kernel-packages team mailing list archive

Thread
Date
[Bug 1520184] Re: CVE-2015-8104

To: kernel-packages@xxxxxxxxxxxxxxxxxxx
From: Launchpad Bug Tracker <1520184@xxxxxxxxxxxxxxxxxx>
Date: Wed, 16 Dec 2015 15:50:24 -0000
Reply-to: Bug 1520184 <1520184@xxxxxxxxxxxxxxxxxx>
Sender: bounces@xxxxxxxxxxxxx
This bug was fixed in the package linux - 3.2.0-96.136

---------------
linux (3.2.0-96.136) precise; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1521325

  [ Andy Whitcroft ]

  * [Packaging] control -- make element ordering deterministic
    - LP: #1516686
  * [Packaging] control -- prepare for new kernel-wedge semantics
    - LP: #1516686

  [ Upstream Kernel Changes ]

  * Revert "KVM: x86: vmx: avoid guest->host DOS by intercepting #AC"
  * Revert "KVM: MMU: fix validation of mmio page fault"
    - LP: #1520200
  * module: Fix locking in symbol_put_addr()
    - LP: #1520200
  * regmap: debugfs: Ensure we don't underflow when printing access masks
    - LP: #1520200
  * regmap: debugfs: Don't bother actually printing when calculating max
    length
    - LP: #1520200
  * ath9k: declare required extra tx headroom
    - LP: #1520200
  * m68k: Define asmlinkage_protect
    - LP: #1520200
  * x86/xen: Do not clip xen_e820_map to xen_e820_map_entries when
    sanitizing map
    - LP: #1520200
  * UBI: Validate data_size
    - LP: #1520200
  * UBI: return ENOSPC if no enough space available
    - LP: #1520200
  * MIPS: dma-default: Fix 32-bit fall back to GFP_DMA
    - LP: #1520200
  * x86/process: Add proper bound checks in 64bit get_wchan()
    - LP: #1520200
  * genirq: Fix race in register_irq_proc()
    - LP: #1520200
  * mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy
    a fault
    - LP: #1520200
  * Do not fall back to SMBWriteX in set_file_size error cases
    - LP: #1520200
  * md/raid0: update queue parameter in a safer location.
    - LP: #1520200
  * md/raid0: apply base queue limits *before* disk_stack_limits
    - LP: #1520200
  * clocksource: Fix abs() usage w/ 64bit values
    - LP: #1520200
  * iio: accel: sca3000: memory corruption in sca3000_read_first_n_hw_rb()
    - LP: #1520200
  * USB: Add reset-resume quirk for two Plantronics usb headphones.
    - LP: #1520200
  * usb: Add device quirk for Logitech PTZ cameras
    - LP: #1520200
  * tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c
    - LP: #1520200
  * drivers/tty: require read access for controlling terminal
    - LP: #1520200
  * ppp: don't override sk->sk_state in pppoe_flush_dev()
    - LP: #1520200
  * iwlwifi: dvm: fix D3 firmware PN programming
    - LP: #1520200
  * ALSA: synth: Fix conflicting OSS device registration on AWE32
    - LP: #1520200
  * sched/core: Fix TASK_DEAD race in finish_task_switch()
    - LP: #1520200
  * 3w-9xxx: don't unmap bounce buffered commands
    - LP: #1520200
  * xen-blkfront: check for null drvdata in blkback_changed
    (XenbusStateClosing)
    - LP: #1520200
  * ALSA: hda - Fix inverted internal mic on Lenovo G50-80
    - LP: #1504778, #1520200
  * crypto: ahash - ensure statesize is non-zero
    - LP: #1520200
  * iommu/vt-d: fix range computation when making room for large pages
    - LP: #1520200
  * xhci: don't finish a TD if we get a short transfer event mid TD
    - LP: #1520200
  * xhci: handle no ping response error properly
    - LP: #1520200
  * xhci: Switch Intel Lynx Point LP ports to EHCI on shutdown.
    - LP: #1520200
  * xhci: Add spurious wakeup quirk for LynxPoint-LP controllers
    - LP: #1520200
  * crypto: api - Only abort operations on fatal signal
    - LP: #1520200
  * ASoC: wm8904: Correct number of EQ registers
    - LP: #1520200
  * IB/cm: Fix rb-tree duplicate free and use-after-free
    - LP: #1520200
  * drm/nouveau/gem: return only valid domain when there's only one
    - LP: #1520200
  * powerpc/rtas: Validate rtas.entry before calling enter_rtas()
    - LP: #1520200
  * mm: make sendfile(2) killable
    - LP: #1520200
  * ppp: fix pppoe_dev deletion condition in pppoe_release()
    - LP: #1520200
  * dm btree remove: fix a bug when rebalancing nodes after removal
    - LP: #1520200
  * dm btree: fix leak of bufio-backed block in btree_split_beneath error
    path
    - LP: #1520200
  * md/raid1: ensure device failure recorded before write request returns.
    - LP: #1520200
  * md/raid1: don't clear bitmap bit when bad-block-list write fails.
    - LP: #1520200
  * md/raid10: ensure device failure recorded before write request returns.
    - LP: #1520200
  * md/raid10: don't clear bitmap bit when bad-block-list write fails.
    - LP: #1520200
  * mvsas: Fix NULL pointer dereference in mvs_slot_task_free
    - LP: #1520200
  * sched: declare pid_alive as inline
    - LP: #1520200
  * net: add length argument to skb_copy_and_csum_datagram_iovec
    - LP: #1520200
  * skbuff: Fix skb checksum flag on skb pull
    - LP: #1520200
  * skbuff: Fix skb checksum partial check.
    - LP: #1520200
  * ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings
    - LP: #1520200
  * asix: Don't reset PHY on if_up for ASIX 88772
    - LP: #1520200
  * asix: Do full reset during ax88772_bind
    - LP: #1520200
  * Failing to send a CLOSE if file is opened WRONLY and server reboots on
    a 4.x mount
    - LP: #1520200
  * KVM: x86: work around infinite loop in microcode when #AC is delivered
    - LP: #1520200
  * KEYS: Fix race between key destruction and finding a keyring by name
    - LP: #1520200
  * KEYS: Fix crash when attempt to garbage collect an uninstantiated
    keyring
    - LP: #1520200
  * Linux 3.2.73
    - LP: #1520200
  * KVM: svm: unconditionally intercept #DB
    - LP: #1520184
    - CVE-2015-8104

