CVE-2012-3430

[John Johansen]

The rds_recvmsg function in net/rds/recv.c in the Linux kernel before 3.0.44 does not initialize a certain structure member, which allows local users to obtain potentially sensitive information from kernel stack memory via a (1) recvfrom or (2) recvmsg system call on an RDS socket.

Break-Fix: - 06b6a1cf6e776426766298d055bb3991957d90a7

[John Johansen (jjohansen)]

CVE-2012-3430

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.5.0-11.11

---------------
linux (3.5.0-11.11) quantal-proposed; urgency=low

  [ Andy Whitcroft ]

  * [Config] enable CONFIG_X86_X32=y

  [ Cypress Semiconductor Corporation ]

  * SAUCE: input: Cypress PS/2 Trackpad mouse driver
    - LP: #978807
  * SAUCE: input: Cypress PS/2 Trackpad link driver into psmouse-base
    - LP: #978807

  [ Dann Frazier ]

  * [Config] compile the rtc-pl031 driver as static on the highbank kernel
    flavour
    - LP: #1035110

  [ Ike Panhc ]

  * [Config] Enable CONFIG_DEBUG_HIGHBANK_UART for highbank
    - LP: #1034781

  [ Kamal Mostafa ]

  * SAUCE: input: Cypress PS/2 Trackpad code style cleanup
    - LP: #978807
  * SAUCE: input: Cypress PS/2 Trackpad eliminate dead code
    - LP: #978807
  * SAUCE: input: Cypress PS/2 Trackpad fix no-config stubs
    - LP: #978807
  * SAUCE: input: Cypress PS/2 Trackpad set default debug_level=0
    - LP: #978807
  * SAUCE: [Config] add MOUSE_PS2_CYPRESS=y
    - LP: #978807

  [ Kees Cook ]

  * SAUCE: Yama: access task_struct->comm directly
  * SAUCE: Yama: add link restrictions
  * SAUCE: security: unconditionally chain to Yama LSM

  [ Seth Forshee ]

  * SAUCE: (drop after 3.6) irq_remap: disable IRQ remapping if any IOAPIC
    lacks an IOMMU
    - LP: #1034459

  [ Stefan Bader ]

  * (config) Enable getabis to use local package copies

  [ Tim Gardner ]

  * rebase to v3.5.2

  [ Upstream Kernel Changes ]

  * rds: set correct msg_namelen
    - LP: #1031112
    - CVE-2012-2340
  * rebase to v3.5.2
    - LP: #1027789
    - LP: #1001251
 -- Leann Ogasawara <email address hidden> Thu, 16 Aug 2012 08:52:09 -0700

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.5.0-208.14

---------------
linux-ti-omap4 (3.5.0-208.14) quantal-proposed; urgency=low

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.5.0-11.11
  * UBUNTU: SAUCE: fixup: retire "goto next" in omap_init_opp_table

  [ Ricardo Salveti de Araujo ]

  * [Config] installing omapdrm specific headers for external drivers
    - LP: #1038846

  [ Ubuntu: 3.5.0-11.11 ]

  * [Config] enable CONFIG_X86_X32=y
  * SAUCE: input: Cypress PS/2 Trackpad mouse driver
    - LP: #978807
  * SAUCE: input: Cypress PS/2 Trackpad link driver into psmouse-base
    - LP: #978807
  * [Config] compile the rtc-pl031 driver as static on the highbank kernel
    flavour
    - LP: #1035110
  * [Config] Enable CONFIG_DEBUG_HIGHBANK_UART for highbank
    - LP: #1034781
  * SAUCE: input: Cypress PS/2 Trackpad code style cleanup
    - LP: #978807
  * SAUCE: input: Cypress PS/2 Trackpad eliminate dead code
    - LP: #978807
  * SAUCE: input: Cypress PS/2 Trackpad fix no-config stubs
    - LP: #978807
  * SAUCE: input: Cypress PS/2 Trackpad set default debug_level=0
    - LP: #978807
  * SAUCE: [Config] add MOUSE_PS2_CYPRESS=y
    - LP: #978807
  * SAUCE: Yama: access task_struct->comm directly
  * SAUCE: Yama: add link restrictions
  * SAUCE: security: unconditionally chain to Yama LSM
  * SAUCE: (drop after 3.6) irq_remap: disable IRQ remapping if any IOAPIC
    lacks an IOMMU
    - LP: #1034459
  * (config) Enable getabis to use local package copies
  * rebase to v3.5.2
  * rds: set correct msg_namelen
    - LP: #1031112
    - CVE-2012-2340
  * rebase to v3.5.2
    - LP: #1027789
    - LP: #1001251

