CVE-2013-2546

[John Johansen]

The report API in the crypto user configuration API in the Linux kernel through 3.8.2 uses an incorrect C library function for copying strings, which allows local users to obtain sensitive information from kernel stack memory by leveraging the CAP_NET_ADMIN capability.

Break-Fix: - 9a5467bf7b6e9e02ec9c3da4e23747c05faeaac6

[John Johansen (jjohansen)]

CVE-2013-2546

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.2.0-40.64

---------------
linux (3.2.0-40.64) precise-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1160017

  [ Stefan Bader ]

  * SAUCE: Revert "SAUCE: xen/pv-spinlock: Never enable interrupts in
    xen_spin_lock_slow()"

  [ Xiangliang Yu ]

  * SAUCE: PCI: define macro for marvell vendor ID
    - LP: #1159863
  * SAUCE: PCI: fix system hang issue of Marvell SATA host controller
    - LP: #1159863

linux (3.2.0-40.63) precise-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1157785

  [ Andy Whitcroft ]

  * [Config] re-disable CONFIG_SOUND_OSS_PRECLAIM
    - LP: #1105230

  [ Luis Henriques ]

  * [Config] CONFIG_NFS_V4_1=y
    - LP: #1111416

  [ Upstream Kernel Changes ]

  * Revert "drm: Add EDID_QUIRK_FORCE_REDUCED_BLANKING for ASUS VW222S"
    - LP: #1150557
  * tmpfs: fix use-after-free of mempolicy object
    - LP: #1143815
    - CVE-2013-1767
  * sunvdc: Fix off-by-one in generic_request().
    - LP: #1150557
  * genirq: Avoid deadlock in spurious handling
    - LP: #1150557
  * KVM: s390: Handle hosts not supporting s390-virtio.
    - LP: #1150557
  * workqueue: consider work function when searching for busy work items
    - LP: #1150557
  * v4l: Reset subdev v4l2_dev field to NULL if registration fails
    - LP: #1150557
  * omap_vout: find_vma() needs ->mmap_sem held
    - LP: #1150557
  * dca: check against empty dca_domains list before unregister provider
    - LP: #1150557
  * powerpc/eeh: Fix crash when adding a device in a slot with DDW
    - LP: #1150557
  * ext4: return ENOMEM if sb_getblk() fails
    - LP: #1150557
  * pcmcia/vrc4171: Add missing spinlock init
    - LP: #1150557
  * Purge existing TLB entries in set_pte_at and ptep_set_wrprotect
    - LP: #1150557
  * ARM: PXA3xx: program the CSMSADRCFG register
    - LP: #1150557
  * USB: option: add and update Alcatel modems
    - LP: #1150557
  * quota: autoload the quota_v2 module for QFMT_VFS_V1 quota format
    - LP: #1150557
  * ext4: fix possible use-after-free with AIO
    - LP: #1150557
  * s390/kvm: Fix store status for ACRS/FPRS
    - LP: #1150557
  * staging: comedi: disallow COMEDI_DEVCONFIG on non-board minors
    - LP: #1150557
  * ALSA: usb-audio: fix Roland A-PRO support
    - LP: #1150557
  * x86-32, mm: Rip out x86_32 NUMA remapping code
    - LP: #1150557
  * ALSA: hda - Release assigned pin/cvt at error path of hdmi_pcm_open()
    - LP: #1150557
  * ext4: fix race in ext4_mb_add_n_trim()
    - LP: #1150557
  * zram: Fix deadlock bug in partial read/write
    - LP: #1150557
  * Driver core: treat unregistered bus_types as having no devices
    - LP: #1150557
  * ALSA: aloop: Fix Oops while PM resume
    - LP: #1150557
  * UBIFS: fix double free of ubifs_orphan objects
    - LP: #1150557
  * tty: set_termios/set_termiox should not return -EINTR
    - LP: #1150557
  * hrtimer: Prevent hrtimer_enqueue_reprogram race
    - LP: #1150557
  * nfsd: Fix memleak
    - LP: #1150557
  * staging: comedi: check s->async for poll(), read() and write()
    - LP: #1150557
  * ACPI: Add DMI entry for Sony VGN-FW41E_H
    - LP: #1150557
  * vgacon/vt: clear buf...

