CVE-2015-8104

[Luis Henriques]

The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (aka Debug) exceptions, related to svm.c.

Break-Fix: - cbdb967af3d54993f5814f1cee0ed311a055377d

[Luis Henriques (henrix)]

CVE-2015-8104

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.2.0-96.136

---------------
linux (3.2.0-96.136) precise; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1521325

  [ Andy Whitcroft ]

  * [Packaging] control -- make element ordering deterministic
    - LP: #1516686
  * [Packaging] control -- prepare for new kernel-wedge semantics
    - LP: #1516686

  [ Upstream Kernel Changes ]

  * Revert "KVM: x86: vmx: avoid guest->host DOS by intercepting #AC"
  * Revert "KVM: MMU: fix validation of mmio page fault"
    - LP: #1520200
  * module: Fix locking in symbol_put_addr()
    - LP: #1520200
  * regmap: debugfs: Ensure we don't underflow when printing access masks
    - LP: #1520200
  * regmap: debugfs: Don't bother actually printing when calculating max
    length
    - LP: #1520200
  * ath9k: declare required extra tx headroom
    - LP: #1520200
  * m68k: Define asmlinkage_protect
    - LP: #1520200
  * x86/xen: Do not clip xen_e820_map to xen_e820_map_entries when
    sanitizing map
    - LP: #1520200
  * UBI: Validate data_size
    - LP: #1520200
  * UBI: return ENOSPC if no enough space available
    - LP: #1520200
  * MIPS: dma-default: Fix 32-bit fall back to GFP_DMA
    - LP: #1520200
  * x86/process: Add proper bound checks in 64bit get_wchan()
    - LP: #1520200
  * genirq: Fix race in register_irq_proc()
    - LP: #1520200
  * mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy
    a fault
    - LP: #1520200
  * Do not fall back to SMBWriteX in set_file_size error cases
    - LP: #1520200
  * md/raid0: update queue parameter in a safer location.
    - LP: #1520200
  * md/raid0: apply base queue limits *before* disk_stack_limits
    - LP: #1520200
  * clocksource: Fix abs() usage w/ 64bit values
    - LP: #1520200
  * iio: accel: sca3000: memory corruption in sca3000_read_first_n_hw_rb()
    - LP: #1520200
  * USB: Add reset-resume quirk for two Plantronics usb headphones.
    - LP: #1520200
  * usb: Add device quirk for Logitech PTZ cameras
    - LP: #1520200
  * tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c
    - LP: #1520200
  * drivers/tty: require read access for controlling terminal
    - LP: #1520200
  * ppp: don't override sk->sk_state in pppoe_flush_dev()
    - LP: #1520200
  * iwlwifi: dvm: fix D3 firmware PN programming
    - LP: #1520200
  * ALSA: synth: Fix conflicting OSS device registration on AWE32
    - LP: #1520200
  * sched/core: Fix TASK_DEAD race in finish_task_switch()
    - LP: #1520200
  * 3w-9xxx: don't unmap bounce buffered commands
    - LP: #1520200
  * xen-blkfront: check for null drvdata in blkback_changed
    (XenbusStateClosing)
    - LP: #1520200
  * ALSA: hda - Fix inverted internal mic on Lenovo G50-80
    - LP: #1504778, #1520200
  * crypto: ahash - ensure statesize is non-zero
    - LP: #1520200
  * iommu/vt-d: fix range computation when making room for large pages
    - LP: #1520200
  * xhci: don't finish a TD if we get a short transfer event mid TD
    - LP: #1520200
  * xhci: handle no ping response error properly
    - LP: #1520200
  * xhci: Switch Intel Lynx Point LP ports to EHCI on shutdown.
    - LP: #1520200
  * xhci: Add spurious wak...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-armadaxp - 3.2.0-1660.84

---------------
linux-armadaxp (3.2.0-1660.84) precise; urgency=low

  [ Ike Panhc ]

  * Release Tracking Bug
    - LP: #1521448
  * Rebase to Ubuntu-3.2.0-96.136

  [ Ubuntu: 3.2.0-96.136 ]