  [ Ubuntu: 3.5.0-10.10 ]

  * rebase to v3.5.1
  * [Config] Enable CONFIG_AFS_FSCACHE=y
    - LP: #728977
  * SAUCE: firmware: Remove emi62 files duplicated in linux-firmware
  * SAUCE: firmware: Remove tehuti files duplicated in linux-firmware
  * overlayfs: copy up i_uid/i_gid from the underlying inode
    - LP: #944386
  * hwmon: (applesmc) Shorten minimum wait time
    - LP: #1034449
  * hwmon: (applesmc) Decode and act on read/write status codes
    - LP: #1034449
  * rebase to v3.5.1
    - LP: #1026953
    - LP: #1025377
 -- Paolo Pisati <email address hidden> Mon, 20 Aug 2012 16:59:17 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 2.6.38-16.67

---------------
linux (2.6.38-16.67) natty-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1045383

  [ Upstream Kernel Changes ]

  * rds: set correct msg_namelen
    - LP: #1031112
    - CVE-2012-3430
  * eCryptfs: Initialize empty lower files when opening them
    - LP: #911507
  * net: Allow driver to limit number of GSO segments per skb
    - LP: #1037456
    - CVE-2012-3412
  * tcp: do not scale TSO segment size with reordering degree
    - LP: #1037456
    - CVE-2012-3412
  * tcp: Apply device TSO segment limit earlier
    - LP: #1037456
    - CVE-2012-3412
  * sfc: Replace some literal constants with EFX_PAGE_SIZE/EFX_BUF_SIZE
    - LP: #1037456
    - CVE-2012-3412
  * sfc: Fix maximum number of TSO segments and minimum TX queue size
    - LP: #1037456
    - CVE-2012-3412
  * mm: Hold a file reference in madvise_remove
    - LP: #1042447
    - CVE-2012-3511
  * cred: copy_process() should clear child->replacement_session_keyring
    - LP: #1023535
    - CVE-2012-2745
 -- Luis Henriques <email address hidden> Thu, 06 Sep 2012 09:25:21 +0100

[Adam Conrad (adconrad)]

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.0.0-26.42

---------------
linux (3.0.0-26.42) oneiric-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1045707

  [ Upstream Kernel Changes ]

