CVE-2014-5077

[John Johansen]

The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction.

Break-Fix: - 1be9a950c646c9092fb3618197f7b6bfb50e82aa

[John Johansen (jjohansen)]

CVE-2014-5077

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 2.6.32-65.131

---------------
linux (2.6.32-65.131) lucid; urgency=low

  [ Joseph Salisbury ]

  * Release Tracking Bug
    - LP: #1357394

  [ Upstream Kernel Changes ]

  * x86_32, entry: Store badsys error code in %eax
    - LP: #1334989
    - CVE-2014-4508

linux (2.6.32-65.129) lucid; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1355445

  [ Upstream Kernel Changes ]

  * fix autofs/afs/etc. magic mountpoint breakage
    - CVE-2014-0203
  * ALSA: control: Don't access controls outside of protected regions
    - LP: #1339297
    - CVE-2014-4653
  * ALSA: control: Fix replacing user controls
    - LP: #1339303, #1339304
    - CVE-2014-4655
  * ALSA: control: Handle numid overflow
    - LP: #1339306
    - CVE-2014-4656
  * ALSA: control: Make sure that id->index does not overflow
    - LP: #1339306
    - CVE-2014-4656
  * sctp: Fix sk_ack_backlog wrap-around problem
    - LP: #1336135
    - CVE-2014-4667
  * x86_32, entry: Do syscall exit work on badsys (CVE-2014-4508)
    - LP: #1334989
    - CVE-2014-4508
  * ALSA: control: Protect user controls against concurrent access
    - LP: #1339294
    - CVE-2014-4652
  * net: sctp: inherit auth_capable on INIT collisions
    - LP: #1349804
    - CVE-2014-5077
 -- Kamal Mostafa <email address hidden> Fri, 15 Aug 2014 11:22:44 -0700

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ec2 - 2.6.32-369.85

---------------
linux-ec2 (2.6.32-369.85) lucid; urgency=low

  [ Stefan Bader ]

  * Rebased to Ubuntu-2.6.32-65.129
  * Rebased to Ubuntu-2.6.32-65.131
  * Release Tracking Bug
    - LP: #1357410

  [ Upstream Kernel Changes ]

  * xen: x86_32, entry: Do syscall exit work on badsys (CVE-2014-4508)
    - LP: #1334989
    - CVE-2014-4508
  * xen: x86_32, entry: Store badsys error code in %eax
    - LP: #1334989
    - CVE-2014-4508

  [ Ubuntu: 2.6.32-65.131 ]

  * x86_32, entry: Store badsys error code in %eax
    - LP: #1334989
    - CVE-2014-4508

  [ Ubuntu: 2.6.32-65.129 ]

  * fix autofs/afs/etc. magic mountpoint breakage
    - CVE-2014-0203
  * ALSA: control: Don't access controls outside of protected regions
    - LP: #1339297
    - CVE-2014-4653
  * ALSA: control: Fix replacing user controls
    - LP: #1339303, #1339304
    - CVE-2014-4655
  * ALSA: control: Handle numid overflow
    - LP: #1339306
    - CVE-2014-4656
  * ALSA: control: Make sure that id->index does not overflow
    - LP: #1339306
    - CVE-2014-4656
  * sctp: Fix sk_ack_backlog wrap-around problem
    - CVE-2014-4667
  * x86_32, entry: Do syscall exit work on badsys (CVE-2014-4508)
    - LP: #1334989
    - CVE-2014-4508
  * ALSA: control: Protect user controls against concurrent access
    - LP: #1339294
    - CVE-2014-4652
  * net: sctp: inherit auth_capable on INIT collisions
    - LP: #1349804
    - CVE-2014-5077
 -- Stefan Bader <email address hidden> Fri, 15 Aug 2014 08:55:05 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.2.0-68.102

---------------
linux (3.2.0-68.102) precise; urgency=low

  [ Joseph Salisbury ]

