CVE-2015-2666

[John Johansen]

Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to the initrd.

Break-Fix: ec400ddeff200b068ddc6c70f7321f49ecf32ed5 f84598bd7c851f8b0bf8cd0d7c3be0d73c432ff4

[John Johansen (jjohansen)]

CVE-2015-2666

[Mathew Hodson (mhodson)]

According to http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-2666.html, this was released upstream with 3.9~rc1 and trusty, utopic, vivid are not affected.

[Mathew Hodson (mhodson)]

http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-2666.html has been updated and now says that it affects trusty, utopic, vivid with the upstream fix in 4.0~rc1. So undoing my change.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.19.0-13.13

---------------
linux (3.19.0-13.13) vivid; urgency=low

  [ Andy Whitcroft ]

  * [Packaging] initscripts need installing when making the package
  * [Packaging] initscripts work around bug in debhelper systemd support

  [ Jay Vosburgh ]

  * SAUCE: fan: Proof of concept implementation
    - LP: #1439706

  [ Leann Ogasawara ]

  * Release Tracking Bug
    - LP: #1442165

  [ Upstream Kernel Changes ]

  * Revert "drm: fix mismerge in drm_crtc.c"
    - LP: #1440270, #1440392
  * e1000e: initial support for i219
    - LP: #1400955
  * e1000e: fix obscure comments
    - LP: #1400955
  * e1000e: remove calls to ioremap/unmap for NVM addr
    - LP: #1400955
  * d-i: Enable usb modules on arm64
  * drm/amdkfd: Initialize only amdkfd's assigned pipelines
  * storvsc: use cmd_size to allocate per-command data
  * storvsc: in responce to a scan event, scan the host
  * storvsc: force discovery of LUNs that may have been removed.
  * storvsc: fix a bug in storvsc limits
  * Drivers: hv: vmbus: Use get_cpu() to get the current CPU
  * Tools: hv: address compiler warnings for hv_fcopy_daemon.c
  * Tools: hv: do not add redundant '/' in hv_start_fcopy()
  * Drivers: hv: hv_balloon: Make adjustments in computing the floor
  * Drivers: hv: hv_balloon: Fix a locking bug in the balloon driver
  * Drivers: hv: hv_balloon: Don't post pressure status from interrupt
    context
  * Drivers: hv: vmbus: Implement a clockevent device
  * Drivers: hv: vmbus: Fix a bug in vmbus_establish_gpadl()
  * Drivers: hv: vmbus: Support a vmbus API for efficiently sending page
    arrays
  * hv: hv_fcopy: drop the obsolete message on transfer failure
  * Drivers: hv: check vmbus_device_create() return value in
    vmbus_process_offer()
  * Drivers: hv: rename sc_lock to the more generic lock
  * Drivers: hv: vmbus: serialize Offer and Rescind offer
  * Drivers: hv: vmbus: hv_process_timer_expiration() can be static
  * hyperv: netvsc.c: match wait_for_completion_timeout return type
  * hyperv: fix sparse warnings
  * powerpc/powernv: Add OPAL soft-poweroff routine
    - LP: #1439562
  * drivers/sbus/char/envctrl.c: ignore orderly_poweroff return value
    - LP: #1439562
  * kernel/reboot.c: add orderly_reboot for graceful reboot
    - LP: #1439562
  * powerpc/powernv: reboot when requested by firmware
    - LP: #1439562
  * powerpc/kernel: Make syscall_exit a local label
    - LP: #1439562
  * powerpc: Remove old compile time disabled syscall tracing code
    - LP: #1439562
  * powerpc: Add a proper syscall for switching endianness
    - LP: #1439562
  * powerpc/powernv: Remove "opal" prefix from pr_xxx()s
    - LP: #1439562
  * powerpc/powernv: Separate function for OPAL IRQ setup
    - LP: #1439562
  * powerpc/powernv: Add OPAL message notifier unregister function
    - LP: #1439562
  * powerpc/powernv: Support OPAL requested heartbeat
    - LP: #1439562
  * device: Add dev_of_node() accessor
    - LP: #1439562
  * drivers/core/of: Add symlink to device-tree from devices with an OF
    node
    - LP: #1439562
  * ipv6: Don't reduce hop limit for an interface
    - LP: #1441103
    - CVE-2015-2922
  * x86/microcode/int...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.16.0-36.48

---------------
linux (3.16.0-36.48) utopic; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1443946
  * Merged back Ubuntu-3.16.0-34.47 security release

linux (3.16.0-35.46) utopic; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1442324

  [ Andy Whitcroft ]

  * [Config] CONFIG_DEFAULT_MMAP_MIN_ADDR needs to match on armhf and arm64
    - LP: #1418140

  [ Chris J Arges ]