[Adam Conrad (adconrad)]

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-armadaxp - 3.2.0-1616.25

---------------
linux-armadaxp (3.2.0-1616.25) precise-proposed; urgency=low

  [ Ike Panhc ]

  * Release Tracking Bug
    - LP: #1160195
  * Rebase onto Ubuntu-3.2.0-40.64

  [ Ubuntu: 3.2.0-40.64 ]

  * Release Tracking Bug
    - LP: #1160017
  * SAUCE: Revert "SAUCE: xen/pv-spinlock: Never enable interrupts in
    xen_spin_lock_slow()"
  * SAUCE: PCI: define macro for marvell vendor ID
    - LP: #1159863
  * SAUCE: PCI: fix system hang issue of Marvell SATA host controller
    - LP: #1159863
 -- Ike Panhc <email address hidden> Tue, 26 Mar 2013 16:09:13 +0800

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.2.0-1429.38

---------------
linux-ti-omap4 (3.2.0-1429.38) precise-proposed; urgency=low

  * Release Tracking Bug
    - LP: #1160194

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.2.0-40.64

  [ Upstream Kernel Changes ]

  * Fix ABI directories

  [ Ubuntu: 3.2.0-40.64 ]

  * Release Tracking Bug
    - LP: #1160017
  * SAUCE: Revert "SAUCE: xen/pv-spinlock: Never enable interrupts in
    xen_spin_lock_slow()"
  * SAUCE: PCI: define macro for marvell vendor ID
    - LP: #1159863
  * SAUCE: PCI: fix system hang issue of Marvell SATA host controller
    - LP: #1159863

linux-ti-omap4 (3.2.0-1428.37) precise-proposed; urgency=low

  * Release Tracking Bug
    - LP: #1158081

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.2.0-40.63

  [ Ubuntu: 3.2.0-40.63 ]

  * Release Tracking Bug
    - LP: #1157785
  * [Config] re-disable CONFIG_SOUND_OSS_PRECLAIM
    - LP: #1105230
  * [Config] CONFIG_NFS_V4_1=y
    - LP: #1111416
  * Revert "drm: Add EDID_QUIRK_FORCE_REDUCED_BLANKING for ASUS VW222S"
    - LP: #1150557
  * tmpfs: fix use-after-free of mempolicy object
    - LP: #1143815
    - CVE-2013-1767
  * sunvdc: Fix off-by-one in generic_request().
    - LP: #1150557
  * genirq: Avoid deadlock in spurious handling
    - LP: #1150557
  * KVM: s390: Handle hosts not supporting s390-virtio.
    - LP: #1150557
  * workqueue: consider work function when searching for busy work items
    - LP: #1150557
  * v4l: Reset subdev v4l2_dev field to NULL if registration fails
    - LP: #1150557
  * omap_vout: find_vma() needs ->mmap_sem held
    - LP: #1150557
  * dca: check against empty dca_domains list before unregister provider
    - LP: #1150557
  * powerpc/eeh: Fix crash when adding a device in a slot with DDW
    - LP: #1150557
  * ext4: return ENOMEM if sb_getblk() fails
    - LP: #1150557
  * pcmcia/vrc4171: Add missing spinlock init
    - LP: #1150557
  * Purge existing TLB entries in set_pte_at and ptep_set_wrprotect
    - LP: #1150557
  * ARM: PXA3xx: program the CSMSADRCFG register
    - LP: #1150557
  * USB: option: add and update Alcatel modems
    - LP: #1150557
  * quota: autoload the quota_v2 module for QFMT_VFS_V1 quota format
    - LP: #1150557
  * ext4: fix possible use-after-free with AIO
    - LP: #1150557
  * s390/kvm: Fix store status for ACRS/FPRS
    - LP: #1150557
  * staging: comedi: disallow COMEDI_DEVCONFIG on non-board minors
    - LP: #1150557
  * ALSA: usb-audio: fix Roland A-PRO support
    - LP: #1150557
  * x86-32, mm: Rip out x86_32 NUMA remapping code
    - LP: #1150557
  * ALSA: hda - Release assigned pin/cvt at error path of hdmi_pcm_open()
    - LP: #1150557
  * ext4: fix race in ext4_mb_add_n_trim()
    - LP: #1150557
  * zram: Fix deadlock bug in partial read/write
    - LP: #1150557
  * Driver core: treat unregistered bus_types as having no devices
    - LP: #1150557
  * ALSA: aloop: Fix Oops while PM resume
    - LP: #1150557
  * UBIFS: fix double free of ubifs_orphan objects
    - LP: #1150557
  * tty: set_termios/set_termiox should not return -EINTR
    - LP: #1150557
  * hrtimer: Prevent hrtimer_enqueue_reprogram race
    - LP: #1150557
  * nfsd: Fix memleak
    - LP...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-lts-quantal - 3.5.0-27.46~precise1