  * rds: set correct msg_namelen
    - LP: #1031112
    - CVE-2012-3430
  * x86: Simplify code by removing a !SMP #ifdefs from 'struct cpuinfo_x86'
    - LP: #1037281
  * Redefine ATOMIC_INIT and ATOMIC64_INIT to drop the casts
    - LP: #1037281
  * SUNRPC: return negative value in case rpcbind client creation error
    - LP: #1037281
  * nilfs2: fix deadlock issue between chcp and thaw ioctls
    - LP: #1037281
  * pcdp: use early_ioremap/early_iounmap to access pcdp table
    - LP: #1037281
  * mm: fix wrong argument of migrate_huge_pages() in
    soft_offline_huge_page()
    - LP: #1037281
  * ARM: 7478/1: errata: extend workaround for erratum #720789
    - LP: #1037281
  * ARM: 7479/1: mm: avoid NULL dereference when flushing gate_vma with
    VIVT caches
    - LP: #1037281
  * mm: mmu_notifier: fix freed page still mapped in secondary MMU
    - LP: #1037281
  * mac80211: cancel mesh path timer
    - LP: #1037281
  * x86, nops: Missing break resulting in incorrect selection on Intel
    - LP: #1037281
  * random: Add support for architectural random hooks
    - LP: #1037281
  * fix typo/thinko in get_random_bytes()
    - LP: #1037281
  * random: Use arch_get_random_int instead of cycle counter if avail
    - LP: #1037281
  * random: Use arch-specific RNG to initialize the entropy store
    - LP: #1037281
  * random: Adjust the number of loops when initializing
    - LP: #1037281
  * drivers/char/random.c: fix boot id uniqueness race
    - LP: #1037281
  * random: make 'add_interrupt_randomness()' do something sane
    - LP: #1037281
  * random: use lockless techniques in the interrupt path
    - LP: #1037281
  * random: create add_device_randomness() interface
    - LP: #1037281
  * usb: feed USB device information to the /dev/random driver
    - LP: #1037281
  * net: feed /dev/random with the MAC address when registering a device
    - LP: #1037281
  * random: use the arch-specific rng in xfer_secondary_pool
    - LP: #1037281
  * random: add new get_random_bytes_arch() function
    - LP: #1037281
  * random: add tracepoints for easier debugging and verification
    - LP: #1037281
  * MAINTAINERS: Theodore Ts'o is taking over the random driver
    - LP: #1037281
  * rtc: wm831x: Feed the write counter into device_add_randomness()
    - LP: #1037281
  * mfd: wm831x: Feed the device UUID into device_add_randomness()
    - LP: #1037281
  * random: remove rand_initialize_irq()
    - LP: #1037281
  * random: Add comment to random_initialize()
    - LP: #1037281
  * dmi: Feed DMI table to /dev/random driver
    - LP: #1037281
  * random: mix in architectural randomness in extract_buf()
    - LP: #1037281
  * x86, microcode: microcode_core.c simple_strtoul cleanup
    - LP: #1037281
  * x86, microcode: Sanitize per-cpu microcode reloading interface
    - LP: #1037281
  * mm: hugetlbfs: close race during teardown of hugetlbfs shared page
    tables
    - LP: #1037281
  * ARM: mxs: Remove MMAP_MIN_ADDR setting from mxs_defconfig
  ...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-armadaxp - 3.2.0-1608.13

---------------
linux-armadaxp (3.2.0-1608.13) precise-proposed; urgency=low

  [ Ike Panhc ]

  * Release Tracking Bug
    - LP: #1047672
  * Rebase onto Ubuntu-3.2.0-31.50

  [ Ubuntu: 3.2.0-31.50 ]

  * Release Tracking Bug
    - LP: #1047242
  * SAUCE: drm/vmwgfx: add MODULE_DEVICE_TABLE so vmwgfx loads at boot
    - LP: #1039157
  * SAUCE: input: Cypress PS/2 Trackpad move PSMOUSE_CYPRESS enum
    - LP: #1041594
 -- Ike Panhc <email address hidden> Mon, 10 Sep 2012 09:32:28 +0800

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 2.6.32-43.97

---------------
linux (2.6.32-43.97) lucid-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1045405

  [ Upstream Kernel Changes ]

  * rds: set correct msg_namelen
    - LP: #1031112
    - CVE-2012-3430
  * eCryptfs: Initialize empty lower files when opening them
    - LP: #911507
  * net: Allow driver to limit number of GSO segments per skb
    - LP: #1037456
    - CVE-2012-3412
  * tcp: do not scale TSO segment size with reordering degree
    - LP: #1037456
    - CVE-2012-3412
  * tcp: Apply device TSO segment limit earlier
    - LP: #1037456
    - CVE-2012-3412
  * sfc: Replace some literal constants with EFX_PAGE_SIZE/EFX_BUF_SIZE
    - LP: #1037456
    - CVE-2012-3412
  * sfc: Fix maximum number of TSO segments and minimum TX queue size
    - LP: #1037456
    - CVE-2012-3412
  * mm: Hold a file reference in madvise_remove
    - LP: #1042447
    - CVE-2012-3511
  * ulimit: raise default hard ulimit on number of files to 4096
    - LP: #663090
 -- Luis Henriques <email address hidden> Wed, 05 Sep 2012 09:39:41 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ec2 - 2.6.32-348.54

