CVE-2011-4326

[John Johansen]

The udp6_ufo_fragment function in net/ipv6/udp.c in the Linux kernel before 2.6.39, when a certain UDP Fragmentation Offload (UFO) configuration is enabled, allows remote attackers to cause a denial of service (system crash) by sending fragmented IPv6 UDP packets to a bridge device.

Break-Fix: ba73542585a4a3c8a708f502e62e6e63dd74b66c a9cf73ea7ff78f52662c8658d93c226effbbedde

[John Johansen (jjohansen)]

CVE-2011-4326

[Stefan Bader (smb)]

The complete function containing the incorrect code was not added before 2.6.32 by:

commit ba73542585a4a3c8a708f502e62e6e63dd74b66c
Author: Sridhar Samudrala <email address hidden>
Date: Thu Jul 9 08:10:04 2009 +0000

    udpv6: Handle large incoming UDP/IPv6 packets and support software UFO

    - validate and forward GSO UDP/IPv6 packets from untrusted sources.
    - do software UFO if the outgoing device doesn't support UFO.

    Signed-off-by: Sridhar Samudrala <email address hidden>
    Acked-by: Herbert Xu <email address hidden>
    Signed-off-by: David S. Miller <email address hidden>

[Stefan Bader (smb)]

Since fsl-imx51 is 2.6.31 based this is not affected either.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 2.6.35-31.63

---------------
linux (2.6.35-31.63) maverick-proposed; urgency=low

  [Herton R. Krzesinski]

  * Release Tracking Bug
    - LP: #897265

  [ Upstream Kernel Changes ]

  * crypto: ghash - Avoid null pointer dereference if no key is set
    - LP: #887299
    - CVE-2011-4081
  * xfs: Fix possible memory corruption in xfs_readlink, CVE-2011-4077
    - LP: #887298
    - CVE-2011-4077
  * jbd/jbd2: validate sb->s_first in journal_get_superblock()
    - LP: #893148
    - CVE-2011-4132
  * hfs: add sanity check for file name length, CVE-2011-4330
    - LP: #894374
    - CVE-2011-4330
  * ipv6: udp: fix the wrong headroom check
    - LP: #894373
    - CVE-2011-4326
 -- Herton Ronaldo Krzesinski <email address hidden> Mon, 28 Nov 2011 14:05:38 -0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-lts-backport-maverick - 2.6.35-31.63~lucid1

---------------
linux-lts-backport-maverick (2.6.35-31.63~lucid1) lucid-proposed; urgency=low

  [Herton R. Krzesinski]

  * Release Tracking Bug
    - LP: #897744

  [ Upstream Kernel Changes ]

  * crypto: ghash - Avoid null pointer dereference if no key is set
    - LP: #887299
    - CVE-2011-4081
  * xfs: Fix possible memory corruption in xfs_readlink, CVE-2011-4077
    - LP: #887298
    - CVE-2011-4077
  * jbd/jbd2: validate sb->s_first in journal_get_superblock()
    - LP: #893148
    - CVE-2011-4132
  * hfs: add sanity check for file name length, CVE-2011-4330
    - LP: #894374
    - CVE-2011-4330
  * ipv6: udp: fix the wrong headroom check
    - LP: #894373
    - CVE-2011-4326

linux (2.6.35-31.62) maverick-proposed; urgency=low

  [Herton R. Krzesinski]

  * Release Tracking Bug
    - LP: #887378

  [ Upstream Kernel Changes ]

  * ipv6: restore correct ECN handling on TCP xmit
    - LP: #872179
  * nl80211: fix overflow in ssid_len - CVE-2011-2517
    - LP: #869245
    - CVE-2011-2517
  * vm: fix vm_pgoff wrap in stack expansion - CVE-2011-2496
    - LP: #869243
    - CVE-2011-2496
  * vm: fix vm_pgoff wrap in upward expansion - CVE-2011-2496
    - LP: #869243
    - CVE-2011-2496
  * ksm: fix NULL pointer dereference in scan_get_next_rmap_item() -
    CVE-2011-2183
    - LP: #869227
    - CVE-2011-2183
  * NLM: Don't hang forever on NLM unlock requests - CVE-2011-2491
    - LP: #869237
    - CVE-2011-2491
  * cifs: clean up cifs_find_smb_ses (try #2), CVE-2011-1585
    - LP: #869208
    - CVE-2011-1585
  * cifs: fix NULL pointer dereference in cifs_find_smb_ses, CVE-2011-1585
    - LP: #869208
    - CVE-2011-1585
  * cifs: check for NULL session password, CVE-2011-1585
    - LP: #869208
    - CVE-2011-1585
 -- Herton Ronaldo Krzesinski <email address hidden> Tue, 29 Nov 2011 15:42:23 -0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 2.6.38-1209.18

---------------
linux-ti-omap4 (2.6.38-1209.18) natty-proposed; urgency=low

  * Release Tracking Bug
    - LP: #897566

  [ Upstream Kernel Changes ]