---------------
linux-lts-quantal (3.5.0-27.46~precise1) precise-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1160183

  [ Steve Conklin ]

  * Start New Release

  [ Upstream Kernel Changes ]

  * crypto: user - fix info leaks in report API
    - LP: #1156790, #1156795, #1156799
    - CVE-2013-2546
  * brcmsmac: fix mismatch in number of custom regulatory rules
    - LP: #1156769

  [ Xiangliang Yu ]

  * SAUCE: PCI: define macro for marvell vendor ID
    - LP: #1159863
  * SAUCE: PCI: fix system hang issue of Marvell SATA host controller
    - LP: #1159863

linux (3.5.0-27.45) quantal-proposed; urgency=low

  [Steve Conklin]

  * no change

linux (3.5.0-27.44) quantal-proposed; urgency=low

  [Steve Conklin]

  * no change

linux (3.5.0-27.43) quantal-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1157270

  [ Adam Lee ]

  * SAUCE: Bluetooth: Add support for 04ca:2007
    - LP: #1153448

  [ Andy Whitcroft ]

  * [Config] re-disable CONFIG_SOUND_OSS_PRECLAIM
    - LP: #1105230

  [ Brad Figg ]

  * Start new release

  [ Kamal Mostafa ]

  * SAUCE: alx: use github.com/qca/alx repo
    - LP: #1154238

  [ Luis Henriques ]

  * [Config] CONFIG_NFS_V4_1=y
    - LP: #1111416

  [ Qualcomm Atheros, Inc ]

  * SAUCE: alx: Update to heads/master
    - LP: #1154238

  [ Upstream Kernel Changes ]

  * Revert "drm: Add EDID_QUIRK_FORCE_REDUCED_BLANKING for ASUS VW222S"
    - LP: #1144961
  * genirq: Avoid deadlock in spurious handling
    - LP: #1144961
  * KVM: s390: Handle hosts not supporting s390-virtio.
    - LP: #1144961
  * v4l: Reset subdev v4l2_dev field to NULL if registration fails
    - LP: #1144961
  * powerpc/eeh: Fix crash when adding a device in a slot with DDW
    - LP: #1144961
  * pcmcia/vrc4171: Add missing spinlock init
    - LP: #1144961
  * USB: DWC3: Generate interrupt on each TRB as default option
    - LP: #1144961
  * usb: dwc3: gadget: fix skip LINK_TRB on ISOC
    - LP: #1144961
  * usb: dwc3: gadget: req->queued must be forced to false in cleanup
    - LP: #1144961
  * Purge existing TLB entries in set_pte_at and ptep_set_wrprotect
    - LP: #1144961
  * ARM: PXA3xx: program the CSMSADRCFG register
    - LP: #1144961
  * ab8500-chargalg: Only root should have write permission on sysfs file
    - LP: #1144961
  * USB: option: add and update Alcatel modems
    - LP: #1144961
  * uprobes/powerpc: Add dependency on single step emulation
    - LP: #1144961
  * drivers/video: fsl-diu-fb: fix pixel formats for 24 and 16 bpp
    - LP: #1144961
  * s390/kvm: Fix store status for ACRS/FPRS
    - LP: #1144961
  * staging: comedi: disallow COMEDI_DEVCONFIG on non-board minors
    - LP: #1144961
  * ALSA: usb-audio: fix Roland A-PRO support
    - LP: #1144961
  * x86-32, mm: Rip out x86_32 NUMA remapping code
    - LP: #1144961
  * x86-32, mm: Remove reference to resume_map_numa_kva()
    - LP: #1144961
  * x86-32, mm: Remove reference to alloc_remap()
    - LP: #1144961
  * ALSA: hda - Release assigned pin/cvt at error path of hdmi_pcm_open()
    - LP: #1144961
  * ab8500_btemp: Demote initcall...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.5.0-27.46

