CVE-2014-8369

[John Johansen]

The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.17.2 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to cause a denial of service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS privileges. NOTE: this vulnerability exists because of an incorrect fix for CVE-2014-3601.

Break-Fix: 350b8bdd689cd2ab2c67c8a86a0be86cfa0751a7 3d32e4dbe71374a6780eaf51d719d76f9a9bf22f

[John Johansen (jjohansen)]

CVE-2014-8369

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.2.0-75.110

---------------
linux (3.2.0-75.110) precise; urgency=low

  [ Kamal Mostafa ]

  * Release Tracking Bug
    - LP: #1403154

  [ Upstream Kernel Changes ]

  * kvm: fix excessive pages un-pinning in kvm_iommu_map error path.
    - LP: #1386395
    - CVE-2014-8369
  * KVM: x86: Don't report guest userspace emulation error to userspace
    - LP: #1392823
    - CVE-2014-7842
  * drivers:scsi:storvsc: Fix a bug in handling ring buffer failures that
    may result in I/O freeze
    - LP: #1400289
  * net:socket: set msg_namelen to 0 if msg_name is passed as NULL in
    msghdr struct from userland.
    - LP: #1335478
 -- Kamal Mostafa <email address hidden> Tue, 16 Dec 2014 10:00:12 -0800

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-armadaxp - 3.2.0-1643.62

---------------
linux-armadaxp (3.2.0-1643.62) precise; urgency=low

  [ Ike Panhc ]

  * Release Tracking Bug
    - LP: #1403240
  * Rebase to Ubuntu-3.2.0-75.110

  [ Ubuntu: 3.2.0-75.110 ]

  * Release Tracking Bug
    - LP: #1403154
  * kvm: fix excessive pages un-pinning in kvm_iommu_map error path.
    - LP: #1386395
    - CVE-2014-8369
  * KVM: x86: Don't report guest userspace emulation error to userspace
    - LP: #1392823
    - CVE-2014-7842
  * drivers:scsi:storvsc: Fix a bug in handling ring buffer failures that
    may result in I/O freeze
    - LP: #1400289
  * net:socket: set msg_namelen to 0 if msg_name is passed as NULL in
    msghdr struct from userland.
    - LP: #1335478
 -- Ike Panhc <email address hidden> Wed, 17 Dec 2014 10:39:21 +0800

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.2.0-1458.78

---------------
linux-ti-omap4 (3.2.0-1458.78) precise; urgency=low

  * Release Tracking Bug
    - LP: #1403239

  [ Luis Henriques ]

  * rebased on Ubuntu-3.2.0-75.110

  [ Ubuntu: 3.2.0-75.110 ]

  * Release Tracking Bug
    - LP: #1403154
  * kvm: fix excessive pages un-pinning in kvm_iommu_map error path.
    - LP: #1386395
    - CVE-2014-8369
  * KVM: x86: Don't report guest userspace emulation error to userspace
    - LP: #1392823
    - CVE-2014-7842
  * drivers:scsi:storvsc: Fix a bug in handling ring buffer failures that
    may result in I/O freeze
    - LP: #1400289
  * net:socket: set msg_namelen to 0 if msg_name is passed as NULL in
    msghdr struct from userland.
    - LP: #1335478

  [ Ubuntu: 3.2.0-74.109 ]

  * Release Tracking Bug
    - LP: #1400709
  * x86_64, traps: Stop using IST for #SS
    - LP: #1398795
    - CVE-2014-9090
  * x86_64, traps: Fix the espfix64 #DF fixup and rewrite it in C
    - LP: #1398795
    - CVE-2014-9090
  * x86_64, traps: Rework bad_iret
    - LP: #1398795
    - CVE-2014-9090
  * x86, kvm: Clear paravirt_enabled on KVM guests for espfix32's benefit
    - LP: #1400314
    - CVE-2014-8134
 -- Luis Henriques <email address hidden> Thu, 18 Dec 2014 10:59:10 +0000

[Rolf Leggewie (r0lf)]

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".

[Steve Langasek (vorlon)]

The Precise Pangolin has reached end of life, so this bug will not be fixed for that release