  * crypto: ghash - Avoid null pointer dereference if no key is set
    - LP: #887299
    - CVE-2011-4081
  * xfs: Fix possible memory corruption in xfs_readlink, CVE-2011-4077
    - LP: #887298
    - CVE-2011-4077
  * jbd/jbd2: validate sb->s_first in journal_get_superblock()
    - LP: #893148
    - CVE-2011-4132
  * inetpeer: reduce stack usage, CVE-2011-4087
    - LP: #887302
    - CVE-2011-4087
  * hfs: add sanity check for file name length, CVE-2011-4330
    - LP: #894374
    - CVE-2011-4330
  * ipv6: udp: fix the wrong headroom check
    - LP: #894373
    - CVE-2011-4326
 -- Paolo Pisati <email address hidden> Fri, 02 Dec 2011 13:15:41 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 2.6.35-903.28

---------------
linux-ti-omap4 (2.6.35-903.28) maverick-proposed; urgency=low

  * Release Tracking Bug
    - LP: #897740

  [ Upstream Kernel Changes ]

  * crypto: ghash - Avoid null pointer dereference if no key is set
    - LP: #887299
    - CVE-2011-4081
  * xfs: Fix possible memory corruption in xfs_readlink, CVE-2011-4077
    - LP: #887298
    - CVE-2011-4077
  * jbd/jbd2: validate sb->s_first in journal_get_superblock()
    - LP: #893148
    - CVE-2011-4132
  * hfs: add sanity check for file name length, CVE-2011-4330
    - LP: #894374
    - CVE-2011-4330
  * ipv6: udp: fix the wrong headroom check
    - LP: #894373
    - CVE-2011-4326
  * mm: make the vma list be doubly linked
    - LP: #893190
  * mm: make the mlock() stack guard page checks stricter
    - LP: #893190
  * mm: make stack guard page logic use vm_prev pointer
    - LP: #893190
  * mm: Move vma_stack_continue into mm.h
    - LP: #672664, #893190
  * Yama: fix default relationship to check thread group
    - LP: #737676, #893190
  * Yama: use thread group leader when creating match
    - LP: #729839, #893190
 -- Paolo Pisati <email address hidden> Fri, 02 Dec 2011 13:04:02 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-mvl-dove - 2.6.32-421.39

---------------
linux-mvl-dove (2.6.32-421.39) maverick-proposed; urgency=low

  * Release Tracking Bug
    - LP: #897742

  [ Paolo Pisati ]

  * Rebased to 2.6.32-37.80

  [ Ubuntu: 2.6.32-37.80 ]

  * Release Tracking Bug
    - LP: #898283
  * Revert "x86, hotplug: Use mwait to offline a processor, fix the legacy
    case"
    - LP: #888042
  * Revert "usb: musb: restore INDEX register in resume path"
    - LP: #888042
  * Revert "MIPS: MTX-1: Make au1000_eth probe all PHY
    - LP: #888042
  * Revert "ALSA: hda: Fix quirk for Dell Inspiron 910"
    - LP: #875300
  * USB: ftdi_sio: add Calao reference board support
    - LP: #888042
  * USB: EHCI: Do not rely on PORT_SUSPEND to stop USB resuming in
    ehci_bus_resume().
    - LP: #888042
  * rt2x00: do not drop usb dev reference counter on suspend
    - LP: #888042
  * atm: br2684: Fix oops due to skb->dev being NULL
    - LP: #888042
  * sparc: Allow handling signals when stack is corrupted.
    - LP: #888042
  * sparc: fix array bounds error setting up PCIC NMI trap
    - LP: #888042
  * net: Fix IPv6 GSO type checks in Intel ethernet drivers
    - LP: #888042
  * ipv6: Add GSO support on forwarding path
    - LP: #888042
  * GRO: fix merging a paged skb after non-paged skbs
    - LP: #888042
  * xen-blkfront: fix data size for xenbus_gather in blkfront_connect
    - LP: #888042
  * md/linear: avoid corrupting structure while waiting for rcu_free to
    complete.
    - LP: #888042
  * powerpc/pci: Check devices status property when scanning OF tree
    - LP: #888042
  * xen: x86_32: do not enable iterrupts when returning from exception in
    interrupt context
    - LP: #888042
  * xen/smp: Warn user why they keel over - nosmp or noapic and what to use
    instead.
    - LP: #888042
  * ARM: davinci: da850 EVM: read mac address from SPI flash
    - LP: #888042
  * md: Fix handling for devices from 2TB to 4TB in 0.90 metadata.
    - LP: #888042
  * net/9p: fix client code to fail more gracefully on protocol error
    - LP: #888042
  * fs/9p: Fid is not valid after a failed clunk.
    - LP: #888042
  * net/9p: Fix the msize calculation.
    - LP: #888042
  * irda: fix smsc-ircc2 section mismatch warning
    - LP: #888042
  * qla2xxx: Correct inadvertent loop state transitions during port-update
    handling.
    - LP: #888042
  * e1000: Fix driver to be used on PA RISC C8000 workstations
    - LP: #888042
  * ASoC: Fix reporting of partial jack updates
    - LP: #888042
  * ALSA: HDA: Cirrus - fix "Surround Speaker" volume control name
    - LP: #888042
  * b43: Fix beacon problem in ad-hoc mode
    - LP: #888042
  * wireless: Reset beacon_found while updating regulatory
    - LP: #888042
  * USB: PL2303: correctly handle baudrates above 115200
    - LP: #888042
  * ASIX: Add AX88772B USB ID
    - LP: #888042
  * hvc_console: Improve tty/console put_chars handling
    - LP: #888042
  * TPM: Call tpm_transmit with correct size
    - LP: #888042
  * TPM: Zero buffer after copying to userspace
    - LP: #888042
  * libiscsi_tcp: fix LLD data allocation
    - LP: #888042
  * cnic: Improve NETDEV_UP event handling
    - LP: #888...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ec2 - 2.6.32-341.42

