CVE-2012-3520

[John Johansen]

The Netlink implementation in the Linux kernel before 3.2.30 does not properly handle messages that lack SCM_CREDENTIALS data, which might allow local users to spoof Netlink communication via a crafted message, as demonstrated by a message to (1) Avahi or (2) NetworkManager.

Break-Fix: 16e5726269611b71c930054ffe9b858c1cea88eb e0e3cea46d31d23dc40df0a49a7a2c04fe8edfea

[John Johansen (jjohansen)]

CVE-2012-3520

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.5.0-15.20

---------------
linux (3.5.0-15.20) quantal-proposed; urgency=low

  [ Tim Gardner ]

  * rebase to v3.5.4
  * SAUCE: CONFIG_HID_BATTERY_STRENGTH=y
    - LP: #1003090

  [ Upstream Kernel Changes ]

  * eCryptfs: Copy up attributes of the lower target inode after rename
    - LP: #561129
  * eCryptfs: Write out all dirty pages just before releasing the lower
    file
    - LP: #1047261
  * eCryptfs: Call lower ->flush() from ecryptfs_flush()
    - LP: #1047261
  * af_netlink: force credentials passing [CVE-2012-3520]
    - LP: #1052097
    - CVE-2012-3520
  * drm/i915: clarify IBX dp workaround
    - LP: #1011440
  * drm/i915: Implement w/a for sporadic read failures on waking from rc6
    - LP: #1011440
  * drm/i915: support Haswell force waking
    - LP: #1011440
  * drm/i915: add RPS configuration for Haswell
    - LP: #1011440
  * drm/i915: enable RC6 by default on Haswell
    - LP: #1011440
  * drm/i915: introduce haswell_init_clock_gating
    - LP: #1011440
  * drm/i915: enable RC6 workaround on Haswell
    - LP: #1011440
  * drm/i915: re-initialize DDI buffer translations after resume
    - LP: #1011440
  * drm/i915: fix PIPE_DDI_PORT_MASK
    - LP: #1011440
  * drm/i915: try to train DP even harder
    - LP: #1011440
  * drm/i915: add more Haswell PCI IDs
    - LP: #1011440
  * rebase to v3.5.4
    - LP: #1038651
 -- Leann Ogasawara <email address hidden> Mon, 17 Sep 2012 13:41:39 -0700

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.5.0-211.18

---------------
linux-ti-omap4 (3.5.0-211.18) quantal-proposed; urgency=low

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.5.0-15.22

  [ Ubuntu: 3.5.0-15.22 ]

  * fix regressions introduced by the last batch of i915 patches.
  * drm/i915: fix up PCH backlight #define mixup
    - LP: #954661
  * drm/i915: don't forget the PCH backlight registers
    - LP: #954661

  [ Ubuntu: 3.5.0-15.21 ]

  * ubuntu: AUFS -- update to 18e455787597579fe144cdb2f18aa6a0a32c46a4
  * [Config] Enable aufs
    - LP: #908784
  * eCryptfs: check for eCryptfs cipher support at mount
    - LP: #338914
  * drm/i915: pnv has a backlight polarity control bit, too
    - LP: #954661
  * drm/i915: clear up backlight #define confusion on gen4+
    - LP: #954661
  * drm/i915: properly enable the blc controller on the right pipe
    - LP: #954661
  * drm/i915: allow pipe A for lvds on gen4
    - LP: #954661

  [ Ubuntu: 3.5.0-15.20 ]

