CVE-2013-2546

[John Johansen]

The report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect C library function for copying strings, which allows local users to obtain sensitive information from kernel stack memory by leveraging the CAP_NET_ADMIN capability.

Break-Fix: - 9a5467bf7b6e9e02ec9c3da4e23747c05faeaac6

[John Johansen (jjohansen)]

CVE-2013-2546

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.2.0-40.64

---------------
linux (3.2.0-40.64) precise-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1160017

  [ Stefan Bader ]

  * SAUCE: Revert "SAUCE: xen/pv-spinlock: Never enable interrupts in
    xen_spin_lock_slow()"

  [ Xiangliang Yu ]

  * SAUCE: PCI: define macro for marvell vendor ID
    - LP: #1159863
  * SAUCE: PCI: fix system hang issue of Marvell SATA host controller
    - LP: #1159863

linux (3.2.0-40.63) precise-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1157785

  [ Andy Whitcroft ]

  * [Config] re-disable CONFIG_SOUND_OSS_PRECLAIM
    - LP: #1105230

  [ Luis Henriques ]

  * [Config] CONFIG_NFS_V4_1=y
    - LP: #1111416

  [ Upstream Kernel Changes ]

  * Revert "drm: Add EDID_QUIRK_FORCE_REDUCED_BLANKING for ASUS VW222S"
    - LP: #1150557
  * tmpfs: fix use-after-free of mempolicy object
    - LP: #1143815
    - CVE-2013-1767
  * sunvdc: Fix off-by-one in generic_request().
    - LP: #1150557
  * genirq: Avoid deadlock in spurious handling
    - LP: #1150557
  * KVM: s390: Handle hosts not supporting s390-virtio.
    - LP: #1150557
  * workqueue: consider work function when searching for busy work items
    - LP: #1150557
  * v4l: Reset subdev v4l2_dev field to NULL if registration fails
    - LP: #1150557
  * omap_vout: find_vma() needs ->mmap_sem held
    - LP: #1150557
  * dca: check against empty dca_domains list before unregister provider
    - LP: #1150557
  * powerpc/eeh: Fix crash when adding a device in a slot with DDW
    - LP: #1150557
  * ext4: return ENOMEM if sb_getblk() fails
    - LP: #1150557
  * pcmcia/vrc4171: Add missing spinlock init
    - LP: #1150557
  * Purge existing TLB entries in set_pte_at and ptep_set_wrprotect
    - LP: #1150557
  * ARM: PXA3xx: program the CSMSADRCFG register
    - LP: #1150557
  * USB: option: add and update Alcatel modems
    - LP: #1150557
  * quota: autoload the quota_v2 module for QFMT_VFS_V1 quota format
    - LP: #1150557
  * ext4: fix possible use-after-free with AIO
    - LP: #1150557
  * s390/kvm: Fix store status for ACRS/FPRS
    - LP: #1150557
  * staging: comedi: disallow COMEDI_DEVCONFIG on non-board minors
    - LP: #1150557
  * ALSA: usb-audio: fix Roland A-PRO support
    - LP: #1150557
  * x86-32, mm: Rip out x86_32 NUMA remapping code
    - LP: #1150557
  * ALSA: hda - Release assigned pin/cvt at error path of hdmi_pcm_open()
    - LP: #1150557
  * ext4: fix race in ext4_mb_add_n_trim()
    - LP: #1150557
  * zram: Fix deadlock bug in partial read/write
    - LP: #1150557
  * Driver core: treat unregistered bus_types as having no devices
    - LP: #1150557
  * ALSA: aloop: Fix Oops while PM resume
    - LP: #1150557
  * UBIFS: fix double free of ubifs_orphan objects
    - LP: #1150557
  * tty: set_termios/set_termiox should not return -EINTR
    - LP: #1150557
  * hrtimer: Prevent hrtimer_enqueue_reprogram race
    - LP: #1150557
  * nfsd: Fix memleak
    - LP: #1150557
  * staging: comedi: check s->async for poll(), read() and write()
    - LP: #1150557
  * ACPI: Add DMI entry for Sony VGN-FW41E_H
    - LP: #1150557
  * vgacon/vt: clear buf...