 -- Brad Figg <brad.figg@xxxxxxxxxxxxx>  Mon, 30 Nov 2015 12:52:43 -0800

** Changed in: linux (Ubuntu Precise)
       Status: Fix Committed => Fix Released

** Changed in: linux-armadaxp (Ubuntu Precise)
       Status: Invalid => Fix Released

** CVE added: http://www.cve.mitre.org/cgi-
bin/cvename.cgi?name=2015-5307

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux-armadaxp in Ubuntu.
https://bugs.launchpad.net/bugs/1520184

Title:
  CVE-2015-8104

Status in linux package in Ubuntu:
  Fix Committed
Status in linux-armadaxp package in Ubuntu:
  Invalid
Status in linux-ec2 package in Ubuntu:
  Invalid
Status in linux-flo package in Ubuntu:
  Invalid
Status in linux-fsl-imx51 package in Ubuntu:
  Invalid
Status in linux-goldfish package in Ubuntu:
  New
Status in linux-lts-backport-maverick package in Ubuntu:
  New
Status in linux-lts-backport-natty package in Ubuntu:
  New
Status in linux-lts-quantal package in Ubuntu:
  Invalid
Status in linux-lts-raring package in Ubuntu:
  Invalid
Status in linux-lts-saucy package in Ubuntu:
  Invalid
Status in linux-lts-trusty package in Ubuntu:
  Invalid
Status in linux-lts-utopic package in Ubuntu:
  Invalid
Status in linux-lts-vivid package in Ubuntu:
  Invalid
Status in linux-lts-wily package in Ubuntu:
  Invalid
Status in linux-mako package in Ubuntu:
  Invalid
Status in linux-manta package in Ubuntu:
  Invalid
Status in linux-mvl-dove package in Ubuntu:
  Invalid
Status in linux-raspi2 package in Ubuntu:
  Invalid
Status in linux-ti-omap4 package in Ubuntu:
  Invalid
Status in linux source package in Precise:
  Fix Released
Status in linux-armadaxp source package in Precise:
  Fix Released
Status in linux-ec2 source package in Precise:
  Invalid
Status in linux-flo source package in Precise:
  Invalid
Status in linux-fsl-imx51 source package in Precise:
  Invalid
Status in linux-goldfish source package in Precise:
  Invalid
Status in linux-lts-backport-maverick source package in Precise:
  New
Status in linux-lts-backport-natty source package in Precise:
  New
Status in linux-lts-quantal source package in Precise:
  Invalid
Status in linux-lts-raring source package in Precise:
  Invalid
Status in linux-lts-saucy source package in Precise:
  Invalid
Status in linux-lts-trusty source package in Precise:
  Fix Released
Status in linux-lts-utopic source package in Precise:
  Invalid
Status in linux-lts-vivid source package in Precise:
  Invalid
Status in linux-lts-wily source package in Precise:
  Invalid
Status in linux-mako source package in Precise:
  Invalid
Status in linux-manta source package in Precise:
  Invalid
Status in linux-mvl-dove source package in Precise:
  Invalid
Status in linux-raspi2 source package in Precise:
  Invalid
Status in linux-ti-omap4 source package in Precise:
  Invalid
Status in linux source package in Trusty:
  Fix Released
Status in linux-armadaxp source package in Trusty:
  Invalid
Status in linux-ec2 source package in Trusty:
  Invalid
Status in linux-flo source package in Trusty:
  Invalid
Status in linux-fsl-imx51 source package in Trusty:
  Invalid
Status in linux-goldfish source package in Trusty:
  Invalid
Status in linux-lts-backport-maverick source package in Trusty:
  New
Status in linux-lts-backport-natty source package in Trusty:
  New
Status in linux-lts-quantal source package in Trusty:
  Invalid
Status in linux-lts-raring source package in Trusty:
  Invalid
Status in linux-lts-saucy source package in Trusty:
  Invalid
Status in linux-lts-trusty source package in Trusty:
  Invalid
Status in linux-lts-utopic source package in Trusty:
  Fix Released
Status in linux-lts-vivid source package in Trusty:
  Fix Committed
Status in linux-lts-wily source package in Trusty:
  Fix Committed
Status in linux-mako source package in Trusty:
  Invalid
Status in linux-manta source package in Trusty:
  Invalid
Status in linux-mvl-dove source package in Trusty:
  Invalid
Status in linux-raspi2 source package in Trusty:
  Invalid
Status in linux-ti-omap4 source package in Trusty:
  Invalid