  * rebase to v3.5.4
  * SAUCE: CONFIG_HID_BATTERY_STRENGTH=y
    - LP: #1003090
  * eCryptfs: Copy up attributes of the lower target inode after rename
    - LP: #561129
  * eCryptfs: Write out all dirty pages just before releasing the lower
    file
    - LP: #1047261
  * eCryptfs: Call lower ->flush() from ecryptfs_flush()
    - LP: #1047261
  * af_netlink: force credentials passing [CVE-2012-3520]
    - LP: #1052097
    - CVE-2012-3520
  * drm/i915: clarify IBX dp workaround
    - LP: #1011440
  * drm/i915: Implement w/a for sporadic read failures on waking from rc6
    - LP: #1011440
  * drm/i915: support Haswell force waking
    - LP: #1011440
  * drm/i915: add RPS configuration for Haswell
    - LP: #1011440
  * drm/i915: enable RC6 by default on Haswell
    - LP: #1011440
  * drm/i915: introduce haswell_init_clock_gating
    - LP: #1011440
  * drm/i915: enable RC6 workaround on Haswell
    - LP: #1011440
  * drm/i915: re-initialize DDI buffer translations after resume
    - LP: #1011440
  * drm/i915: fix PIPE_DDI_PORT_MASK
    - LP: #1011440
  * drm/i915: try to train DP even harder
    - LP: #1011440
  * drm/i915: add more Haswell PCI IDs
    - LP: #1011440
  * rebase to v3.5.4
    - LP: #1038651

  [ Ubuntu: 3.5.0-14.19 ]

  * [Config] Fix debug FTBS on non-x86

  [ Ubuntu: 3.5.0-14.18 ]

  * SAUCE: Add 'used' to the video_cards structure attributes
    - LP: #1049650

  [ Ubuntu: 3.5.0-14.17 ]

  * SAUCE: Intel xhci: Only switch the switchable ports
    - LP: #1034814
 -- Paolo Pisati <email address hidden> Fri, 21 Sep 2012 11:27:41 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-armadaxp - 3.5.0-1602.3

---------------
linux-armadaxp (3.5.0-1602.3) quantal; urgency=low

  [ Jani Monoses ]

  * [Config] fdr updateconfigs after rebase.

  [ Upstream Kernel Changes ]

  * Rebase on Ubuntu-3.5.0-16.25

  [ Ubuntu: 3.5.0-16.25 ]

  * SAUCE: input: Cypress PS/2 Trackpad fix multi-source, double-click
    - LP: #1055788
  * [Config] revert '[Config] enable CONFIG_X86_X32=y'
    - LP: #1041883
  * vmwgfx: corruption in vmw_event_fence_action_create()
  * drm/nvd0/disp: hopefully fix selection of 6/8bpc mode on DP outputs
    - LP: #1058088
  * drm/nv50-/gpio: initialise to vbios defaults during init
    - LP: #1058088
  * igb: A fix to VF TX rate limit
    - LP: #1058188
  * igb: Add switch case for supported hardware to igb_ptp_remove.
    - LP: #1058188
  * igb: Support the get_ts_info ethtool method.
    - LP: #1058188
  * igb: Streamline RSS queue and queue pairing assignment logic.
    - LP: #1058188
  * igb: Update firmware info output
    - LP: #1058188
  * igb: Version bump
    - LP: #1058188
  * igb: reset PHY in the link_up process to recover PHY setting after
    power down.
    - LP: #1058188
  * igb: Fix for failure to init on some 82576 devices.
    - LP: #1058188
  * igb: correct hardware type (i210/i211) check in igb_loopback_test()
    - LP: #1058188
  * igb: don't break user visible strings over multiple lines in
    igb_ethtool.c
    - LP: #1058188
  * igb: add delay to allow igb loopback test to succeed on 8086:10c9
    - LP: #1058188
  * igb: fix panic while dumping packets on Tx hang with IOMMU
    - LP: #1058188
  * igb: Fix register defines for all non-82575 hardware
    - LP: #1058188
  * e1000e: use more informative logging macros when netdev not yet
    registered
    - LP: #1058219
  * e1000e: Cleanup code logic in e1000_check_for_serdes_link_82571()
    - LP: #1058219
  * e1000e: Program the correct register for ITR when using MSI-X.
    - LP: #1058219
  * e1000e: advertise transmit time stamping
    - LP: #1058219
  * e1000e: 82571 Tx Data Corruption during Tx hang recovery
    - LP: #1058219
  * e1000e: fix panic while dumping packets on Tx hang with IOMMU
    - LP: #1058219
  * e1000: Combining Bitwise OR in one expression.
    - LP: #1058221
  * e1000: advertise transmit time stamping
    - LP: #1058221
  * e1000: Small packets may get corrupted during padding by HW
    - LP: #1058221
  * sched: Fix migration thread runtime bogosity
    - LP: #1057593
  * ACER: Add support for accelerometer sensor
    - LP: #1055433
  * ACER: Fix Smatch double-free issue
    - LP: #1055433
  * SAUCE: HID: ntrig: change default value of logical/physical
    width/height to 1
    - LP: #1044248