  * Release Tracking Bug
    - LP: #1521325
  * [Packaging] control -- make element ordering deterministic
    - LP: #1516686
  * [Packaging] control -- prepare for new kernel-wedge semantics
    - LP: #1516686
  * Revert "KVM: x86: vmx: avoid guest->host DOS by intercepting #AC"
  * Revert "KVM: MMU: fix validation of mmio page fault"
    - LP: #1520200
  * module: Fix locking in symbol_put_addr()
    - LP: #1520200
  * regmap: debugfs: Ensure we don't underflow when printing access masks
    - LP: #1520200
  * regmap: debugfs: Don't bother actually printing when calculating max
    length
    - LP: #1520200
  * ath9k: declare required extra tx headroom
    - LP: #1520200
  * m68k: Define asmlinkage_protect
    - LP: #1520200
  * x86/xen: Do not clip xen_e820_map to xen_e820_map_entries when
    sanitizing map
    - LP: #1520200
  * UBI: Validate data_size
    - LP: #1520200
  * UBI: return ENOSPC if no enough space available
    - LP: #1520200
  * MIPS: dma-default: Fix 32-bit fall back to GFP_DMA
    - LP: #1520200
  * x86/process: Add proper bound checks in 64bit get_wchan()
    - LP: #1520200
  * genirq: Fix race in register_irq_proc()
    - LP: #1520200
  * mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy
    a fault
    - LP: #1520200
  * Do not fall back to SMBWriteX in set_file_size error cases
    - LP: #1520200
  * md/raid0: update queue parameter in a safer location.
    - LP: #1520200
  * md/raid0: apply base queue limits *before* disk_stack_limits
    - LP: #1520200
  * clocksource: Fix abs() usage w/ 64bit values
    - LP: #1520200
  * iio: accel: sca3000: memory corruption in sca3000_read_first_n_hw_rb()
    - LP: #1520200
  * USB: Add reset-resume quirk for two Plantronics usb headphones.
    - LP: #1520200
  * usb: Add device quirk for Logitech PTZ cameras
    - LP: #1520200
  * tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c
    - LP: #1520200
  * drivers/tty: require read access for controlling terminal
    - LP: #1520200
  * ppp: don't override sk->sk_state in pppoe_flush_dev()
    - LP: #1520200
  * iwlwifi: dvm: fix D3 firmware PN programming
    - LP: #1520200
  * ALSA: synth: Fix conflicting OSS device registration on AWE32
    - LP: #1520200
  * sched/core: Fix TASK_DEAD race in finish_task_switch()
    - LP: #1520200
  * 3w-9xxx: don't unmap bounce buffered commands
    - LP: #1520200
  * xen-blkfront: check for null drvdata in blkback_changed
    (XenbusStateClosing)
    - LP: #1520200
  * ALSA: hda - Fix inverted internal mic on Lenovo G50-80
    - LP: #1504778, #1520200
  * crypto: ahash - ensure statesize is non-zero
    - LP: #1520200
  * iommu/vt-d: fix range computation when making room for large pages
    - LP: #1520200
  * xhci: don't finish a TD if we get a short transfer event mid TD
    - LP: #1520200
  * xhci: handle no ping response error properly
    - LP: #1520200
  * xhci: Switch Intel Lynx Point LP ...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-lts-utopic - 3.16.0-56.75~14.04.1

---------------
linux-lts-utopic (3.16.0-56.75~14.04.1) trusty; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1521942

  [ Andy Whitcroft ]

  * [Packaging] control -- make element ordering deterministic
    - LP: #1516686
  * [Packaging] control -- prepare for new kernel-wedge semantics
    - LP: #1516686
  * [Debian] rebuild should only trigger for non-linux packages
    - LP: #1498862, #1516686
  * [Tests] gcc-multilib does not exist on ppc64el
    - LP: #1515541

  [ Brad Figg ]

  * SAUCE: DEP8 test to run our regression tests
    - LP: #1515541

  [ Upstream Kernel Changes ]

  * Revert "ARM64: unwind: Fix PC calculation"
    - LP: #1520282
  * Revert "md: allow a partially recovered device to be hot-added to an
    array."
    - LP: #1520282
  * xhci: Workaround to get Intel xHCI reset working more reliably
  * regmap: debugfs: Ensure we don't underflow when printing access masks
    - LP: #1520282
  * regmap: debugfs: Don't bother actually printing when calculating max
    length
    - LP: #1520282
  * x86/xen: Support kexec/kdump in HVM guests by doing a soft reset
    - LP: #1520282
  * s390/boot/decompression: disable floating point in decompressor
    - LP: #1520282
  * svcrdma: handle rdma read with a non-zero initial page offset
    - LP: #1520282
  * dm: fix AB-BA deadlock in __dm_destroy()
    - LP: #1520282
  * [SMB3] Do not fall back to SMBWriteX in set_file_size error cases
    - LP: #1520282
  * clk: ti: fix dual-registration of uart4_ick
    - LP: #1520282
  * ASoC: dwc: correct irq clear method
    - LP: #1520282
  * dm raid: fix round up of default region size
    - LP: #1520282
  * ALSA: hda: Add dock support for ThinkPad T550
    - LP: #1520282
  * ALSA: hda - Apply SPDIF pin ctl to MacBookPro 12,1
    - LP: #1520282
  * USB: Add reset-resume quirk for two Plantronics usb headphones.
    - LP: #1520282
  * usb: Add device quirk for Logitech PTZ cameras
    - LP: #1520282
  * staging: speakup: fix speakup-r regression
    - LP: #1520282
  * ALSA: synth: Fix conflicting OSS device registration on AWE32
    - LP: #1520282
  * arm64: readahead: fault retry breaks mmap file read random detection
    - LP: #1520282
  * sched/core: Fix TASK_DEAD race in finish_task_switch()
    - LP: #1520282
  * dm cache: fix NULL pointer when switching from cleaner policy
    - LP: #1520282
  * 3w-9xxx: don't unmap bounce buffered commands
    - LP: #1520282
  * workqueue: make sure delayed work run in local cpu
    - LP: #1520282
  * drm/radeon: add pm sysfs files late
    - LP: #1520282
  * crypto: sparc - initialize blkcipher.ivsize
    - LP: #1520282
  * drm/nouveau/fbcon: take runpm reference when userspace has an open fd
    - LP: #1520282
  * crypto: ahash - ensure statesize is non-zero
    - LP: #1520282
  * dm thin: fix missing pool reference count decrement in pool_ctr error
    path
    - LP: #1520282
  * btrfs: check unsupported filters in balance arguments
    - LP: #1520282
  * btrfs: fix use after free iterating extrefs
    - LP: #1520282
  * i2c: rcar: enable RuntimePM before registering to the core
    - LP: #1520282
  * i2c...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.13.0-73.116