[Adam Conrad (adconrad)]

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-armadaxp - 3.2.0-1616.25

---------------
linux-armadaxp (3.2.0-1616.25) precise-proposed; urgency=low

  [ Ike Panhc ]

  * Release Tracking Bug
    - LP: #1160195
  * Rebase onto Ubuntu-3.2.0-40.64

  [ Ubuntu: 3.2.0-40.64 ]

  * Release Tracking Bug
    - LP: #1160017
  * SAUCE: Revert "SAUCE: xen/pv-spinlock: Never enable interrupts in
    xen_spin_lock_slow()"
  * SAUCE: PCI: define macro for marvell vendor ID
    - LP: #1159863
  * SAUCE: PCI: fix system hang issue of Marvell SATA host controller
    - LP: #1159863
 -- Ike Panhc <email address hidden> Tue, 26 Mar 2013 16:09:13 +0800

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.2.0-1429.38

---------------
linux-ti-omap4 (3.2.0-1429.38) precise-proposed; urgency=low

  * Release Tracking Bug
    - LP: #1160194

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.2.0-40.64

  [ Upstream Kernel Changes ]

  * Fix ABI directories

  [ Ubuntu: 3.2.0-40.64 ]

  * Release Tracking Bug
    - LP: #1160017
  * SAUCE: Revert "SAUCE: xen/pv-spinlock: Never enable interrupts in
    xen_spin_lock_slow()"
  * SAUCE: PCI: define macro for marvell vendor ID
    - LP: #1159863
  * SAUCE: PCI: fix system hang issue of Marvell SATA host controller
    - LP: #1159863

linux-ti-omap4 (3.2.0-1428.37) precise-proposed; urgency=low

  * Release Tracking Bug
    - LP: #1158081

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.2.0-40.63

  [ Ubuntu: 3.2.0-40.63 ]

  * Release Tracking Bug
    - LP: #1157785
  * [Config] re-disable CONFIG_SOUND_OSS_PRECLAIM
    - LP: #1105230
  * [Config] CONFIG_NFS_V4_1=y
    - LP: #1111416
  * Revert "drm: Add EDID_QUIRK_FORCE_REDUCED_BLANKING for ASUS VW222S"
    - LP: #1150557
  * tmpfs: fix use-after-free of mempolicy object
    - LP: #1143815
    - CVE-2013-1767
  * sunvdc: Fix off-by-one in generic_request().
    - LP: #1150557
  * genirq: Avoid deadlock in spurious handling
    - LP: #1150557
  * KVM: s390: Handle hosts not supporting s390-virtio.
    - LP: #1150557
  * workqueue: consider work function when searching for busy work items
    - LP: #1150557
  * v4l: Reset subdev v4l2_dev field to NULL if registration fails
    - LP: #1150557
  * omap_vout: find_vma() needs ->mmap_sem held
    - LP: #1150557
  * dca: check against empty dca_domains list before unregister provider
    - LP: #1150557
  * powerpc/eeh: Fix crash when adding a device in a slot with DDW
    - LP: #1150557
  * ext4: return ENOMEM if sb_getblk() fails
    - LP: #1150557
  * pcmcia/vrc4171: Add missing spinlock init
    - LP: #1150557
  * Purge existing TLB entries in set_pte_at and ptep_set_wrprotect
    - LP: #1150557
  * ARM: PXA3xx: program the CSMSADRCFG register
    - LP: #1150557
  * USB: option: add and update Alcatel modems
    - LP: #1150557
  * quota: autoload the quota_v2 module for QFMT_VFS_V1 quota format
    - LP: #1150557
  * ext4: fix possible use-after-free with AIO
    - LP: #1150557
  * s390/kvm: Fix store status for ACRS/FPRS
    - LP: #1150557
  * staging: comedi: disallow COMEDI_DEVCONFIG on non-board minors
    - LP: #1150557
  * ALSA: usb-audio: fix Roland A-PRO support
    - LP: #1150557
  * x86-32, mm: Rip out x86_32 NUMA remapping code
    - LP: #1150557
  * ALSA: hda - Release assigned pin/cvt at error path of hdmi_pcm_open()
    - LP: #1150557
  * ext4: fix race in ext4_mb_add_n_trim()
    - LP: #1150557
  * zram: Fix deadlock bug in partial read/write
    - LP: #1150557
  * Driver core: treat unregistered bus_types as having no devices
    - LP: #1150557
  * ALSA: aloop: Fix Oops while PM resume
    - LP: #1150557
  * UBIFS: fix double free of ubifs_orphan objects
    - LP: #1150557
  * tty: set_termios/set_termiox should not return -EINTR
    - LP: #1150557
  * hrtimer: Prevent hrtimer_enqueue_reprogram race
    - LP: #1150557
  * nfsd: Fix memleak
    - LP...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-lts-quantal - 3.5.0-27.46~precise1