  [ Ubuntu: 3.5.0-16.24 ]

  * SAUCE: ata_piix: add a disable_driver option
    - LP: #994870
  * (pre-stable) drm/radeon: make 64bit fences more robust v3 (3.5 stable)
    - LP: #1029582
  * SAUCE: ALSA: hda - use both input paths on Conexant auto parser
    - LP: #1037642
  * SAUCE: ALSA: hda - fix control names for multiple speaker out on
    IDT/STAC
    - LP: #1046734
  * SAUCE: ALSA: hda/via - don't report presence on HPs with no presence
    support
    - LP: #1052499
  * S...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.2.0-1420.27

---------------
linux-ti-omap4 (3.2.0-1420.27) precise-proposed; urgency=low

  * Release Tracking Bug
    - LP: #1057431

  [ Paolo Pisati ]

  * [Config] EASYCAP=m
    - LP: #1039584
  * rebased on Ubuntu-3.2.0-32.51

  [ Ubuntu: 3.2.0-32.51 ]

  * Release Tracking Bug
    - LP: #1056036
  * SAUCE: Intel xhci: Only switch the switchable ports
    - LP: #1034814
  * SAUCE: input: Cypress PS/2 Trackpad fix disabling tap-to-click
    - LP: #1048816
  * SAUCE: Input: synaptics - Adjust threshold for treating position values
    as negative
    - LP: #1046512
  * Revert "SAUCE: Force xsave off on older Xen hypervisors"
    - LP: #1044550
  * Revert "HID: wiimote: fix invalid power_supply_powers call"
    - LP: #1048605
  * Revert "drm/radeon: fix bo creation retry path"
    - LP: #1049899
  * HID: wiimote: fix invalid power_supply_powers call
    - LP: #1048605
  * HID: add ASUS AIO keyboard model AK1D
    - LP: #1027789, #1049899
  * nfs: tear down caches in nfs_init_writepagecache when allocation fails
    - LP: #1049899
  * NFS: Use kcalloc() when allocating arrays
    - LP: #1049899
  * NFSv4.1 fix page number calculation bug for filelayout decode buffers
    - LP: #1049899
  * fix page number calculation bug for block layout decode buffer
    - LP: #1049899
  * pnfs: defer release of pages in layoutget
    - LP: #1049899
  * ext4: avoid kmemcheck complaint from reading uninitialized memory
    - LP: #1049899
  * fuse: verify all ioctl retry iov elements
    - LP: #1049899
  * Bluetooth: Fix legacy pairing with some devices
    - LP: #1049899
  * xhci: Increase reset timeout for Renesas 720201 host.
    - LP: #1049899
  * xhci: Add Etron XHCI_TRUST_TX_LENGTH quirk.
    - LP: #1049899
  * USB: ftdi_sio: Add VID/PID for Kondo Serial USB
    - LP: #1049899
  * USB: option: Add Vodafone/Huawei K5005 support
    - LP: #1049899
  * USB: add USB_VENDOR_AND_INTERFACE_INFO() macro
    - LP: #1049899
  * USB: support the new interfaces of Huawei Data Card devices in option
    driver
    - LP: #1049899
  * usb: serial: mos7840: Fixup mos7840_chars_in_buffer()
    - LP: #1049899
  * usb: gadget: u_ether: fix kworker 100% CPU issue with still used
    interfaces in eth_stop
    - LP: #1049899
  * ARM: 7483/1: vfp: only advertise VFPv4 in hwcaps if CONFIG_VFPv3 is
    enabled
    - LP: #1049899
  * ARM: 7488/1: mm: use 5 bits for swapfile type encoding
    - LP: #1049899
  * ARM: 7489/1: errata: fix workaround for erratum #720789 on UP systems
    - LP: #1049899
  * drm/i915: ignore eDP bpc settings from vbt
    - LP: #1049899
  * ALSA: hda - fix Copyright debug message
    - LP: #1049899
  * sched: fix divide by zero at {thread_group,task}_times
    - LP: #1049899
  * ath9k: fix decrypt_error initialization in ath_rx_tasklet()
    - LP: #1049899
  * drm/nvd0/disp: mask off high 16 bit of negative cursor x-coordinate
    - LP: #1049899
  * drm/i915: reorder edp disabling to fix ivb MacBook Air
    - LP: #1049899
  * audit: don't free_chunk() after fsnotify_add_mark()
    - LP: #1049899
  * audit: fix refcounting in audit-tree
    - LP: #1049899
  * vfs: canonicalize create mode in build_op...