---------------
linux (3.13.0-73.116) trusty; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1522858

  [ Upstream Kernel Changes ]

  * Revert "dm: fix AB-BA deadlock in __dm_destroy()"
    - LP: #1522766
  * dm: fix AB-BA deadlock in __dm_destroy()
    - LP: #1522766

linux (3.13.0-72.115) trusty; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1521979

  [ Andy Whitcroft ]

  * [Packaging] control -- make element ordering deterministic
    - LP: #1516686
  * [Packaging] control -- prepare for new kernel-wedge semantics
    - LP: #1516686
  * [Tests] rebuild -- fix up rebuild test
    - LP: #1516686
  * [Debian] rebuild should only trigger for non-linux packages
    - LP: #1498862, #1516686
  * [Tests] gcc-multilib does not exist on ppc64el
    - LP: #1515541

  [ Craig Magina ]

  * [Config] Enable USB for arm64
    - LP: #1514971

  [ Duc Dang ]

  * SAUCE: (noup) arm64: dts: Add USB nodes for APM X-Gene v1 platforms
    - LP: #1514971

  [ Joseph Salisbury ]

  * SAUCE: scsi_sysfs: protect against double execution of
    __scsi_remove_device()
    - LP: #1509029

  [ Upstream Kernel Changes ]

  * Revert "ARM64: unwind: Fix PC calculation"
    - LP: #1520264
  * [SCSI] hpsa: allow SCSI mid layer to handle unit attention
    - LP: #1512415
  * usb: make xhci platform driver use 64 bit or 32 bit DMA
    - LP: #1514971
  * usb: Add support for ACPI identification to xhci-platform
    - LP: #1514971
  * xhci: Workaround to get Intel xHCI reset working more reliably
  * isdn_ppp: Add checks for allocation failure in isdn_ppp_open()
    - LP: #1520264
  * ppp, slip: Validate VJ compression slot parameters completely
    - LP: #1520264
  * staging/dgnc: fix info leak in ioctl
    - LP: #1520264
  * regmap: debugfs: Ensure we don't underflow when printing access masks
    - LP: #1520264
  * regmap: debugfs: Don't bother actually printing when calculating max
    length
    - LP: #1520264
  * tools lib traceevent: Fix string handling in heterogeneous arch
    environments
    - LP: #1520264
  * perf tools: Fix copying of /proc/kcore
    - LP: #1520264
  * ASoC: db1200: Fix DAI link format for db1300 and db1550
    - LP: #1520264
  * m68k: Define asmlinkage_protect
    - LP: #1520264
  * x86/xen: Support kexec/kdump in HVM guests by doing a soft reset
    - LP: #1520264
  * x86/xen: Do not clip xen_e820_map to xen_e820_map_entries when
    sanitizing map
    - LP: #1520264
  * UBI: return ENOSPC if no enough space available
    - LP: #1520264
  * s390/boot: fix boot of compressed kernel built with gcc 4.9
    - LP: #1520264
  * s390/boot/decompression: disable floating point in decompressor
    - LP: #1520264
  * MIPS: dma-default: Fix 32-bit fall back to GFP_DMA
    - LP: #1520264
  * drm/qxl: recreate the primary surface when the bo is not primary
    - LP: #1520264
  * genirq: Fix race in register_irq_proc()
    - LP: #1520264
  * KVM: nSVM: Check for NRIPS support before updating control field
    - LP: #1520264
  * Use WARN_ON_ONCE for missing X86_FEATURE_NRIPS
    - LP: #1520264
  * dm: fix AB-BA deadlock in __dm_destroy()
    - LP: #15202...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-lts-trusty - 3.13.0-73.116~precise1