---------------
linux-ec2 (2.6.32-348.54) lucid-proposed; urgency=low

  [ Stefan Bader ]

  * Rebased to Ubuntu-2.6.32-43.97
  * SAUCE: EC2: Backport changes to limit GSO segments
    - LP: #1037456
    - CVE-2012-3412
  * Release Tracking Bug
    - LP: #1046656

  [ Ubuntu: 2.6.32-43.97 ]

  * rds: set correct msg_namelen
    - LP: #1031112
    - CVE-2012-3430
  * eCryptfs: Initialize empty lower files when opening them
    - LP: #911507
  * net: Allow driver to limit number of GSO segments per skb
    - LP: #1037456
    - CVE-2012-3412
  * tcp: do not scale TSO segment size with reordering degree
    - LP: #1037456
    - CVE-2012-3412
  * tcp: Apply device TSO segment limit earlier
    - LP: #1037456
    - CVE-2012-3412
  * sfc: Replace some literal constants with EFX_PAGE_SIZE/EFX_BUF_SIZE
    - LP: #1037456
    - CVE-2012-3412
  * sfc: Fix maximum number of TSO segments and minimum TX queue size
    - LP: #1037456
    - CVE-2012-3412
  * mm: Hold a file reference in madvise_remove
    - LP: #1042447
    - CVE-2012-3511
  * ulimit: raise default hard ulimit on number of files to 4096
    - LP: #663090
 -- Stefan Bader <email address hidden> Fri, 07 Sep 2012 09:16:52 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-lts-backport-natty - 2.6.38-16.67~lucid1

---------------
linux-lts-backport-natty (2.6.38-16.67~lucid1) lucid-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1047350

  [ Upstream Kernel Changes ]

  * rds: set correct msg_namelen
    - LP: #1031112
    - CVE-2012-3430
  * eCryptfs: Initialize empty lower files when opening them
    - LP: #911507
  * net: Allow driver to limit number of GSO segments per skb
    - LP: #1037456
    - CVE-2012-3412
  * tcp: do not scale TSO segment size with reordering degree
    - LP: #1037456
    - CVE-2012-3412
  * tcp: Apply device TSO segment limit earlier
    - LP: #1037456
    - CVE-2012-3412
  * sfc: Replace some literal constants with EFX_PAGE_SIZE/EFX_BUF_SIZE
    - LP: #1037456
    - CVE-2012-3412
  * sfc: Fix maximum number of TSO segments and minimum TX queue size
    - LP: #1037456
    - CVE-2012-3412
  * mm: Hold a file reference in madvise_remove
    - LP: #1042447
    - CVE-2012-3511
  * cred: copy_process() should clear child->replacement_session_keyring
    - LP: #1023535
    - CVE-2012-2745
 -- Luis Henriques <email address hidden> Fri, 07 Sep 2012 14:15:51 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-lts-backport-oneiric - 3.0.0-26.42~lucid1

---------------
linux-lts-backport-oneiric (3.0.0-26.42~lucid1) lucid-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1046423

  [ Upstream Kernel Changes ]