[Adam Conrad (adconrad)]

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-armadaxp - 3.2.0-1609.14

---------------
linux-armadaxp (3.2.0-1609.14) precise-proposed; urgency=low

  [ Jani Monoses ]

  * Release Tracking Bug
    - LP: #1057435
  * Rebase on Ubuntu-3.2.0-32.51

  [ Ubuntu: 3.2.0-32.51 ]

  * Release Tracking Bug
    - LP: #1056036
  * SAUCE: Intel xhci: Only switch the switchable ports
    - LP: #1034814
  * SAUCE: input: Cypress PS/2 Trackpad fix disabling tap-to-click
    - LP: #1048816
  * SAUCE: Input: synaptics - Adjust threshold for treating position values
    as negative
    - LP: #1046512
  * Revert "SAUCE: Force xsave off on older Xen hypervisors"
    - LP: #1044550
  * Revert "HID: wiimote: fix invalid power_supply_powers call"
    - LP: #1048605
  * Revert "drm/radeon: fix bo creation retry path"
    - LP: #1049899
  * HID: wiimote: fix invalid power_supply_powers call
    - LP: #1048605
  * HID: add ASUS AIO keyboard model AK1D
    - LP: #1027789, #1049899
  * nfs: tear down caches in nfs_init_writepagecache when allocation fails
    - LP: #1049899
  * NFS: Use kcalloc() when allocating arrays
    - LP: #1049899
  * NFSv4.1 fix page number calculation bug for filelayout decode buffers
    - LP: #1049899
  * fix page number calculation bug for block layout decode buffer
    - LP: #1049899
  * pnfs: defer release of pages in layoutget
    - LP: #1049899
  * ext4: avoid kmemcheck complaint from reading uninitialized memory
    - LP: #1049899
  * fuse: verify all ioctl retry iov elements
    - LP: #1049899
  * Bluetooth: Fix legacy pairing with some devices
    - LP: #1049899
  * xhci: Increase reset timeout for Renesas 720201 host.
    - LP: #1049899
  * xhci: Add Etron XHCI_TRUST_TX_LENGTH quirk.
    - LP: #1049899
  * USB: ftdi_sio: Add VID/PID for Kondo Serial USB
    - LP: #1049899
  * USB: option: Add Vodafone/Huawei K5005 support
    - LP: #1049899
  * USB: add USB_VENDOR_AND_INTERFACE_INFO() macro
    - LP: #1049899
  * USB: support the new interfaces of Huawei Data Card devices in option
    driver
    - LP: #1049899
  * usb: serial: mos7840: Fixup mos7840_chars_in_buffer()
    - LP: #1049899
  * usb: gadget: u_ether: fix kworker 100% CPU issue with still used
    interfaces in eth_stop
    - LP: #1049899
  * ARM: 7483/1: vfp: only advertise VFPv4 in hwcaps if CONFIG_VFPv3 is
    enabled
    - LP: #1049899
  * ARM: 7488/1: mm: use 5 bits for swapfile type encoding
    - LP: #1049899
  * ARM: 7489/1: errata: fix workaround for erratum #720789 on UP systems
    - LP: #1049899
  * drm/i915: ignore eDP bpc settings from vbt
    - LP: #1049899
  * ALSA: hda - fix Copyright debug message
    - LP: #1049899
  * sched: fix divide by zero at {thread_group,task}_times
    - LP: #1049899
  * ath9k: fix decrypt_error initialization in ath_rx_tasklet()
    - LP: #1049899
  * drm/nvd0/disp: mask off high 16 bit of negative cursor x-coordinate
    - LP: #1049899
  * drm/i915: reorder edp disabling to fix ivb MacBook Air
    - LP: #1049899
  * audit: don't free_chunk() after fsnotify_add_mark()
    - LP: #1049899
  * audit: fix refcounting in audit-tree
    - LP: #1049899
  * vfs: canonicalize create mode in build_open_flags()
    - LP: #1049899
  * PCI: EHCI:...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.2.0-32.51