Status in linux source package in Vivid:
  Fix Committed
Status in linux-armadaxp source package in Vivid:
  Invalid
Status in linux-ec2 source package in Vivid:
  Invalid
Status in linux-flo source package in Vivid:
  Invalid
Status in linux-fsl-imx51 source package in Vivid:
  Invalid
Status in linux-goldfish source package in Vivid:
  New
Status in linux-lts-backport-maverick source package in Vivid:
  New
Status in linux-lts-backport-natty source package in Vivid:
  New
Status in linux-lts-quantal source package in Vivid:
  Invalid
Status in linux-lts-raring source package in Vivid:
  Invalid
Status in linux-lts-saucy source package in Vivid:
  Invalid
Status in linux-lts-trusty source package in Vivid:
  Invalid
Status in linux-lts-utopic source package in Vivid:
  Invalid
Status in linux-lts-vivid source package in Vivid:
  Invalid
Status in linux-lts-wily source package in Vivid:
  Invalid
Status in linux-mako source package in Vivid:
  Invalid
Status in linux-manta source package in Vivid:
  Invalid
Status in linux-mvl-dove source package in Vivid:
  Invalid
Status in linux-raspi2 source package in Vivid:
  Invalid
Status in linux-ti-omap4 source package in Vivid:
  Invalid
Status in linux source package in Wily:
  Fix Committed
Status in linux-armadaxp source package in Wily:
  Invalid
Status in linux-ec2 source package in Wily:
  Invalid
Status in linux-flo source package in Wily:
  Invalid
Status in linux-fsl-imx51 source package in Wily:
  Invalid
Status in linux-goldfish source package in Wily:
  New
Status in linux-lts-backport-maverick source package in Wily:
  New
Status in linux-lts-backport-natty source package in Wily:
  New
Status in linux-lts-quantal source package in Wily:
  Invalid
Status in linux-lts-raring source package in Wily:
  Invalid
Status in linux-lts-saucy source package in Wily:
  Invalid
Status in linux-lts-trusty source package in Wily:
  Invalid
Status in linux-lts-utopic source package in Wily:
  Invalid
Status in linux-lts-vivid source package in Wily:
  Invalid
Status in linux-lts-wily source package in Wily:
  Invalid
Status in linux-mako source package in Wily:
  Invalid
Status in linux-manta source package in Wily:
  Invalid
Status in linux-mvl-dove source package in Wily:
  Invalid
Status in linux-raspi2 source package in Wily:
  Invalid
Status in linux-ti-omap4 source package in Wily:
  Invalid
Status in linux source package in Xenial:
  Fix Committed
Status in linux-armadaxp source package in Xenial:
  Invalid
Status in linux-ec2 source package in Xenial:
  Invalid
Status in linux-flo source package in Xenial:
  Invalid
Status in linux-fsl-imx51 source package in Xenial:
  Invalid
Status in linux-goldfish source package in Xenial:
  New
Status in linux-lts-backport-maverick source package in Xenial:
  New
Status in linux-lts-backport-natty source package in Xenial:
  New
Status in linux-lts-quantal source package in Xenial:
  Invalid
Status in linux-lts-raring source package in Xenial:
  Invalid
Status in linux-lts-saucy source package in Xenial:
  Invalid
Status in linux-lts-trusty source package in Xenial:
  Invalid
Status in linux-lts-utopic source package in Xenial:
  Invalid
Status in linux-lts-vivid source package in Xenial:
  Invalid
Status in linux-lts-wily source package in Xenial:
  Invalid
Status in linux-mako source package in Xenial:
  Invalid
Status in linux-manta source package in Xenial:
  Invalid
Status in linux-mvl-dove source package in Xenial:
  Invalid
Status in linux-raspi2 source package in Xenial:
  Invalid
Status in linux-ti-omap4 source package in Xenial:
  Invalid

Bug description:
  The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x
  through 4.6.x, allows guest OS users to cause a denial of service
  (host OS panic or hang) by triggering many #DB (aka Debug) exceptions,
  related to svm.c.

  Break-Fix: - cbdb967af3d54993f5814f1cee0ed311a055377d

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1520184/+subscriptions
References

[Bug 1520184] [NEW] CVE-2015-8104
From: Luis Henriques, 2015-11-26