  * Release Tracking Bug
    - LP: #1355387

  [ Joseph Salisbury ]

  * [Config] updateconfigs after Linux 3.2.62 update

  [ Upstream Kernel Changes ]

  * Revert "net: ipv4: ip_forward: fix inverted local_df test"
    - LP: #1337281
  * Revert "net: ip, ipv6: handle gso skbs in forwarding path"
    - LP: #1337281
  * Yama: handle 32-bit userspace prctl
    - LP: #1338883
  * mm: highmem: don't treat PKMAP_ADDR(LAST_PKMAP) as a highmem address
    - LP: #1348572
  * bluetooth: hci_ldisc: fix deadlock condition
    - LP: #1348572
  * genirq: Sanitize spurious interrupt detection of threaded irqs
    - LP: #1348572
  * UBIFS: fix an mmap and fsync race condition
    - LP: #1348572
  * Input: synaptics - add min/max quirk for the ThinkPad W540
    - LP: #1348572
  * ACPI: Fix conflict between customized DSDT and DSDT local copy
    - LP: #1348572
  * HID: core: fix validation of report id 0
    - LP: #1348572
  * IB/srp: Fix a sporadic crash triggered by cable pulling
    - LP: #1348572
  * reiserfs: drop vmtruncate
    - LP: #1348572
  * reiserfs: call truncate_setsize under tailpack mutex
    - LP: #1348572
  * ARM: imx: fix error handling in ipu device registration
    - LP: #1348572
  * matroxfb: perform a dummy read of M_STATUS
    - LP: #1348572
  * USB: Avoid runtime suspend loops for HCDs that can't handle
    suspend/resume
    - LP: #1348572
  * ARM: 8051/1: put_user: fix possible data corruption in put_user
    - LP: #1348572
  * Input: synaptics - T540p - unify with other LEN0034 models
    - LP: #1348572
  * mac80211: fix IBSS join by initializing last_scan_completed
    - LP: #1348572
  * drm/i915: s/DRM_ERROR/DRM_DEBUG in i915_gem_execbuffer.c
    - LP: #1348572
  * drm/i915: Only copy back the modified fields to userspace from
    execbuffer
    - LP: #1348572
  * ahci: add PCI ID for Marvell 88SE91A0 SATA Controller
    - LP: #1348572
  * ext4: fix zeroing of page during writeback
    - LP: #1348572
  * ext4: fix wrong assert in ext4_mb_normalize_request()
    - LP: #1348572
  * IB/qib: Fix port in pkey change event
    - LP: #1348572
  * IB/ipath: Translate legacy diagpkt into newer extended diagpkt
    - LP: #1348572
  * USB: sierra: fix AA deadlock in open error path
    - LP: #1348572
  * USB: sierra: fix urb and memory leak in resume error path
    - LP: #1348572
  * USB: sierra: fix urb and memory leak on disconnect
    - LP: #1348572
  * USB: sierra: fix remote wakeup
    - LP: #1348572
  * USB: option: fix runtime PM handling
    - LP: #1348572
  * USB: usb_wwan: fix urb leak in write error path
    - LP: #1348572
  * USB: usb_wwan: fix race between write and resume
    - LP: #1348572
  * USB: usb_wwan: fix write and suspend race
    - LP: #1348572
  * USB: usb_wwan: fix urb leak at shutdown
    - LP: #1348572
  * USB: usb_wwan: fix potential blocked I/O after resume
    - LP: #1348572
  * USB: cdc-acm: fix write and suspend race
    - LP: #1348572
  * USB: cdc-acm: fix write and resume race
    - LP: #1348572
  * USB: cdc-acm: fix broken runtime suspend
    - LP: #1348572
  * USB: ...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-armadaxp - 3.2.0-1637.54

---------------
linux-armadaxp (3.2.0-1637.54) precise; urgency=low

  [ Ike Panhc ]