  * rds: set correct msg_namelen
    - LP: #1031112
    - CVE-2012-3430
  * x86: Simplify code by removing a !SMP #ifdefs from 'struct cpuinfo_x86'
    - LP: #1037281
  * Redefine ATOMIC_INIT and ATOMIC64_INIT to drop the casts
    - LP: #1037281
  * SUNRPC: return negative value in case rpcbind client creation error
    - LP: #1037281
  * nilfs2: fix deadlock issue between chcp and thaw ioctls
    - LP: #1037281
  * pcdp: use early_ioremap/early_iounmap to access pcdp table
    - LP: #1037281
  * mm: fix wrong argument of migrate_huge_pages() in
    soft_offline_huge_page()
    - LP: #1037281
  * ARM: 7478/1: errata: extend workaround for erratum #720789
    - LP: #1037281
  * ARM: 7479/1: mm: avoid NULL dereference when flushing gate_vma with
    VIVT caches
    - LP: #1037281
  * mm: mmu_notifier: fix freed page still mapped in secondary MMU
    - LP: #1037281
  * mac80211: cancel mesh path timer
    - LP: #1037281
  * x86, nops: Missing break resulting in incorrect selection on Intel
    - LP: #1037281
  * random: Add support for architectural random hooks
    - LP: #1037281
  * fix typo/thinko in get_random_bytes()
    - LP: #1037281
  * random: Use arch_get_random_int instead of cycle counter if avail
    - LP: #1037281
  * random: Use arch-specific RNG to initialize the entropy store
    - LP: #1037281
  * random: Adjust the number of loops when initializing
    - LP: #1037281
  * drivers/char/random.c: fix boot id uniqueness race
    - LP: #1037281
  * random: make 'add_interrupt_randomness()' do something sane
    - LP: #1037281
  * random: use lockless techniques in the interrupt path
    - LP: #1037281
  * random: create add_device_randomness() interface
    - LP: #1037281
  * usb: feed USB device information to the /dev/random driver
    - LP: #1037281
  * net: feed /dev/random with the MAC address when registering a device
    - LP: #1037281
  * random: use the arch-specific rng in xfer_secondary_pool
    - LP: #1037281
  * random: add new get_random_bytes_arch() function
    - LP: #1037281
  * random: add tracepoints for easier debugging and verification
    - LP: #1037281
  * MAINTAINERS: Theodore Ts'o is taking over the random driver
    - LP: #1037281
  * rtc: wm831x: Feed the write counter into device_add_randomness()
    - LP: #1037281
  * mfd: wm831x: Feed the device UUID into device_add_randomness()
    - LP: #1037281
  * random: remove rand_initialize_irq()
    - LP: #1037281
  * random: Add comment to random_initialize()
    - LP: #1037281
  * dmi: Feed DMI table to /dev/random driver
    - LP: #1037281
  * random: mix in architectural randomness in extract_buf()
    - LP: #1037281
  * x86, microcode: microcode_core.c simple_strtoul cleanup
    - LP: #1037281
  * x86, microcode: Sanitize per-cpu microcode reloading interface
    - LP: #1037281
  * mm: hugetlbfs: close race during teardown of hugetlbfs shared page
    tables
    - LP: #1037281
  * ARM: m...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.0.0-1216.28

---------------
linux-ti-omap4 (3.0.0-1216.28) oneiric-proposed; urgency=low

  * Release Tracking Bug
    - LP: #1046422

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.0.0-26.42

  [ Ubuntu: 3.0.0-26.42 ]