  * [Config] CONFIG_PCIEASPM_DEBUG=y
    - LP: #1398544

  [ dann frazier ]

  * [Config] CONFIG_RTC_DRV_EFI=y on arm64
    - LP: #1441291

  [ Upstream Kernel Changes ]

  * Revert "USB: serial: make bulk_out_size a lower limit"
    - LP: #1441317
  * Revert "i2c: core: Dispose OF IRQ mapping at client removal time"
    - LP: #1441317
  * Revert "net: cx82310_eth: use common match macro"
    - LP: #1441317
  * KEYS: request_key() should reget expired keys rather than give
    EKEYEXPIRED
    - LP: #1124250
  * drm/i915/bdw: 3D_CHICKEN3 has write mask bits
    - LP: #1374389
  * drm/i915: call lpt_init_clock_gating on BDW too
    - LP: #1374389
  * drm/i915/bdw: Apply workarounds in render ring init function
    - LP: #1374389
  * drm/i915/bdw: Cleanup pre prod workarounds
    - LP: #1374389
  * drm/i915: Refactor Broadwell PIPE_CONTROL emission into a helper.
    - LP: #1374389
  * drm/i915: Add the WaCsStallBeforeStateCacheInvalidate:bdw workaround.
    - LP: #1374389
  * drm/i915/bdw: Remove BDW preproduction W/As until C stepping.
    - LP: #1374389
  * drm/i915: Rework GPU reset sequence to match driver load & thaw
    - LP: #1384469
  * drm/ast: switch to using CACHED by default for sysram
    - LP: #1420627
  * drm/ast: Add missing entry to dclk_table[]
    - LP: #1420627
  * drm/ast: Add reduced blanking modes for wide screen mode
    - LP: #1420627
  * drm/ast: Try to use MMIO registers when PIO isn't supported
    - LP: #1420627
  * drm/ast: POST chip at probe time if VGA not enabled
    - LP: #1420627
  * drm/ast: Properly initialize P2A base before using it in
    ast_init_3rdtx()
    - LP: #1420627
  * drm/ast: Don't assume DVO enabled means SIL164 on uninitialized chips
    - LP: #1420627
  * drm/ast: Cleanup analog init code path
    - LP: #1420627
  * audit: correctly record file names with different path name types
    - LP: #1439441
  * of: Create of_console_check() for selecting a console specified in
    /chosen
    - LP: #1438585
  * of: Enable console on serial ports specified by /chosen/stdout-path
    - LP: #1438585
  * of: correct of_console_check()'s return value
    - LP: #1438585
  * of: Add bindings for chosen node, stdout-path
    - LP: #1438585
  * of: add optional options parameter to of_find_node_by_path()
    - LP: #1438585
  * of: support passing console options with stdout-path
    - LP: #1438585
  * netfilter: nf_tables: disable preemption when restoring chain counters
    - LP: #1441317
  * netfilter: nf_tables: fix leaks in error path of nf_tables_newchain()
    - LP: #1441317
  * ipvs: rerouting to local clients is not needed anymore
    - LP: #1441317
  * netfilter: nft_compat: fix module refcount underflow
    - LP: #1441317
  * netf...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.13.0-51.84

---------------
linux (3.13.0-51.84) trusty; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1444141
  * Merged back Ubuntu-3.13.0-49.83 security release

linux (3.13.0-50.82) trusty; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1442285

  [ Andy Whitcroft ]

  * [Config] CONFIG_DEFAULT_MMAP_MIN_ADDR needs to match on armhf and arm64
    - LP: #1418140

  [ Chris J Arges ]

  * [Config] CONFIG_PCIEASPM_DEBUG=y
    - LP: #1398544

  [ Upstream Kernel Changes ]