  * Release Tracking Bug
    - LP: #1356455
  * Rebase to Ubuntu-3.2.0-68.102

  [ Ubuntu: 3.2.0-68.102 ]

  * Release Tracking Bug
    - LP: #1355387
  * [Config] updateconfigs after Linux 3.2.62 update
  * Revert "net: ipv4: ip_forward: fix inverted local_df test"
    - LP: #1337281
  * Revert "net: ip, ipv6: handle gso skbs in forwarding path"
    - LP: #1337281
  * Yama: handle 32-bit userspace prctl
    - LP: #1338883
  * mm: highmem: don't treat PKMAP_ADDR(LAST_PKMAP) as a highmem address
    - LP: #1348572
  * bluetooth: hci_ldisc: fix deadlock condition
    - LP: #1348572
  * genirq: Sanitize spurious interrupt detection of threaded irqs
    - LP: #1348572
  * UBIFS: fix an mmap and fsync race condition
    - LP: #1348572
  * Input: synaptics - add min/max quirk for the ThinkPad W540
    - LP: #1348572
  * ACPI: Fix conflict between customized DSDT and DSDT local copy
    - LP: #1348572
  * HID: core: fix validation of report id 0
    - LP: #1348572
  * IB/srp: Fix a sporadic crash triggered by cable pulling
    - LP: #1348572
  * reiserfs: drop vmtruncate
    - LP: #1348572
  * reiserfs: call truncate_setsize under tailpack mutex
    - LP: #1348572
  * ARM: imx: fix error handling in ipu device registration
    - LP: #1348572
  * matroxfb: perform a dummy read of M_STATUS
    - LP: #1348572
  * USB: Avoid runtime suspend loops for HCDs that can't handle
    suspend/resume
    - LP: #1348572
  * ARM: 8051/1: put_user: fix possible data corruption in put_user
    - LP: #1348572
  * Input: synaptics - T540p - unify with other LEN0034 models
    - LP: #1348572
  * mac80211: fix IBSS join by initializing last_scan_completed
    - LP: #1348572
  * drm/i915: s/DRM_ERROR/DRM_DEBUG in i915_gem_execbuffer.c
    - LP: #1348572
  * drm/i915: Only copy back the modified fields to userspace from
    execbuffer
    - LP: #1348572
  * ahci: add PCI ID for Marvell 88SE91A0 SATA Controller
    - LP: #1348572
  * ext4: fix zeroing of page during writeback
    - LP: #1348572
  * ext4: fix wrong assert in ext4_mb_normalize_request()
    - LP: #1348572
  * IB/qib: Fix port in pkey change event
    - LP: #1348572
  * IB/ipath: Translate legacy diagpkt into newer extended diagpkt
    - LP: #1348572
  * USB: sierra: fix AA deadlock in open error path
    - LP: #1348572
  * USB: sierra: fix urb and memory leak in resume error path
    - LP: #1348572
  * USB: sierra: fix urb and memory leak on disconnect
    - LP: #1348572
  * USB: sierra: fix remote wakeup
    - LP: #1348572
  * USB: option: fix runtime PM handling
    - LP: #1348572
  * USB: usb_wwan: fix urb leak in write error path
    - LP: #1348572
  * USB: usb_wwan: fix race between write and resume
    - LP: #1348572
  * USB: usb_wwan: fix write and suspend race
    - LP: #1348572
  * USB: usb_wwan: fix urb leak at shutdown
    - LP: #1348572
  * USB: usb_wwan: fix potential blocked I/O after resume
    - LP: #1348572
  * USB: cdc-acm: fix write and suspend race
    - LP: #1348572
  * USB: cdc-acm: fix write and resume race
    - LP: #1348572
  * USB: c...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.2.0-1452.72

---------------
linux-ti-omap4 (3.2.0-1452.72) precise; urgency=low

  * Release Tracking Bug
    - LP: #1356452

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.2.0-68.102

  [ Ubuntu: 3.2.0-68.102 ]