  * Release Tracking Bug
    - LP: #1045707
  * rds: set correct msg_namelen
    - LP: #1031112
    - CVE-2012-3430
  * x86: Simplify code by removing a !SMP #ifdefs from 'struct cpuinfo_x86'
    - LP: #1037281
  * Redefine ATOMIC_INIT and ATOMIC64_INIT to drop the casts
    - LP: #1037281
  * SUNRPC: return negative value in case rpcbind client creation error
    - LP: #1037281
  * nilfs2: fix deadlock issue between chcp and thaw ioctls
    - LP: #1037281
  * pcdp: use early_ioremap/early_iounmap to access pcdp table
    - LP: #1037281
  * mm: fix wrong argument of migrate_huge_pages() in
    soft_offline_huge_page()
    - LP: #1037281
  * ARM: 7478/1: errata: extend workaround for erratum #720789
    - LP: #1037281
  * ARM: 7479/1: mm: avoid NULL dereference when flushing gate_vma with
    VIVT caches
    - LP: #1037281
  * mm: mmu_notifier: fix freed page still mapped in secondary MMU
    - LP: #1037281
  * mac80211: cancel mesh path timer
    - LP: #1037281
  * x86, nops: Missing break resulting in incorrect selection on Intel
    - LP: #1037281
  * random: Add support for architectural random hooks
    - LP: #1037281
  * fix typo/thinko in get_random_bytes()
    - LP: #1037281
  * random: Use arch_get_random_int instead of cycle counter if avail
    - LP: #1037281
  * random: Use arch-specific RNG to initialize the entropy store
    - LP: #1037281
  * random: Adjust the number of loops when initializing
    - LP: #1037281
  * drivers/char/random.c: fix boot id uniqueness race
    - LP: #1037281
  * random: make 'add_interrupt_randomness()' do something sane
    - LP: #1037281
  * random: use lockless techniques in the interrupt path
    - LP: #1037281
  * random: create add_device_randomness() interface
    - LP: #1037281
  * usb: feed USB device information to the /dev/random driver
    - LP: #1037281
  * net: feed /dev/random with the MAC address when registering a device
    - LP: #1037281
  * random: use the arch-specific rng in xfer_secondary_pool
    - LP: #1037281
  * random: add new get_random_bytes_arch() function
    - LP: #1037281
  * random: add tracepoints for easier debugging and verification
    - LP: #1037281
  * MAINTAINERS: Theodore Ts'o is taking over the random driver
    - LP: #1037281
  * rtc: wm831x: Feed the write counter into device_add_randomness()
    - LP: #1037281
  * mfd: wm831x: Feed the device UUID into device_add_randomness()
    - LP: #1037281
  * random: remove rand_initialize_irq()
    - LP: #1037281
  * random: Add comment to random_initialize()
    - LP: #1037281
  * dmi: Feed DMI table to /dev/random driver
    - LP: #1037281
  * random: mix in architectural randomness in extract_buf()
    - LP: #1037281
  * x86, microcode: microcode_core.c simple_strtoul cleanup
    - LP: #1037281
  * x86, microcode: Sanitize per-cpu microcode reloading interface
    - LP: #1037281
  * mm: hugetlbfs: close race during teardown of hugetlbfs shared pa...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.2.0-31.50

---------------
linux (3.2.0-31.50) precise-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1047242

  [ Dave Airlie ]

  * SAUCE: drm/vmwgfx: add MODULE_DEVICE_TABLE so vmwgfx loads at boot
    - LP: #1039157

  [ Kamal Mostafa ]

  * SAUCE: input: Cypress PS/2 Trackpad move PSMOUSE_CYPRESS enum
    - LP: #1041594

linux (3.2.0-31.49) precise-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1046216

  [ Cypress Semiconductor Corporation ]

  * SAUCE: input: Cypress PS/2 Trackpad mouse driver
    - LP: #978807
  * SAUCE: input: Cypress PS/2 Trackpad link driver into psmouse-base
    - LP: #978807

  [ Ike Panhc ]

  * [Config] Enable CONFIG_DEVPTS_MULTIPLE_INSTANCES for highbank
    - LP: #1038259

  [ Kamal Mostafa ]

  * SAUCE: input: Cypress PS/2 Trackpad code style cleanup
    - LP: #978807
  * SAUCE: input: Cypress PS/2 Trackpad eliminate dead code
    - LP: #978807
  * SAUCE: input: Cypress PS/2 Trackpad fix no-config stubs
    - LP: #978807
  * SAUCE: input: Cypress PS/2 Trackpad set default debug_level=0
    - LP: #978807

  [ Stefan Bader ]