---------------
linux-lts-trusty (3.13.0-73.116~precise1) precise; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1522991

  [ Upstream Kernel Changes ]

  * Revert "dm: fix AB-BA deadlock in __dm_destroy()"
    - LP: #1522766
  * dm: fix AB-BA deadlock in __dm_destroy()
    - LP: #1522766

linux (3.13.0-72.115) trusty; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1521979

  [ Andy Whitcroft ]

  * [Packaging] control -- make element ordering deterministic
    - LP: #1516686
  * [Packaging] control -- prepare for new kernel-wedge semantics
    - LP: #1516686
  * [Tests] rebuild -- fix up rebuild test
    - LP: #1516686
  * [Debian] rebuild should only trigger for non-linux packages
    - LP: #1498862, #1516686
  * [Tests] gcc-multilib does not exist on ppc64el
    - LP: #1515541

  [ Craig Magina ]

  * [Config] Enable USB for arm64
    - LP: #1514971

  [ Duc Dang ]

  * SAUCE: (noup) arm64: dts: Add USB nodes for APM X-Gene v1 platforms
    - LP: #1514971

  [ Joseph Salisbury ]

  * SAUCE: scsi_sysfs: protect against double execution of
    __scsi_remove_device()
    - LP: #1509029

  [ Upstream Kernel Changes ]

  * Revert "ARM64: unwind: Fix PC calculation"
    - LP: #1520264
  * [SCSI] hpsa: allow SCSI mid layer to handle unit attention
    - LP: #1512415
  * usb: make xhci platform driver use 64 bit or 32 bit DMA
    - LP: #1514971
  * usb: Add support for ACPI identification to xhci-platform
    - LP: #1514971
  * xhci: Workaround to get Intel xHCI reset working more reliably
  * isdn_ppp: Add checks for allocation failure in isdn_ppp_open()
    - LP: #1520264
  * ppp, slip: Validate VJ compression slot parameters completely
    - LP: #1520264
  * staging/dgnc: fix info leak in ioctl
    - LP: #1520264
  * regmap: debugfs: Ensure we don't underflow when printing access masks
    - LP: #1520264
  * regmap: debugfs: Don't bother actually printing when calculating max
    length
    - LP: #1520264
  * tools lib traceevent: Fix string handling in heterogeneous arch
    environments
    - LP: #1520264
  * perf tools: Fix copying of /proc/kcore
    - LP: #1520264
  * ASoC: db1200: Fix DAI link format for db1300 and db1550
    - LP: #1520264
  * m68k: Define asmlinkage_protect
    - LP: #1520264
  * x86/xen: Support kexec/kdump in HVM guests by doing a soft reset
    - LP: #1520264
  * x86/xen: Do not clip xen_e820_map to xen_e820_map_entries when
    sanitizing map
    - LP: #1520264
  * UBI: return ENOSPC if no enough space available
    - LP: #1520264
  * s390/boot: fix boot of compressed kernel built with gcc 4.9
    - LP: #1520264
  * s390/boot/decompression: disable floating point in decompressor
    - LP: #1520264
  * MIPS: dma-default: Fix 32-bit fall back to GFP_DMA
    - LP: #1520264
  * drm/qxl: recreate the primary surface when the bo is not primary
    - LP: #1520264
  * genirq: Fix race in register_irq_proc()
    - LP: #1520264
  * KVM: nSVM: Check for NRIPS support before updating control field
    - LP: #1520264
  * Use WARN_ON_ONCE for missing X86_FEATURE_NRIPS
    - LP: #1520264
  * dm: fix AB-BA de...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 4.2.0-21.25

---------------
linux (4.2.0-21.25) wily; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1522108

  [ Upstream Kernel Changes ]

  * staging/dgnc: fix info leak in ioctl
    - LP: #1509565
    - CVE-2015-7885
  * [media] media/vivid-osd: fix info leak in ioctl
    - LP: #1509564
    - CVE-2015-7884
  * KEYS: Fix race between key destruction and finding a keyring by name
    - LP: #1508856
    - CVE-2015-7872
  * KEYS: Fix crash when attempt to garbage collect an uninstantiated
    keyring
    - LP: #1508856
    - CVE-2015-7872
  * KEYS: Don't permit request_key() to construct a new keyring
    - LP: #1508856
    - CVE-2015-7872
  * isdn_ppp: Add checks for allocation failure in isdn_ppp_open()
    - LP: #1508329
    - CVE-2015-7799
  * ppp, slip: Validate VJ compression slot parameters completely
    - LP: #1508329
    - CVE-2015-7799

linux (4.2.0-20.24) wily; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1521753

  [ Andy Whitcroft ]

  * [Tests] gcc-multilib does not exist on ppc64el
    - LP: #1515541

  [ Joseph Salisbury ]

  * SAUCE: scsi_sysfs: protect against double execution of
    __scsi_remove_device()
    - LP: #1509029