  * Release Tracking Bug
    - LP: #1355387
  * [Config] updateconfigs after Linux 3.2.62 update
  * Revert "net: ipv4: ip_forward: fix inverted local_df test"
    - LP: #1337281
  * Revert "net: ip, ipv6: handle gso skbs in forwarding path"
    - LP: #1337281
  * Yama: handle 32-bit userspace prctl
    - LP: #1338883
  * mm: highmem: don't treat PKMAP_ADDR(LAST_PKMAP) as a highmem address
    - LP: #1348572
  * bluetooth: hci_ldisc: fix deadlock condition
    - LP: #1348572
  * genirq: Sanitize spurious interrupt detection of threaded irqs
    - LP: #1348572
  * UBIFS: fix an mmap and fsync race condition
    - LP: #1348572
  * Input: synaptics - add min/max quirk for the ThinkPad W540
    - LP: #1348572
  * ACPI: Fix conflict between customized DSDT and DSDT local copy
    - LP: #1348572
  * HID: core: fix validation of report id 0
    - LP: #1348572
  * IB/srp: Fix a sporadic crash triggered by cable pulling
    - LP: #1348572
  * reiserfs: drop vmtruncate
    - LP: #1348572
  * reiserfs: call truncate_setsize under tailpack mutex
    - LP: #1348572
  * ARM: imx: fix error handling in ipu device registration
    - LP: #1348572
  * matroxfb: perform a dummy read of M_STATUS
    - LP: #1348572
  * USB: Avoid runtime suspend loops for HCDs that can't handle
    suspend/resume
    - LP: #1348572
  * ARM: 8051/1: put_user: fix possible data corruption in put_user
    - LP: #1348572
  * Input: synaptics - T540p - unify with other LEN0034 models
    - LP: #1348572
  * mac80211: fix IBSS join by initializing last_scan_completed
    - LP: #1348572
  * drm/i915: s/DRM_ERROR/DRM_DEBUG in i915_gem_execbuffer.c
    - LP: #1348572
  * drm/i915: Only copy back the modified fields to userspace from
    execbuffer
    - LP: #1348572
  * ahci: add PCI ID for Marvell 88SE91A0 SATA Controller
    - LP: #1348572
  * ext4: fix zeroing of page during writeback
    - LP: #1348572
  * ext4: fix wrong assert in ext4_mb_normalize_request()
    - LP: #1348572
  * IB/qib: Fix port in pkey change event
    - LP: #1348572
  * IB/ipath: Translate legacy diagpkt into newer extended diagpkt
    - LP: #1348572
  * USB: sierra: fix AA deadlock in open error path
    - LP: #1348572
  * USB: sierra: fix urb and memory leak in resume error path
    - LP: #1348572
  * USB: sierra: fix urb and memory leak on disconnect
    - LP: #1348572
  * USB: sierra: fix remote wakeup
    - LP: #1348572
  * USB: option: fix runtime PM handling
    - LP: #1348572
  * USB: usb_wwan: fix urb leak in write error path
    - LP: #1348572
  * USB: usb_wwan: fix race between write and resume
    - LP: #1348572
  * USB: usb_wwan: fix write and suspend race
    - LP: #1348572
  * USB: usb_wwan: fix urb leak at shutdown
    - LP: #1348572
  * USB: usb_wwan: fix potential blocked I/O after resume
    - LP: #1348572
  * USB: cdc-acm: fix write and suspend race
    - LP: #1348572
  * USB: cdc-acm: fix write and resume race
    - LP: #1348572
  * U...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.13.0-36.63

---------------
linux (3.13.0-36.63) trusty; urgency=low

  [ Joseph Salisbury ]

  * Release Tracking Bug
    - LP: #1365052

  [ Feng Kan ]

  * SAUCE: (no-up) irqchip:gic: change access of gicc_ctrl register to read
    modify write.
    - LP: #1357527
  * SAUCE: (no-up) arm64: optimized copy_to_user and copy_from_user
    assembly code
    - LP: #1358949