  * KEYS: request_key() should reget expired keys rather than give
    EKEYEXPIRED
    - LP: #1124250
  * audit: correctly record file names with different path name types
    - LP: #1439441
  * KVM: x86: Check for nested events if there is an injectable interrupt
    - LP: #1413540
  * be2iscsi: fix memory leak in error path
    - LP: #1440156
  * block: remove old blk_iopoll_enabled variable
    - LP: #1440156
  * be2iscsi: Fix handling timed out MBX completion from FW
    - LP: #1440156
  * be2iscsi: Fix doorbell format for EQ/CQ/RQ s per SLI spec.
    - LP: #1440156
  * be2iscsi: Fix the session cleanup when reboot/shutdown happens
    - LP: #1440156
  * be2iscsi: Fix scsi_cmnd leakage in driver.
    - LP: #1440156
  * be2iscsi : Fix DMA Out of SW-IOMMU space error
    - LP: #1440156
  * be2iscsi: Fix retrieving MCCQ_WRB in non-embedded Mbox path
    - LP: #1440156
  * be2iscsi: Fix exposing Host in sysfs after adapter initialization is
    complete
    - LP: #1440156
  * be2iscsi: Fix interrupt Coalescing mechanism.
    - LP: #1440156
  * be2iscsi: Fix TCP parameters while connection offloading.
    - LP: #1440156
  * be2iscsi: Fix memory corruption in MBX path
    - LP: #1440156
  * be2iscsi: Fix destroy MCC-CQ before MCC-EQ is destroyed
    - LP: #1440156
  * be2iscsi: add an missing goto in error path
    - LP: #1440156
  * be2iscsi: remove potential junk pointer free
    - LP: #1440156
  * be2iscsi: Fix memory leak in mgmt_set_ip()
    - LP: #1440156
  * be2iscsi: Fix the sparse warning introduced in previous submission
    - LP: #1440156
  * be2iscsi: Fix updating the boot enteries in sysfs
    - LP: #1440156
  * be2iscsi: Fix processing CQE before connection resources are freed
    - LP: #1440156
  * be2iscsi : Fix kernel panic during reboot/shutdown
    - LP: #1440156
  * fixed invalid assignment of 64bit mask to host dma_boundary for scatter
    gather segment boundary limit.
    - LP: #1440156
  * quota: Store maximum space limit in bytes
    - LP: #1441284
  * ip: zero sockaddr returned on error queue
    - LP: #1441284
  * net: rps: fix cpu unplug
    - LP: #1441284
  * ipv6: stop sending PTB packets for MTU < 1280
    - LP: #1441284
  * netxen: fix netxen_nic_poll() logic
    - LP: #1441284
  * udp_diag: Fix socket skipping within chain
    - LP: #1441284
  * ping: Fix race in free in receive path
    - LP: #1441284
  * bnx2x: fix napi poll return value for repoll
    - LP: #1441284
  * net: don't OOPS on socket aio
    - LP: #1441284
  * bridge: dont send notification when skb->len == 0 in rtnl_bridge_notify
    - LP: #1441284
  * ipv4: tcp: get rid of ugly unicast_sock
...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-lts-trusty - 3.13.0-51.84~precise1

---------------
linux-lts-trusty (3.13.0-51.84~precise1) precise; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1444698
  * Merged back Ubuntu-3.13.0-49.83 security release

linux (3.13.0-50.82) trusty; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1442285

  [ Andy Whitcroft ]

  * [Config] CONFIG_DEFAULT_MMAP_MIN_ADDR needs to match on armhf and arm64
    - LP: #1418140

  [ Chris J Arges ]

  * [Config] CONFIG_PCIEASPM_DEBUG=y
    - LP: #1398544

  [ Upstream Kernel Changes ]

  * KEYS: request_key() should reget expired keys rather than give
    EKEYEXPIRED
    - LP: #1124250
  * audit: correctly record file names with different path name types
    - LP: #1439441
  * KVM: x86: Check for nested events if there is an injectable interrupt
    - LP: #1413540
  * be2iscsi: fix memory leak in error path
    - LP: #1440156
  * block: remove old blk_iopoll_enabled variable
    - LP: #1440156
  * be2iscsi: Fix handling timed out MBX completion from FW
    - LP: #1440156
  * be2iscsi: Fix doorbell format for EQ/CQ/RQ s per SLI spec.
    - LP: #1440156
  * be2iscsi: Fix the session cleanup when reboot/shutdown happens
    - LP: #1440156
  * be2iscsi: Fix scsi_cmnd leakage in driver.
    - LP: #1440156
  * be2iscsi : Fix DMA Out of SW-IOMMU space error
    - LP: #1440156
  * be2iscsi: Fix retrieving MCCQ_WRB in non-embedded Mbox path
    - LP: #1440156
  * be2iscsi: Fix exposing Host in sysfs after adapter initialization is
    complete
    - LP: #1440156
  * be2iscsi: Fix interrupt Coalescing mechanism.
    - LP: #1440156
  * be2iscsi: Fix TCP parameters while connection offloading.
    - LP: #1440156
  * be2iscsi: Fix memory corruption in MBX path
    - LP: #1440156
  * be2iscsi: Fix destroy MCC-CQ before MCC-EQ is destroyed
    - LP: #1440156
  * be2iscsi: add an missing goto in error path
    - LP: #1440156
  * be2iscsi: remove potential junk pointer free
    - LP: #1440156
  * be2iscsi: Fix memory leak in mgmt_set_ip()
    - LP: #1440156
  * be2iscsi: Fix the sparse warning introduced in previous submission
    - LP: #1440156
  * be2iscsi: Fix updating the boot enteries in sysfs
    - LP: #1440156
  * be2iscsi: Fix processing CQE before connection resources are freed
    - LP: #1440156
  * be2iscsi : Fix kernel panic during reboot/shutdown
    - LP: #1440156
  * fixed invalid assignment of 64bit mask to host dma_boundary for scatter
    gather segment boundary limit.
    - LP: #1440156
  * quota: Store maximum space limit in bytes
    - LP: #1441284
  * ip: zero sockaddr returned on error queue
    - LP: #1441284
  * net: rps: fix cpu unplug
    - LP: #1441284
  * ipv6: stop sending PTB packets for MTU < 1280
    - LP: #1441284
  * netxen: fix netxen_nic_poll() logic
    - LP: #1441284
  * udp_diag: Fix socket skipping within chain
    - LP: #1441284
  * ping: Fix race in free in receive path
    - LP: #1441284
  * bnx2x: fix napi poll return value for repoll
    - LP: #1441284
  * net: don't OOPS on socket aio
    - LP: #1441284
  * bridge: dont send notification when skb->len == 0 in rtnl_bridge_notify
    - LP: #1441284
  *...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-lts-utopic - 3.16.0-36.48~14.04.1