  * Revert "SAUCE: fix pv-ops for legacy Xen"
    - LP: #1044550
  * SAUCE: Force xsave off on older Xen hypervisors
    - LP: #1044550

  [ Tim Gardner ]

  * [Config] Add smsc{79}5xx to nic-usb-modules
    - LP: #1041397

  [ Upstream Kernel Changes ]

  * Revert "samsung-laptop: make the dmi check less strict"
    - LP: #1028151
  * rds: set correct msg_namelen
    - LP: #1031112
    - CVE-2012-3430
  * bnx2: Fix bug in bnx2_free_tx_skbs().
    - LP: #1039087
  * sch_sfb: Fix missing NULL check
    - LP: #1039087
  * sctp: Fix list corruption resulting from freeing an association on a
    list
    - LP: #1039087
  * caif: Fix access to freed pernet memory
    - LP: #1039087
  * cipso: don't follow a NULL pointer when setsockopt() is called
    - LP: #1039087
  * caif: fix NULL pointer check
    - LP: #1039087
  * wanmain: comparing array with NULL
    - LP: #1039087
  * tcp: Add TCP_USER_TIMEOUT negative value check
    - LP: #1039087
  * USB: kaweth.c: use GFP_ATOMIC under spin_lock
    - LP: #1039087
  * net: fix rtnetlink IFF_PROMISC and IFF_ALLMULTI handling
    - LP: #1039087
  * tcp: perform DMA to userspace only if there is a task waiting for it
    - LP: #1039087
  * net/tun: fix ioctl() based info leaks
    - LP: #1039087
  * e1000: add dropped DMA receive enable back in for WoL
    - LP: #1039087
  * rtlwifi: rtl8192cu: Change buffer allocation for synchronous reads
    - LP: #1039087
  * hfsplus: fix overflow in sector calculations in hfsplus_submit_bio
    - LP: #1039087
  * drm/i915: fixup seqno allocation logic for lazy_request
    - LP: #1039087
  * mac80211: cancel mesh path timer
    - LP: #1039087
  * ath9k: Add PID/VID support for AR1111
    - LP: #1039087
  * ARM: mxs: Remove MMAP_MIN_ADDR setting from mxs_defconfig
    - LP: #1039087
  * ALSA: hda - add dock support for Thinkpad T430s
    - LP: #1039087
  * cfg80211: process pending events when unregistering net device
    - LP: #1039087
  * rt61pci: fix NULL pointer dereference in config_lna_gain
    - LP: #...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.2.0-1419.26

---------------
linux-ti-omap4 (3.2.0-1419.26) precise-proposed; urgency=low

  * Release Tracking Bug
    - LP: #1047670

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.2.0-31.50

  [ Ubuntu: 3.2.0-31.50 ]

  * Release Tracking Bug
    - LP: #1047242
  * SAUCE: drm/vmwgfx: add MODULE_DEVICE_TABLE so vmwgfx loads at boot
    - LP: #1039157
  * SAUCE: input: Cypress PS/2 Trackpad move PSMOUSE_CYPRESS enum
    - LP: #1041594

  [ Ubuntu: 3.2.0-31.49 ]

