCIv0.2 functions
    - LP: #1455372
  * Documentation: devicetree: Add new binding for PSCIv0.2
    - LP: #1455372
  * ARM: Check if a CPU has gone offline
    - LP: #1455372
  * arm64: KVM: Enable minimalistic support for Cortex-A53
    - LP: #1455372
  * HID: multitouch: add support of clickpads
    - LP: #1456881
  * vhost/scsi: potential memory corruption
    - LP: #1457807
    - CVE-2015-4036

 -- Luis Henriques <luis.henriques@xxxxxxxxxxxxx>  Tue, 26 May 2015
17:19:30 +0100

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux-armadaxp in Ubuntu.
https://bugs.launchpad.net/bugs/1457807

Title:
  CVE-2015-4036

Status in linux package in Ubuntu:
  Fix Released
Status in linux-armadaxp package in Ubuntu:
  Invalid
Status in linux-ec2 package in Ubuntu:
  Invalid
Status in linux-flo package in Ubuntu:
  New
Status in linux-fsl-imx51 package in Ubuntu:
  Invalid
Status in linux-goldfish package in Ubuntu:
  New
Status in linux-lts-backport-maverick package in Ubuntu:
  New
Status in linux-lts-backport-natty package in Ubuntu:
  New
Status in linux-lts-quantal package in Ubuntu:
  Invalid
Status in linux-lts-raring package in Ubuntu:
  Invalid
Status in linux-lts-saucy package in Ubuntu:
  Invalid
Status in linux-lts-trusty package in Ubuntu:
  Invalid
Status in linux-lts-utopic package in Ubuntu:
  Invalid
Status in linux-lts-vivid package in Ubuntu:
  Invalid
Status in linux-mako package in Ubuntu:
  New
Status in linux-manta package in Ubuntu:
  New
Status in linux-mvl-dove package in Ubuntu:
  Invalid
Status in linux-ti-omap4 package in Ubuntu:
  Invalid
Status in linux source package in Precise:
  Invalid
Status in linux-armadaxp source package in Precise:
  Invalid
Status in linux-ec2 source package in Precise:
  Invalid
Status in linux-flo source package in Precise:
  Invalid
Status in linux-fsl-imx51 source package in Precise:
  Invalid
Status in linux-goldfish source package in Precise:
  Invalid
Status in linux-lts-backport-maverick source package in Precise:
  New
Status in linux-lts-backport-natty source package in Precise:
  New
Status in linux-lts-quantal source package in Precise:
  Invalid
Status in linux-lts-raring source package in Precise:
  Invalid
Status in linux-lts-saucy source package in Precise:
  New
Status in linux-lts-trusty source package in Precise:
  Fix Committed
Status in linux-lts-utopic source package in Precise:
  Invalid
Status in linux-lts-vivid source package in Precise:
  Invalid
Status in linux-mako source package in Precise:
  Invalid
Status in linux-manta source package in Precise:
  Invalid
Status in linux-mvl-dove source package in Precise:
  Invalid
Status in linux-ti-omap4 source package in Precise:
  Invalid
Status in linux source package in Trusty:
  Fix Released
Status in linux-armadaxp source package in Trusty:
  Invalid
Status in linux-ec2 source package in Trusty:
  Invalid
Status in linux-flo source package in Trusty:
  Invalid
Status in linux-fsl-imx51 source package in Trusty:
  Invalid
Status in linux-goldfish source package in Trusty:
  Invalid
Status in linux-lts-backport-maverick source package in Trusty:
  New
Status in linux-lts-backport-natty source package in Trusty:
  New
Status in linux-lts-quantal source package in Trusty:
  Invalid
Status in linux-lts-raring source package in Trusty:
  Invalid
Status in linux-lts-saucy source package in Trusty:
  Invalid
Status in linux-lts-trusty source package in Trusty:
  Invalid
Status in linux-lts-utopic source package in Trusty:
  Fix Committed
Status in linux-lts-vivid source package in Trusty:
  Fix Committed
Status in linux-mako source package in Trusty:
  Invalid
Status in linux-manta source package in Trusty:
  Invalid
Status in linux-mvl-dove source package in Trusty:
  Invalid
Status in linux-ti-omap4 source package in Trusty:
  Invalid
Status in linux source package in Utopic:
  Fix Committed
Status in linux-armadaxp source package in Utopic:
  Invalid
Status in linux-ec2 source package in Utopic:
  Invalid
Status in linux-flo source package in Utopic:
  Invalid
Status in linux-fsl-imx51 source package in Utopic:
  Invalid
Status in linux-goldfish source package in Utopic:
  Invalid
Status in linux-lts-backport-maverick source package in Utopic:
  New
Status in linux-lts-backport-natty source package in Utopic:
  New
Status in linux-lts-quantal source package in Utopic:
  Invalid
Status in linux-lts-raring source package in Utopic:
  Invalid
Status in linux-lts-saucy source package in Utopic:
  Invalid
Status in linux-lts-trusty source package in Utopic:
  Invalid
Status in linux-lts-utopic source package in Utopic:
  Invalid
Status in linux-lts-vivid source package in Utopic:
  Invalid
Status in linux-mako source package in Utopic:
  Invalid
Status in linux-manta source package in Utopic:
  Invalid
Status in linux-mvl-dove source package in Utopic:
  Invalid
Status in linux-ti-omap4 source package in Utopic:
  Invalid
Status in linux source package in Vivid:
  Fix Released
Status in linux-armadaxp source package in Vivid:
  Invalid
Status in linux-ec2 source package in Vivid:
  Invalid
Status in linux-flo source package in Vivid:
  Invalid
Status in linux-fsl-imx51 source package in Vivid:
  Invalid
Status in linux-goldfish source package in Vivid:
  Invalid
Status in linux-lts-backport-maverick source package in Vivid:
  New
Status in linux-lts-backport-natty source package in Vivid:
  New
Status in linux-lts-quantal source package in Vivid:
  Invalid
Status in linux-lts-raring source package in Vivid:
  Invalid
Status in linux-lts-saucy source package in Vivid:
  Invalid
Status in linux-lts-trusty source package in Vivid:
  Invalid
Status in linux-lts-utopic source package in Vivid:
  Invalid
Status in linux-lts-vivid source package in Vivid:
  Invalid
Status in linux-mako source package in Vivid:
  Invalid
Status in linux-manta source package in Vivid:
  Invalid
Status in linux-mvl-dove source package in Vivid:
  Invalid
Status in linux-ti-omap4 source package in Vivid:
  Invalid
Status in linux source package in Wily:
  Fix Released
Status in linux-armadaxp source package in Wily:
  Invalid
Status in linux-ec2 source package in Wily:
  Invalid
Status in linux-flo source package in Wily:
  New
Status in linux-fsl-imx51 source package in Wily:
  Invalid
Status in linux-goldfish source package in Wily:
  New
Status in linux-lts-backport-maverick source package in Wily:
  New
Status in linux-lts-backport-natty source package in Wily:
  New
Status in linux-lts-quantal source package in Wily:
  Invalid
Status in linux-lts-raring source package in Wily:
  Invalid
Status in linux-lts-saucy source package in Wily:
  Invalid
Status in linux-lts-trusty source package in Wily:
  Invalid
Status in linux-lts-utopic source package in Wily:
  Invalid
Status in linux-lts-vivid source package in Wily:
  Invalid
Status in linux-mako source package in Wily:
  New
Status in linux-manta source package in Wily:
  New
Status in linux-mvl-dove source package in Wily:
  Invalid
Status in linux-ti-omap4 source package in Wily:
  Invalid

Bug description:
  [drivers/vhost/scsi.c: potential memory corruption]

  Break-Fix: 057cbf49a1f08297877e46c82f707b1bfea806a8
  59c816c1f24df0204e01851431d3bab3eb76719c

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1457807/+subscriptions
References

[Bug 1457807] [NEW] CVE-2015-4036
From: John Johansen, 2015-05-22