  [ Manoj Kumar ]

  * SAUCE: (noup) cxlflash: Fix to escalate LINK_RESET also on port 1
    - LP: #1513583

  [ Matthew R. Ochs ]

  * SAUCE: (noup) cxlflash: Fix to avoid virtual LUN failover failure
    - LP: #1513583

  [ Oren Givon ]

  * SAUCE: (noup) iwlwifi: Add new PCI IDs for the 8260 series
    - LP: #1517375

  [ Seth Forshee ]

  * [Config] CONFIG_DRM_AMDGPU_CIK=n
    - LP: #1510405

  [ Upstream Kernel Changes ]

  * net/mlx5e: Disable VLAN filter in promiscuous mode
    - LP: #1514861
  * drivers: net: xgene: fix RGMII 10/100Mb mode
    - LP: #1433290
  * HID: rmi: Disable scanning if the device is not a wake source
    - LP: #1515503
  * HID: rmi: Set F01 interrupt enable register when not set
    - LP: #1515503
  * net/mlx5e: Ethtool link speed setting fixes
    - LP: #1517919
  * scsi_scan: don't dump trace when scsi_prep_async_scan() is called twice
    - LP: #1517942
  * x86/ioapic: Disable interrupts when re-routing legacy IRQs
    - LP: #1508593
  * xhci: Workaround to get Intel xHCI reset working more reliably
  * megaraid_sas: Do not use PAGE_SIZE for max_sectors
    - LP: #1475166
  * net: usb: cdc_ether: add Dell DW5580 as a mobile broadband adapter
    - LP: #1513847
  * KVM: svm: unconditionally intercept #DB
    - LP: #1520184
    - CVE-2015-8104

 -- Luis Henriques <email address hidden> Wed, 02 Dec 2015 17:30:58 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.19.0-41.46

---------------
linux (3.19.0-41.46) vivid; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1522918

  [ Upstream Kernel Changes ]

  * Revert "dm: fix AB-BA deadlock in __dm_destroy()"
    - LP: #1522766
  * dm: fix AB-BA deadlock in __dm_destroy()
    - LP: #1522766

linux (3.19.0-40.45) vivid; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1522786

  [ Andy Whitcroft ]

  * [Packaging] control -- prepare for new kernel-wedge semantics
    - LP: #1516686
  * [Debian] rebuild should only trigger for non-linux packages
    - LP: #1498862, #1516686
  * [Tests] gcc-multilib does not exist on ppc64el
    - LP: #1515541

  [ Joseph Salisbury ]

  * SAUCE: scsi_sysfs: protect against double execution of
    __scsi_remove_device()
    - LP: #1509029

  [ Luis Henriques ]

  * [Config] updateconfigs after 3.19.8-ckt10 stable update

  [ Upstream Kernel Changes ]

  * Revert "ARM64: unwind: Fix PC calculation"
    - LP: #1520309
  * Revert "md: allow a partially recovered device to be hot-added to an
    array."
    - LP: #1520309
  * tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c
    - LP: #1512815
  * HID: rmi: Print the firmware id of the touchpad
    - LP: #1515503
  * HID: rmi: Add functions for writing to registers
    - LP: #1515503
  * HID: rmi: Disable scanning if the device is not a wake source
    - LP: #1515503
  * HID: rmi: Set F01 interrupt enable register when not set
    - LP: #1515503
  * be2net: log link status
    - LP: #1513980
  * xhci: Workaround to get Intel xHCI reset working more reliably
  * Drivers: hv: hv_balloon: refuse to balloon below the floor
    - LP: #1294283
  * Drivers: hv: hv_balloon: survive ballooning request with num_pages=0
    - LP: #1294283
  * Drivers: hv: hv_balloon: correctly handle val.freeram<num_pages case
    - LP: #1294283
  * Drivers: hv: hv_balloon: correctly handle num_pages>INT_MAX case
    - LP: #1294283
  * Drivers: hv: balloon: check if ha_region_mutex was acquired in
    MEM_CANCEL_ONLINE case
    - LP: #1294283
  * mm: meminit: make __early_pfn_to_nid SMP-safe and introduce
    meminit_pfn_in_nid
    - LP: #1294283
  * mm: meminit: inline some helper functions
    - LP: #1294283
  * mm, meminit: allow early_pfn_to_nid to be used during runtime
    - LP: #1294283
  * mm: initialize hotplugged pages as reserved
    - LP: #1294283
  * gut proc_register() a bit
    - LP: #1519106
  * arm: factor out mmap ASLR into mmap_rnd
    - LP: #1518483
  * x86: standardize mmap_rnd() usage
    - LP: #1518483
  * arm64: standardize mmap_rnd() usage
    - LP: #1518483
  * mips: extract logic for mmap_rnd()
    - LP: #1518483
  * powerpc: standardize mmap_rnd() usage
    - LP: #1518483
  * s390: standardize mmap_rnd() usage
    - LP: #1518483
  * mm: expose arch_mmap_rnd when available
    - LP: #1518483
  * s390: redefine randomize_et_dyn for ELF_ET_DYN_BASE
    - LP: #1518483
  * mm: split ET_DYN ASLR from mmap ASLR
    - LP: #1518483
  * mm: fold arch_randomize_brk into ARCH_HAS_ELF_RANDOMIZE
    - LP: #1518483
  * isdn_ppp: Add checks for allocation failure in isdn_ppp_open()
   ...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-lts-vivid - 3.19.0-41.46~14.04.2