---------------
linux-lts-quantal (3.5.0-27.46~precise1) precise-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1160183

  [ Steve Conklin ]

  * Start New Release

  [ Upstream Kernel Changes ]

  * crypto: user - fix info leaks in report API
    - LP: #1156790, #1156795, #1156799
    - CVE-2013-2546
  * brcmsmac: fix mismatch in number of custom regulatory rules
    - LP: #1156769

  [ Xiangliang Yu ]

  * SAUCE: PCI: define macro for marvell vendor ID
    - LP: #1159863
  * SAUCE: PCI: fix system hang issue of Marvell SATA host controller
    - LP: #1159863

linux (3.5.0-27.45) quantal-proposed; urgency=low

  [Steve Conklin]

  * no change

linux (3.5.0-27.44) quantal-proposed; urgency=low

  [Steve Conklin]

  * no change

linux (3.5.0-27.43) quantal-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1157270

  [ Adam Lee ]

  * SAUCE: Bluetooth: Add support for 04ca:2007
    - LP: #1153448

  [ Andy Whitcroft ]

  * [Config] re-disable CONFIG_SOUND_OSS_PRECLAIM
    - LP: #1105230

  [ Brad Figg ]

  * Start new release

  [ Kamal Mostafa ]

  * SAUCE: alx: use github.com/qca/alx repo
    - LP: #1154238

  [ Luis Henriques ]

  * [Config] CONFIG_NFS_V4_1=y
    - LP: #1111416

  [ Qualcomm Atheros, Inc ]

  * SAUCE: alx: Update to heads/master
    - LP: #1154238

  [ Upstream Kernel Changes ]

  * Revert "drm: Add EDID_QUIRK_FORCE_REDUCED_BLANKING for ASUS VW222S"
    - LP: #1144961
  * genirq: Avoid deadlock in spurious handling
    - LP: #1144961
  * KVM: s390: Handle hosts not supporting s390-virtio.
    - LP: #1144961
  * v4l: Reset subdev v4l2_dev field to NULL if registration fails
    - LP: #1144961
  * powerpc/eeh: Fix crash when adding a device in a slot with DDW
    - LP: #1144961
  * pcmcia/vrc4171: Add missing spinlock init
    - LP: #1144961
  * USB: DWC3: Generate interrupt on each TRB as default option
    - LP: #1144961
  * usb: dwc3: gadget: fix skip LINK_TRB on ISOC
    - LP: #1144961
  * usb: dwc3: gadget: req->queued must be forced to false in cleanup
    - LP: #1144961
  * Purge existing TLB entries in set_pte_at and ptep_set_wrprotect
    - LP: #1144961
  * ARM: PXA3xx: program the CSMSADRCFG register
    - LP: #1144961
  * ab8500-chargalg: Only root should have write permission on sysfs file
    - LP: #1144961
  * USB: option: add and update Alcatel modems
    - LP: #1144961
  * uprobes/powerpc: Add dependency on single step emulation
    - LP: #1144961
  * drivers/video: fsl-diu-fb: fix pixel formats for 24 and 16 bpp
    - LP: #1144961
  * s390/kvm: Fix store status for ACRS/FPRS
    - LP: #1144961
  * staging: comedi: disallow COMEDI_DEVCONFIG on non-board minors
    - LP: #1144961
  * ALSA: usb-audio: fix Roland A-PRO support
    - LP: #1144961
  * x86-32, mm: Rip out x86_32 NUMA remapping code
    - LP: #1144961
  * x86-32, mm: Remove reference to resume_map_numa_kva()
    - LP: #1144961
  * x86-32, mm: Remove reference to alloc_remap()
    - LP: #1144961
  * ALSA: hda - Release assigned pin/cvt at error path of hdmi_pcm_open()
    - LP: #1144961
  * ab8500_btemp: Demote initcall...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.5.0-27.46

---------------
linux (3.5.0-27.46) quantal-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1159991

  [ Steve Conklin ]

  * Start New Release

  [ Upstream Kernel Changes ]

  * crypto: user - fix info leaks in report API
    - LP: #1156790, #1156795, #1156799
    - CVE-2013-2546
  * brcmsmac: fix mismatch in number of custom regulatory rules
    - LP: #1156769