---------------
linux (3.5.0-27.46) quantal-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1159991

  [ Steve Conklin ]

  * Start New Release

  [ Upstream Kernel Changes ]

  * crypto: user - fix info leaks in report API
    - LP: #1156790, #1156795, #1156799
    - CVE-2013-2546
  * brcmsmac: fix mismatch in number of custom regulatory rules
    - LP: #1156769

  [ Xiangliang Yu ]

  * SAUCE: PCI: define macro for marvell vendor ID
    - LP: #1159863
  * SAUCE: PCI: fix system hang issue of Marvell SATA host controller
    - LP: #1159863

linux (3.5.0-27.45) quantal-proposed; urgency=low

  [Steve Conklin]

  * no change

linux (3.5.0-27.44) quantal-proposed; urgency=low

  [Steve Conklin]

  * no change

linux (3.5.0-27.43) quantal-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1156821

  [ Adam Lee ]

  * SAUCE: Bluetooth: Add support for 04ca:2007
    - LP: #1153448

  [ Andy Whitcroft ]

  * [Config] re-disable CONFIG_SOUND_OSS_PRECLAIM
    - LP: #1105230

  [ Brad Figg ]

  * Start new release

  [ Kamal Mostafa ]

  * SAUCE: alx: use github.com/qca/alx repo
    - LP: #1154238

  [ Luis Henriques ]

  * [Config] CONFIG_NFS_V4_1=y
    - LP: #1111416

  [ Qualcomm Atheros, Inc ]

  * SAUCE: alx: Update to heads/master
    - LP: #1154238

  [ Upstream Kernel Changes ]

  * Revert "drm: Add EDID_QUIRK_FORCE_REDUCED_BLANKING for ASUS VW222S"
    - LP: #1144961
  * genirq: Avoid deadlock in spurious handling
    - LP: #1144961
  * KVM: s390: Handle hosts not supporting s390-virtio.
    - LP: #1144961
  * v4l: Reset subdev v4l2_dev field to NULL if registration fails
    - LP: #1144961
  * powerpc/eeh: Fix crash when adding a device in a slot with DDW
    - LP: #1144961
  * pcmcia/vrc4171: Add missing spinlock init
    - LP: #1144961
  * USB: DWC3: Generate interrupt on each TRB as default option
    - LP: #1144961
  * usb: dwc3: gadget: fix skip LINK_TRB on ISOC
    - LP: #1144961
  * usb: dwc3: gadget: req->queued must be forced to false in cleanup
    - LP: #1144961
  * Purge existing TLB entries in set_pte_at and ptep_set_wrprotect
    - LP: #1144961
  * ARM: PXA3xx: program the CSMSADRCFG register
    - LP: #1144961
  * ab8500-chargalg: Only root should have write permission on sysfs file
    - LP: #1144961
  * USB: option: add and update Alcatel modems
    - LP: #1144961
  * uprobes/powerpc: Add dependency on single step emulation
    - LP: #1144961
  * drivers/video: fsl-diu-fb: fix pixel formats for 24 and 16 bpp
    - LP: #1144961
  * s390/kvm: Fix store status for ACRS/FPRS
    - LP: #1144961
  * staging: comedi: disallow COMEDI_DEVCONFIG on non-board minors
    - LP: #1144961
  * ALSA: usb-audio: fix Roland A-PRO support
    - LP: #1144961
  * x86-32, mm: Rip out x86_32 NUMA remapping code
    - LP: #1144961
  * x86-32, mm: Remove reference to resume_map_numa_kva()
    - LP: #1144961
  * x86-32, mm: Remove reference to alloc_remap()
    - LP: #1144961
  * ALSA: hda - Release assigned pin/cvt at error path of hdmi_pcm_open()
    - LP: #1144961
  * ab8500_btemp: Demote initcall sequence
    - LP: #1144961
  * Driver co...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-armadaxp - 3.5.0-1611.17