---------------
linux-lts-vivid (3.19.0-41.46~14.04.2) trusty; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1523036

  [ Upstream Kernel Changes ]

  * Revert "dm: fix AB-BA deadlock in __dm_destroy()"
    - LP: #1522766
  * dm: fix AB-BA deadlock in __dm_destroy()
    - LP: #1522766

linux (3.19.0-40.45) vivid; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1522786

  [ Andy Whitcroft ]

  * [Packaging] control -- prepare for new kernel-wedge semantics
    - LP: #1516686
  * [Debian] rebuild should only trigger for non-linux packages
    - LP: #1498862, #1516686
  * [Tests] gcc-multilib does not exist on ppc64el
    - LP: #1515541

  [ Joseph Salisbury ]

  * SAUCE: scsi_sysfs: protect against double execution of
    __scsi_remove_device()
    - LP: #1509029

  [ Luis Henriques ]

  * [Config] updateconfigs after 3.19.8-ckt10 stable update

  [ Upstream Kernel Changes ]

  * Revert "ARM64: unwind: Fix PC calculation"
    - LP: #1520309
  * Revert "md: allow a partially recovered device to be hot-added to an
    array."
    - LP: #1520309
  * tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c
    - LP: #1512815
  * HID: rmi: Print the firmware id of the touchpad
    - LP: #1515503
  * HID: rmi: Add functions for writing to registers
    - LP: #1515503
  * HID: rmi: Disable scanning if the device is not a wake source
    - LP: #1515503
  * HID: rmi: Set F01 interrupt enable register when not set
    - LP: #1515503
  * be2net: log link status
    - LP: #1513980
  * xhci: Workaround to get Intel xHCI reset working more reliably
  * Drivers: hv: hv_balloon: refuse to balloon below the floor
    - LP: #1294283
  * Drivers: hv: hv_balloon: survive ballooning request with num_pages=0
    - LP: #1294283
  * Drivers: hv: hv_balloon: correctly handle val.freeram<num_pages case
    - LP: #1294283
  * Drivers: hv: hv_balloon: correctly handle num_pages>INT_MAX case
    - LP: #1294283
  * Drivers: hv: balloon: check if ha_region_mutex was acquired in
    MEM_CANCEL_ONLINE case
    - LP: #1294283
  * mm: meminit: make __early_pfn_to_nid SMP-safe and introduce
    meminit_pfn_in_nid
    - LP: #1294283
  * mm: meminit: inline some helper functions
    - LP: #1294283
  * mm, meminit: allow early_pfn_to_nid to be used during runtime
    - LP: #1294283
  * mm: initialize hotplugged pages as reserved
    - LP: #1294283
  * gut proc_register() a bit
    - LP: #1519106
  * arm: factor out mmap ASLR into mmap_rnd
    - LP: #1518483
  * x86: standardize mmap_rnd() usage
    - LP: #1518483
  * arm64: standardize mmap_rnd() usage
    - LP: #1518483
  * mips: extract logic for mmap_rnd()
    - LP: #1518483
  * powerpc: standardize mmap_rnd() usage
    - LP: #1518483
  * s390: standardize mmap_rnd() usage
    - LP: #1518483
  * mm: expose arch_mmap_rnd when available
    - LP: #1518483
  * s390: redefine randomize_et_dyn for ELF_ET_DYN_BASE
    - LP: #1518483
  * mm: split ET_DYN ASLR from mmap ASLR
    - LP: #1518483
  * mm: fold arch_randomize_brk into ARCH_HAS_ELF_RANDOMIZE
    - LP: #1518483
  * isdn_ppp: Add checks for allo...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.2.0-1475.97

---------------
linux-ti-omap4 (3.2.0-1475.97) precise; urgency=low

  * Release Tracking Bug
    - LP: #1521445

  [ Luis Henriques ]

  * rebased on Ubuntu-3.2.0-96.136

  [ Ubuntu: 3.2.0-96.136 ]