  [ Xiangliang Yu ]

  * SAUCE: PCI: define macro for marvell vendor ID
    - LP: #1159863
  * SAUCE: PCI: fix system hang issue of Marvell SATA host controller
    - LP: #1159863

linux (3.5.0-27.45) quantal-proposed; urgency=low

  [Steve Conklin]

  * no change

linux (3.5.0-27.44) quantal-proposed; urgency=low

  [Steve Conklin]

  * no change

linux (3.5.0-27.43) quantal-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1156821

  [ Adam Lee ]

  * SAUCE: Bluetooth: Add support for 04ca:2007
    - LP: #1153448

  [ Andy Whitcroft ]

  * [Config] re-disable CONFIG_SOUND_OSS_PRECLAIM
    - LP: #1105230

  [ Brad Figg ]

  * Start new release

  [ Kamal Mostafa ]

  * SAUCE: alx: use github.com/qca/alx repo
    - LP: #1154238

  [ Luis Henriques ]

  * [Config] CONFIG_NFS_V4_1=y
    - LP: #1111416

  [ Qualcomm Atheros, Inc ]

  * SAUCE: alx: Update to heads/master
    - LP: #1154238

  [ Upstream Kernel Changes ]

  * Revert "drm: Add EDID_QUIRK_FORCE_REDUCED_BLANKING for ASUS VW222S"
    - LP: #1144961
  * genirq: Avoid deadlock in spurious handling
    - LP: #1144961
  * KVM: s390: Handle hosts not supporting s390-virtio.
    - LP: #1144961
  * v4l: Reset subdev v4l2_dev field to NULL if registration fails
    - LP: #1144961
  * powerpc/eeh: Fix crash when adding a device in a slot with DDW
    - LP: #1144961
  * pcmcia/vrc4171: Add missing spinlock init
    - LP: #1144961
  * USB: DWC3: Generate interrupt on each TRB as default option
    - LP: #1144961
  * usb: dwc3: gadget: fix skip LINK_TRB on ISOC
    - LP: #1144961
  * usb: dwc3: gadget: req->queued must be forced to false in cleanup
    - LP: #1144961
  * Purge existing TLB entries in set_pte_at and ptep_set_wrprotect
    - LP: #1144961
  * ARM: PXA3xx: program the CSMSADRCFG register
    - LP: #1144961
  * ab8500-chargalg: Only root should have write permission on sysfs file
    - LP: #1144961
  * USB: option: add and update Alcatel modems
    - LP: #1144961
  * uprobes/powerpc: Add dependency on single step emulation
    - LP: #1144961
  * drivers/video: fsl-diu-fb: fix pixel formats for 24 and 16 bpp
    - LP: #1144961
  * s390/kvm: Fix store status for ACRS/FPRS
    - LP: #1144961
  * staging: comedi: disallow COMEDI_DEVCONFIG on non-board minors
    - LP: #1144961
  * ALSA: usb-audio: fix Roland A-PRO support
    - LP: #1144961
  * x86-32, mm: Rip out x86_32 NUMA remapping code
    - LP: #1144961
  * x86-32, mm: Remove reference to resume_map_numa_kva()
    - LP: #1144961
  * x86-32, mm: Remove reference to alloc_remap()
    - LP: #1144961
  * ALSA: hda - Release assigned pin/cvt at error path of hdmi_pcm_open()
    - LP: #1144961
  * ab8500_btemp: Demote initcall sequence
    - LP: #1144961
  * Driver co...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-armadaxp - 3.5.0-1611.17

---------------
linux-armadaxp (3.5.0-1611.17) quantal-proposed; urgency=low

  [ Ike Panhc ]

  * Release Tracking Bug
    - LP: #1160181
  * Rebase onto Ubuntu-3.5.0-27.46

  [ Ubuntu: 3.5.0-27.46 ]

  * Release Tracking Bug
    - LP: #1159991
  * Start New Release
  * crypto: user - fix info leaks in report API
    - LP: #1156790, #1156795, #1156799
    - CVE-2013-2546
  * brcmsmac: fix mismatch in number of custom regulatory rules
    - LP: #1156769
  * SAUCE: PCI: define macro for marvell vendor ID
    - LP: #1159863
  * SAUCE: PCI: fix system hang issue of Marvell SATA host controller
    - LP: #1159863