  * Release Tracking Bug
    - LP: #1046216
  * SAUCE: input: Cypress PS/2 Trackpad mouse driver
    - LP: #978807
  * SAUCE: input: Cypress PS/2 Trackpad link driver into psmouse-base
    - LP: #978807
  * [Config] Enable CONFIG_DEVPTS_MULTIPLE_INSTANCES for highbank
    - LP: #1038259
  * SAUCE: input: Cypress PS/2 Trackpad code style cleanup
    - LP: #978807
  * SAUCE: input: Cypress PS/2 Trackpad eliminate dead code
    - LP: #978807
  * SAUCE: input: Cypress PS/2 Trackpad fix no-config stubs
    - LP: #978807
  * SAUCE: input: Cypress PS/2 Trackpad set default debug_level=0
    - LP: #978807
  * Revert "SAUCE: fix pv-ops for legacy Xen"
    - LP: #1044550
  * SAUCE: Force xsave off on older Xen hypervisors
    - LP: #1044550
  * [Config] Add smsc{79}5xx to nic-usb-modules
    - LP: #1041397
  * Revert "samsung-laptop: make the dmi check less strict"
    - LP: #1028151
  * rds: set correct msg_namelen
    - LP: #1031112
    - CVE-2012-3430
  * bnx2: Fix bug in bnx2_free_tx_skbs().
    - LP: #1039087
  * sch_sfb: Fix missing NULL check
    - LP: #1039087
  * sctp: Fix list corruption resulting from freeing an association on a
    list
    - LP: #1039087
  * caif: Fix access to freed pernet memory
    - LP: #1039087
  * cipso: don't follow a NULL pointer when setsockopt() is called
    - LP: #1039087
  * caif: fix NULL pointer check
    - LP: #1039087
  * wanmain: comparing array with NULL
    - LP: #1039087
  * tcp: Add TCP_USER_TIMEOUT negative value check
    - LP: #1039087
  * USB: kaweth.c: use GFP_ATOMIC under spin_lock
    - LP: #1039087
  * net: fix rtnetlink IFF_PROMISC and IFF_ALLMULTI handling
    - LP: #1039087
  * tcp: perform DMA to userspace only if there is a task waiting for it
    - LP: #1039087
  * net/tun: fix ioctl() based info leaks
    - LP: #1039087
  * e1000: add dropped DMA receive enable back in for WoL
    - LP: #1039087
  * rtlwifi: rtl8192cu: Change buffer allocation for synchronous reads
    - LP: #1039087
  * hfsplus: fix overflow in sector calculations in hfsplus_submit_bio
    - LP: #1039087
  * drm/i915: fixup seqno allocation logic for lazy_request
    - LP: #1039087
  * mac80211: cancel mesh path timer
    - LP: #1039087
  * ath9k: Add PID/VID support for AR1111
    - LP: #1039087
  * ARM: mxs: Remove MMAP_MIN_ADDR setting from mxs_defconfig
    - LP: #1039087
  * ALSA: hda - add dock support for Thinkpad T430s
    - LP: #1039087
  * cfg80211: process pending events when unregistering net device
    - LP: #1039087
  * rt61pci: fix NULL pointer dereference in config_lna_gain
    - LP: #1039087
  * iwlwifi: disable greenfield transmissions as a workaround
    - LP: #1039087
  * ALSA: hda - add doc...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 2.6.38-1209.26

---------------
linux-ti-omap4 (2.6.38-1209.26) natty-proposed; urgency=low

  * Release Tracking Bug
    - LP: #1047347

  [ Upstream Kernel Changes ]

  * rds: set correct msg_namelen
    - LP: #1031112
    - CVE-2012-3340
  * KVM: unmap pages from the iommu when slots are removed
    - LP: #987569
    - CVE-2012-2121
  * net: Allow driver to limit number of GSO segments per skb
    - LP: #1037456
    - CVE-2012-3412
  * tcp: do not scale TSO segment size with reordering degree
    - LP: #1037456
    - CVE-2012-3412
  * tcp: Apply device TSO segment limit earlier
    - LP: #1037456
    - CVE-2012-3412
  * sfc: Replace some literal constants with EFX_PAGE_SIZE/EFX_BUF_SIZE
    - LP: #1037456
    - CVE-2012-3412
  * sfc: Fix maximum number of TSO segments and minimum TX queue size
    - LP: #1037456
    - CVE-2012-3412
  * mm: Hold a file reference in madvise_remove
    - LP: #1042447
    - CVE-2012-3511
 -- Paolo Pisati <email address hidden> Wed, 12 Sep 2012 16:34:28 +0200

[Andy Whitcroft (apw)]

This bug was nominated against a series that is no longer supported, ie vivid. The bug task representing the vivid nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.