  * Release Tracking Bug
    - LP: #1521325
  * [Packaging] control -- make element ordering deterministic
    - LP: #1516686
  * [Packaging] control -- prepare for new kernel-wedge semantics
    - LP: #1516686
  * Revert "KVM: x86: vmx: avoid guest->host DOS by intercepting #AC"
  * Revert "KVM: MMU: fix validation of mmio page fault"
    - LP: #1520200
  * module: Fix locking in symbol_put_addr()
    - LP: #1520200
  * regmap: debugfs: Ensure we don't underflow when printing access masks
    - LP: #1520200
  * regmap: debugfs: Don't bother actually printing when calculating max
    length
    - LP: #1520200
  * ath9k: declare required extra tx headroom
    - LP: #1520200
  * m68k: Define asmlinkage_protect
    - LP: #1520200
  * x86/xen: Do not clip xen_e820_map to xen_e820_map_entries when
    sanitizing map
    - LP: #1520200
  * UBI: Validate data_size
    - LP: #1520200
  * UBI: return ENOSPC if no enough space available
    - LP: #1520200
  * MIPS: dma-default: Fix 32-bit fall back to GFP_DMA
    - LP: #1520200
  * x86/process: Add proper bound checks in 64bit get_wchan()
    - LP: #1520200
  * genirq: Fix race in register_irq_proc()
    - LP: #1520200
  * mm: hugetlbfs: skip shared VMAs when unmapping private pages to satisfy
    a fault
    - LP: #1520200
  * Do not fall back to SMBWriteX in set_file_size error cases
    - LP: #1520200
  * md/raid0: update queue parameter in a safer location.
    - LP: #1520200
  * md/raid0: apply base queue limits *before* disk_stack_limits
    - LP: #1520200
  * clocksource: Fix abs() usage w/ 64bit values
    - LP: #1520200
  * iio: accel: sca3000: memory corruption in sca3000_read_first_n_hw_rb()
    - LP: #1520200
  * USB: Add reset-resume quirk for two Plantronics usb headphones.
    - LP: #1520200
  * usb: Add device quirk for Logitech PTZ cameras
    - LP: #1520200
  * tty: fix stall caused by missing memory barrier in drivers/tty/n_tty.c
    - LP: #1520200
  * drivers/tty: require read access for controlling terminal
    - LP: #1520200
  * ppp: don't override sk->sk_state in pppoe_flush_dev()
    - LP: #1520200
  * iwlwifi: dvm: fix D3 firmware PN programming
    - LP: #1520200
  * ALSA: synth: Fix conflicting OSS device registration on AWE32
    - LP: #1520200
  * sched/core: Fix TASK_DEAD race in finish_task_switch()
    - LP: #1520200
  * 3w-9xxx: don't unmap bounce buffered commands
    - LP: #1520200
  * xen-blkfront: check for null drvdata in blkback_changed
    (XenbusStateClosing)
    - LP: #1520200
  * ALSA: hda - Fix inverted internal mic on Lenovo G50-80
    - LP: #1504778, #1520200
  * crypto: ahash - ensure statesize is non-zero
    - LP: #1520200
  * iommu/vt-d: fix range computation when making room for large pages
    - LP: #1520200
  * xhci: don't finish a TD if we get a short transfer event mid TD
    - LP: #1520200
  * xhci: handle no ping response error properly
    - LP: #1520200
  * xhci: Switch Intel Lynx Po...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-raspi2 - 4.2.0-1016.23

---------------
linux-raspi2 (4.2.0-1016.23) wily; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1522372
  * rebased on Ubuntu-4.2.0-21.25

  [ Ubuntu: 4.2.0-21.25 ]

  * Release Tracking Bug
    - LP: #1522108
  * staging/dgnc: fix info leak in ioctl
    - LP: #1509565
    - CVE-2015-7885
  * [media] media/vivid-osd: fix info leak in ioctl
    - LP: #1509564
    - CVE-2015-7884
  * KEYS: Fix race between key destruction and finding a keyring by name
    - LP: #1508856
    - CVE-2015-7872
  * KEYS: Fix crash when attempt to garbage collect an uninstantiated
    keyring
    - LP: #1508856
    - CVE-2015-7872
  * KEYS: Don't permit request_key() to construct a new keyring
    - LP: #1508856
    - CVE-2015-7872
  * isdn_ppp: Add checks for allocation failure in isdn_ppp_open()
    - LP: #1508329
    - CVE-2015-7799
  * ppp, slip: Validate VJ compression slot parameters completely
    - LP: #1508329
    - CVE-2015-7799

  [ Ubuntu: 4.2.0-20.24 ]