  [ Ubuntu: 3.5.0-27.45 ]

  * no change

  [ Ubuntu: 3.5.0-27.44 ]

  * no change
 -- Ike Panhc <email address hidden> Tue, 26 Mar 2013 16:59:14 +0800

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.5.0-222.33

---------------
linux-ti-omap4 (3.5.0-222.33) quantal-proposed; urgency=low

  * Release Tracking Bug
    - LP: #1160180

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.5.0-27.46

  [ Ubuntu: 3.5.0-27.46 ]

  * Release Tracking Bug
    - LP: #1159991
  * Start New Release
  * crypto: user - fix info leaks in report API
    - LP: #1156790, #1156795, #1156799
    - CVE-2013-2546
  * brcmsmac: fix mismatch in number of custom regulatory rules
    - LP: #1156769
  * SAUCE: PCI: define macro for marvell vendor ID
    - LP: #1159863
  * SAUCE: PCI: fix system hang issue of Marvell SATA host controller
    - LP: #1159863

linux-ti-omap4 (3.5.0-222.32) quantal-proposed; urgency=low

  * Release Tracking Bug
    - LP: #1157831

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.5.0-27.45

  [ Ubuntu: 3.5.0-27.45 ]

  * no change

  [ Ubuntu: 3.5.0-27.44 ]

  * no change

  [ Ubuntu: 3.5.0-27.43 ]

  * Release Tracking Bug
    - LP: #1156821
  * SAUCE: Bluetooth: Add support for 04ca:2007
    - LP: #1153448
  * [Config] re-disable CONFIG_SOUND_OSS_PRECLAIM
    - LP: #1105230
  * Start new release
  * SAUCE: alx: use github.com/qca/alx repo
    - LP: #1154238
  * [Config] CONFIG_NFS_V4_1=y
    - LP: #1111416
  * SAUCE: alx: Update to heads/master
    - LP: #1154238
  * Revert "drm: Add EDID_QUIRK_FORCE_REDUCED_BLANKING for ASUS VW222S"
    - LP: #1144961
  * genirq: Avoid deadlock in spurious handling
    - LP: #1144961
  * KVM: s390: Handle hosts not supporting s390-virtio.
    - LP: #1144961
  * v4l: Reset subdev v4l2_dev field to NULL if registration fails
    - LP: #1144961
  * powerpc/eeh: Fix crash when adding a device in a slot with DDW
    - LP: #1144961
  * pcmcia/vrc4171: Add missing spinlock init
    - LP: #1144961
  * USB: DWC3: Generate interrupt on each TRB as default option
    - LP: #1144961
  * usb: dwc3: gadget: fix skip LINK_TRB on ISOC
    - LP: #1144961
  * usb: dwc3: gadget: req->queued must be forced to false in cleanup
    - LP: #1144961
  * Purge existing TLB entries in set_pte_at and ptep_set_wrprotect
    - LP: #1144961
  * ARM: PXA3xx: program the CSMSADRCFG register
    - LP: #1144961
  * ab8500-chargalg: Only root should have write permission on sysfs file
    - LP: #1144961
  * USB: option: add and update Alcatel modems
    - LP: #1144961
  * uprobes/powerpc: Add dependency on single step emulation
    - LP: #1144961
  * drivers/video: fsl-diu-fb: fix pixel formats for 24 and 16 bpp
    - LP: #1144961
  * s390/kvm: Fix store status for ACRS/FPRS
    - LP: #1144961
  * staging: comedi: disallow COMEDI_DEVCONFIG on non-board minors
    - LP: #1144961
  * ALSA: usb-audio: fix Roland A-PRO support
    - LP: #1144961
  * x86-32, mm: Rip out x86_32 NUMA remapping code
    - LP: #1144961
  * x86-32, mm: Remove reference to resume_map_numa_kva()
    - LP: #1144961
  * x86-32, mm: Remove reference to alloc_remap()
    - LP: #1144961
  * ALSA: hda - Release assigned pin/cvt at error path of hdmi_pcm_open()
    - LP: #1144961
  * ab8500_btemp: Demote initcall sequence
    - LP: #1144961
  * Driver core: treat unregistered bus_types as having no devices
    - LP: #1144961
  * ALSA...

[Andy Whitcroft (apw)]

This bug was nominated against a series that is no longer supported, ie vivid. The bug task representing the vivid nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.