  [ Ming Lei ]

  * SAUCE: (no-up) Drop APM X-Gene SoC Ethernet driver
    - LP: #1360140
  * [Config] Drop XGENE entries
    - LP: #1360140
  * [Config] CONFIG_NET_XGENE=m for arm64
    - LP: #1360140

  [ Stefan Bader ]

  * SAUCE: Add compat macro for skb_get_hash
    - LP: #1358162
  * SAUCE: bcache: prevent crash on changing writeback_running
    - LP: #1357295

  [ Suman Tripathi ]

  * SAUCE: (no-up) arm64: Fix the csr-mask for APM X-Gene SoC AHCI SATA PHY
    clock DTS node.
    - LP: #1359489
  * SAUCE: (no-up) ahci_xgene: Skip the PHY and clock initialization if
    already configured by the firmware.
    - LP: #1359501
  * SAUCE: (no-up) ahci_xgene: Fix the link down in first attempt for the
    APM X-Gene SoC AHCI SATA host controller driver.
    - LP: #1359507

  [ Tuan Phan ]

  * SAUCE: (no-up) pci-xgene-msi: fixed deadlock in irq_set_affinity
    - LP: #1359514

  [ Upstream Kernel Changes ]

  * iwlwifi: mvm: Add a missed beacons threshold
    - LP: #1349572
  * mac80211: reset probe_send_count also in HW_CONNECTION_MONITOR case
    - LP: #1349572
  * genirq: Add an accessor for IRQ_PER_CPU flag
    - LP: #1357527
  * arm64: perf: add support for percpu pmu interrupt
    - LP: #1357527
  * cifs: sanity check length of data to send before sending
    - LP: #1283101
  * KVM: nVMX: Pass vmexit parameters to nested_vmx_vmexit
    - LP: #1329434
  * KVM: nVMX: Rework interception of IRQs and NMIs
    - LP: #1329434
  * KVM: vmx: disable APIC virtualization in nested guests
    - LP: #1329434
  * HID: Add transport-driver functions to the USB HID interface.
    - LP: #1353021
  * ahci_xgene: Removing NCQ support from the APM X-Gene SoC AHCI SATA Host
    Controller driver.
    - LP: #1358498
  * fold d_kill() and d_free()
    - LP: #1354234
  * fold try_prune_one_dentry()
    - LP: #1354234
  * new helper: dentry_free()
    - LP: #1354234
  * expand the call of dentry_lru_del() in dentry_kill()
    - LP: #1354234
  * dentry_kill(): don't try to remove from shrink list
    - LP: #1354234
  * don't remove from shrink list in select_collect()
    - LP: #1354234
  * more graceful recovery in umount_collect()
    - LP: #1354234
  * dcache: don't need rcu in shrink_dentry_list()
    - LP: #1354234
  * lift the "already marked killed" case into shrink_dentry_list()
  * split dentry_kill()
    - LP: #1354234
  * expand dentry_kill(dentry, 0) in shrink_dentry_list()
    - LP: #1354234
  * shrink_dentry_list(): take parent's ->d_lock earlier
    - LP: #1354234
  * dealing with the rest of shrink_dentry_list() livelock
    - LP: #1354234
  * dentry_kill() doesn't need the second argument now
    - LP: #1354234
  * dcache: add missing lockdep annotation
    - LP: #1354234
  * fs: convert use of typedef ctl_table to struct ctl_table
 ...

[Mathew Hodson (mhodson)]

utopic, vivid are not affected according to http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-5077.html

[Rolf Leggewie (r0lf)]

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".

[Rolf Leggewie (r0lf)]

utopic has seen the end of its life and is no longer receiving any updates. Marking the utopic task for this ticket as "Won't Fix".

[Andy Whitcroft (apw)]

This bug was nominated against a series that is no longer supported, ie vivid. The bug task representing the vivid nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.