---------------
linux-ec2 (2.6.32-341.42) lucid-proposed; urgency=low

  [Stefan Bader]

  * Release Tracking Bug
    - LP: #900752
  * XEN: xen-blkfront: fix data size for xenbus_gather in blkfront_connect
    - LP: #888042

linux-ec2 (2.6.32-341.41) lucid-proposed; urgency=low

  [ Stefan Bader ]

  * Release Tracking Bug
    - LP: #899737
  * Revert "SAUCE: XEN: Import 26ab8408157fbbc669e1aab1f271bb3cb1c433d0"
    - LP: #888042
  * Rebased to Ubuntu-Ubuntu-2.6.32-37.81

  [ Ubuntu: 2.6.32-37.81 ]

  * (pre-stable) sparc: sigutil: Include <linux/errno.h>
    - LP: #899311

  [ Ubuntu: 2.6.32-37.80 ]

  * Revert "x86, hotplug: Use mwait to offline a processor, fix the legacy
    case"
    - LP: #888042
  * Revert "usb: musb: restore INDEX register in resume path"
    - LP: #888042
  * Revert "MIPS: MTX-1: Make au1000_eth probe all PHY
    - LP: #888042
  * Revert "ALSA: hda: Fix quirk for Dell Inspiron 910"
    - LP: #875300
  * USB: ftdi_sio: add Calao reference board support
    - LP: #888042
  * USB: EHCI: Do not rely on PORT_SUSPEND to stop USB resuming in
    ehci_bus_resume().
    - LP: #888042
  * rt2x00: do not drop usb dev reference counter on suspend
    - LP: #888042
  * atm: br2684: Fix oops due to skb->dev being NULL
    - LP: #888042
  * sparc: Allow handling signals when stack is corrupted.
    - LP: #888042
  * sparc: fix array bounds error setting up PCIC NMI trap
    - LP: #888042
  * net: Fix IPv6 GSO type checks in Intel ethernet drivers
    - LP: #888042
  * ipv6: Add GSO support on forwarding path
    - LP: #888042
  * GRO: fix merging a paged skb after non-paged skbs
    - LP: #888042
  * xen-blkfront: fix data size for xenbus_gather in blkfront_connect
    - LP: #888042
  * md/linear: avoid corrupting structure while waiting for rcu_free to
    complete.
    - LP: #888042
  * powerpc/pci: Check devices status property when scanning OF tree
    - LP: #888042
  * xen: x86_32: do not enable iterrupts when returning from exception in
    interrupt context
    - LP: #888042
  * xen/smp: Warn user why they keel over - nosmp or noapic and what to use
    instead.
    - LP: #888042
  * ARM: davinci: da850 EVM: read mac address from SPI flash
    - LP: #888042
  * md: Fix handling for devices from 2TB to 4TB in 0.90 metadata.
    - LP: #888042
  * net/9p: fix client code to fail more gracefully on protocol error
    - LP: #888042
  * fs/9p: Fid is not valid after a failed clunk.
    - LP: #888042
  * net/9p: Fix the msize calculation.
    - LP: #888042
  * irda: fix smsc-ircc2 section mismatch warning
    - LP: #888042
  * qla2xxx: Correct inadvertent loop state transitions during port-update
    handling.
    - LP: #888042
  * e1000: Fix driver to be used on PA RISC C8000 workstations
    - LP: #888042
  * ASoC: Fix reporting of partial jack updates
    - LP: #888042
  * ALSA: HDA: Cirrus - fix "Surround Speaker" volume control name
    - LP: #888042
  * b43: Fix beacon problem in ad-hoc mode
    - LP: #888042
  * wireless: Reset beacon_found while updating regulatory
    - LP: #888042
  * USB: PL2303: correctly handle baudrates above 115200
    - LP: #888042
  * AS...

[Rolf Leggewie (r0lf)]

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".