---------------
linux (3.2.0-32.51) precise-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1056036

  [ Keng-Yu Lin ]

  * SAUCE: Intel xhci: Only switch the switchable ports
    - LP: #1034814

  [ Kyle Fazzari ]

  * SAUCE: input: Cypress PS/2 Trackpad fix disabling tap-to-click
    - LP: #1048816

  [ Seth Forshee ]

  * SAUCE: Input: synaptics - Adjust threshold for treating position values
    as negative
    - LP: #1046512

  [ Stefan Bader ]

  * Revert "SAUCE: Force xsave off on older Xen hypervisors"
    - LP: #1044550

  [ Upstream Kernel Changes ]

  * Revert "HID: wiimote: fix invalid power_supply_powers call"
    - LP: #1048605
  * Revert "drm/radeon: fix bo creation retry path"
    - LP: #1049899
  * HID: wiimote: fix invalid power_supply_powers call
    - LP: #1048605
  * HID: add ASUS AIO keyboard model AK1D
    - LP: #1027789, #1049899
  * nfs: tear down caches in nfs_init_writepagecache when allocation fails
    - LP: #1049899
  * NFS: Use kcalloc() when allocating arrays
    - LP: #1049899
  * NFSv4.1 fix page number calculation bug for filelayout decode buffers
    - LP: #1049899
  * fix page number calculation bug for block layout decode buffer
    - LP: #1049899
  * pnfs: defer release of pages in layoutget
    - LP: #1049899
  * ext4: avoid kmemcheck complaint from reading uninitialized memory
    - LP: #1049899
  * fuse: verify all ioctl retry iov elements
    - LP: #1049899
  * Bluetooth: Fix legacy pairing with some devices
    - LP: #1049899
  * xhci: Increase reset timeout for Renesas 720201 host.
    - LP: #1049899
  * xhci: Add Etron XHCI_TRUST_TX_LENGTH quirk.
    - LP: #1049899
  * USB: ftdi_sio: Add VID/PID for Kondo Serial USB
    - LP: #1049899
  * USB: option: Add Vodafone/Huawei K5005 support
    - LP: #1049899
  * USB: add USB_VENDOR_AND_INTERFACE_INFO() macro
    - LP: #1049899
  * USB: support the new interfaces of Huawei Data Card devices in option
    driver
    - LP: #1049899
  * usb: serial: mos7840: Fixup mos7840_chars_in_buffer()
    - LP: #1049899
  * usb: gadget: u_ether: fix kworker 100% CPU issue with still used
    interfaces in eth_stop
    - LP: #1049899
  * ARM: 7483/1: vfp: only advertise VFPv4 in hwcaps if CONFIG_VFPv3 is
    enabled
    - LP: #1049899
  * ARM: 7488/1: mm: use 5 bits for swapfile type encoding
    - LP: #1049899
  * ARM: 7489/1: errata: fix workaround for erratum #720789 on UP systems
    - LP: #1049899
  * drm/i915: ignore eDP bpc settings from vbt
    - LP: #1049899
  * ALSA: hda - fix Copyright debug message
    - LP: #1049899
  * sched: fix divide by zero at {thread_group,task}_times
    - LP: #1049899
  * ath9k: fix decrypt_error initialization in ath_rx_tasklet()
    - LP: #1049899
  * drm/nvd0/disp: mask off high 16 bit of negative cursor x-coordinate
    - LP: #1049899
  * drm/i915: reorder edp disabling to fix ivb MacBook Air
    - LP: #1049899
  * audit: don't free_chunk() after fsnotify_add_mark()
    - LP: #1049899
  * audit: fix refcounting in audit-tree
    - LP: #1049899
  * vfs: canonicalize create mode in build_open_flags()
    - LP: #1049899
  * PCI: EHCI: Fix crash d...