  * Release Tracking Bug
    - LP: #1521753
  * [Tests] gcc-multilib does not exist on ppc64el
    - LP: #1515541
  * SAUCE: scsi_sysfs: protect against double execution of
    __scsi_remove_device()
    - LP: #1509029
  * SAUCE: (noup) cxlflash: Fix to escalate LINK_RESET also on port 1
    - LP: #1513583
  * SAUCE: (noup) cxlflash: Fix to avoid virtual LUN failover failure
    - LP: #1513583
  * SAUCE: (noup) iwlwifi: Add new PCI IDs for the 8260 series
    - LP: #1517375
  * [Config] CONFIG_DRM_AMDGPU_CIK=n
    - LP: #1510405
  * net/mlx5e: Disable VLAN filter in promiscuous mode
    - LP: #1514861
  * drivers: net: xgene: fix RGMII 10/100Mb mode
    - LP: #1433290
  * HID: rmi: Disable scanning if the device is not a wake source
    - LP: #1515503
  * HID: rmi: Set F01 interrupt enable register when not set
    - LP: #1515503
  * net/mlx5e: Ethtool link speed setting fixes
    - LP: #1517919
  * scsi_scan: don't dump trace when scsi_prep_async_scan() is called twice
    - LP: #1517942
  * x86/ioapic: Disable interrupts when re-routing legacy IRQs
    - LP: #1508593
  * xhci: Workaround to get Intel xHCI reset working more reliably
  * megaraid_sas: Do not use PAGE_SIZE for max_sectors
    - LP: #1475166
  * net: usb: cdc_ether: add Dell DW5580 as a mobile broadband adapter
    - LP: #1513847
  * KVM: svm: unconditionally intercept #DB
    - LP: #1520184
    - CVE-2015-8104

 -- Luis Henriques <email address hidden> Thu, 03 Dec 2015 13:57:56 +0000

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-lts-wily - 4.2.0-21.25~14.04.1

---------------
linux-lts-wily (4.2.0-21.25~14.04.1) trusty; urgency=low

  [ Luis Henriques ]

  * Release Tracking Bug
    - LP: #1522374

  [ Upstream Kernel Changes ]

  * staging/dgnc: fix info leak in ioctl
    - LP: #1509565
    - CVE-2015-7885
  * [media] media/vivid-osd: fix info leak in ioctl
    - LP: #1509564
    - CVE-2015-7884
  * KEYS: Fix race between key destruction and finding a keyring by name
    - LP: #1508856
    - CVE-2015-7872
  * KEYS: Fix crash when attempt to garbage collect an uninstantiated
    keyring
    - LP: #1508856
    - CVE-2015-7872
  * KEYS: Don't permit request_key() to construct a new keyring
    - LP: #1508856
    - CVE-2015-7872
  * isdn_ppp: Add checks for allocation failure in isdn_ppp_open()
    - LP: #1508329
    - CVE-2015-7799
  * ppp, slip: Validate VJ compression slot parameters completely
    - LP: #1508329
    - CVE-2015-7799

linux (4.2.0-20.24) wily; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1521753

  [ Andy Whitcroft ]

  * [Tests] gcc-multilib does not exist on ppc64el
    - LP: #1515541

  [ Joseph Salisbury ]

  * SAUCE: scsi_sysfs: protect against double execution of
    __scsi_remove_device()
    - LP: #1509029

  [ Manoj Kumar ]

  * SAUCE: (noup) cxlflash: Fix to escalate LINK_RESET also on port 1
    - LP: #1513583

  [ Matthew R. Ochs ]

  * SAUCE: (noup) cxlflash: Fix to avoid virtual LUN failover failure
    - LP: #1513583

  [ Oren Givon ]

  * SAUCE: (noup) iwlwifi: Add new PCI IDs for the 8260 series
    - LP: #1517375

  [ Seth Forshee ]

  * [Config] CONFIG_DRM_AMDGPU_CIK=n
    - LP: #1510405

  [ Upstream Kernel Changes ]

  * net/mlx5e: Disable VLAN filter in promiscuous mode
    - LP: #1514861
  * drivers: net: xgene: fix RGMII 10/100Mb mode
    - LP: #1433290
  * HID: rmi: Disable scanning if the device is not a wake source
    - LP: #1515503
  * HID: rmi: Set F01 interrupt enable register when not set
    - LP: #1515503
  * net/mlx5e: Ethtool link speed setting fixes
    - LP: #1517919
  * scsi_scan: don't dump trace when scsi_prep_async_scan() is called twice
    - LP: #1517942
  * x86/ioapic: Disable interrupts when re-routing legacy IRQs
    - LP: #1508593
  * xhci: Workaround to get Intel xHCI reset working more reliably
  * megaraid_sas: Do not use PAGE_SIZE for max_sectors
    - LP: #1475166
  * net: usb: cdc_ether: add Dell DW5580 as a mobile broadband adapter
    - LP: #1513847
  * KVM: svm: unconditionally intercept #DB
    - LP: #1520184
    - CVE-2015-8104

 -- Luis Henriques <email address hidden> Thu, 03 Dec 2015 11:41:35 +0000

[Andy Whitcroft (apw)]

This bug was nominated against a series that is no longer supported, ie yakkety. The bug task representing the yakkety nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

[Steve Langasek (vorlon)]

The Precise Pangolin has reached end of life, so this bug will not be fixed for that release