---------------
linux-lts-utopic (3.16.0-36.48~14.04.1) trusty; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1444249
  * Merged back Ubuntu-3.16.0-34.47 security release

linux (3.16.0-35.46) utopic; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1442324

  [ Andy Whitcroft ]

  * [Config] CONFIG_DEFAULT_MMAP_MIN_ADDR needs to match on armhf and arm64
    - LP: #1418140

  [ Chris J Arges ]

  * [Config] CONFIG_PCIEASPM_DEBUG=y
    - LP: #1398544

  [ dann frazier ]

  * [Config] CONFIG_RTC_DRV_EFI=y on arm64
    - LP: #1441291

  [ Upstream Kernel Changes ]

  * Revert "USB: serial: make bulk_out_size a lower limit"
    - LP: #1441317
  * Revert "i2c: core: Dispose OF IRQ mapping at client removal time"
    - LP: #1441317
  * Revert "net: cx82310_eth: use common match macro"
    - LP: #1441317
  * KEYS: request_key() should reget expired keys rather than give
    EKEYEXPIRED
    - LP: #1124250
  * drm/i915/bdw: 3D_CHICKEN3 has write mask bits
    - LP: #1374389
  * drm/i915: call lpt_init_clock_gating on BDW too
    - LP: #1374389
  * drm/i915/bdw: Apply workarounds in render ring init function
    - LP: #1374389
  * drm/i915/bdw: Cleanup pre prod workarounds
    - LP: #1374389
  * drm/i915: Refactor Broadwell PIPE_CONTROL emission into a helper.
    - LP: #1374389
  * drm/i915: Add the WaCsStallBeforeStateCacheInvalidate:bdw workaround.
    - LP: #1374389
  * drm/i915/bdw: Remove BDW preproduction W/As until C stepping.
    - LP: #1374389
  * drm/i915: Rework GPU reset sequence to match driver load & thaw
    - LP: #1384469
  * drm/ast: switch to using CACHED by default for sysram
    - LP: #1420627
  * drm/ast: Add missing entry to dclk_table[]
    - LP: #1420627
  * drm/ast: Add reduced blanking modes for wide screen mode
    - LP: #1420627
  * drm/ast: Try to use MMIO registers when PIO isn't supported
    - LP: #1420627
  * drm/ast: POST chip at probe time if VGA not enabled
    - LP: #1420627
  * drm/ast: Properly initialize P2A base before using it in
    ast_init_3rdtx()
    - LP: #1420627
  * drm/ast: Don't assume DVO enabled means SIL164 on uninitialized chips
    - LP: #1420627
  * drm/ast: Cleanup analog init code path
    - LP: #1420627
  * audit: correctly record file names with different path name types
    - LP: #1439441
  * of: Create of_console_check() for selecting a console specified in
    /chosen
    - LP: #1438585
  * of: Enable console on serial ports specified by /chosen/stdout-path
    - LP: #1438585
  * of: correct of_console_check()'s return value
    - LP: #1438585
  * of: Add bindings for chosen node, stdout-path
    - LP: #1438585
  * of: add optional options parameter to of_find_node_by_path()
    - LP: #1438585
  * of: support passing console options with stdout-path
    - LP: #1438585
  * netfilter: nf_tables: disable preemption when restoring chain counters
    - LP: #1441317
  * netfilter: nf_tables: fix leaks in error path of nf_tables_newchain()
    - LP: #1441317
  * ipvs: rerouting to local clients is not needed anymore
    - LP: #1441317
  * netfilter: nft_compat: fix module refcount...

[Rolf Leggewie (r0lf)]

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".