---------------
linux-armadaxp (3.5.0-1611.17) quantal-proposed; urgency=low

  [ Ike Panhc ]

  * Release Tracking Bug
    - LP: #1160181
  * Rebase onto Ubuntu-3.5.0-27.46

  [ Ubuntu: 3.5.0-27.46 ]

  * Release Tracking Bug
    - LP: #1159991
  * Start New Release
  * crypto: user - fix info leaks in report API
    - LP: #1156790, #1156795, #1156799
    - CVE-2013-2546
  * brcmsmac: fix mismatch in number of custom regulatory rules
    - LP: #1156769
  * SAUCE: PCI: define macro for marvell vendor ID
    - LP: #1159863
  * SAUCE: PCI: fix system hang issue of Marvell SATA host controller
    - LP: #1159863

  [ Ubuntu: 3.5.0-27.45 ]

  * no change

  [ Ubuntu: 3.5.0-27.44 ]

  * no change
 -- Ike Panhc <email address hidden> Tue, 26 Mar 2013 16:59:14 +0800

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.5.0-222.33

---------------
linux-ti-omap4 (3.5.0-222.33) quantal-proposed; urgency=low

  * Release Tracking Bug
    - LP: #1160180

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.5.0-27.46

  [ Ubuntu: 3.5.0-27.46 ]

  * Release Tracking Bug
    - LP: #1159991
  * Start New Release
  * crypto: user - fix info leaks in report API
    - LP: #1156790, #1156795, #1156799
    - CVE-2013-2546
  * brcmsmac: fix mismatch in number of custom regulatory rules
    - LP: #1156769
  * SAUCE: PCI: define macro for marvell vendor ID
    - LP: #1159863
  * SAUCE: PCI: fix system hang issue of Marvell SATA host controller
    - LP: #1159863

linux-ti-omap4 (3.5.0-222.32) quantal-proposed; urgency=low

  * Release Tracking Bug
    - LP: #1157831

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.5.0-27.45

  [ Ubuntu: 3.5.0-27.45 ]

  * no change

  [ Ubuntu: 3.5.0-27.44 ]

  * no change

  [ Ubuntu: 3.5.0-27.43 ]

  * Release Tracking Bug
    - LP: #1156821
  * SAUCE: Bluetooth: Add support for 04ca:2007
    - LP: #1153448
  * [Config] re-disable CONFIG_SOUND_OSS_PRECLAIM
    - LP: #1105230
  * Start new release
  * SAUCE: alx: use github.com/qca/alx repo
    - LP: #1154238
  * [Config] CONFIG_NFS_V4_1=y
    - LP: #1111416
  * SAUCE: alx: Update to heads/master
    - LP: #1154238
  * Revert "drm: Add EDID_QUIRK_FORCE_REDUCED_BLANKING for ASUS VW222S"
    - LP: #1144961
  * genirq: Avoid deadlock in spurious handling
    - LP: #1144961
  * KVM: s390: Handle hosts not supporting s390-virtio.
    - LP: #1144961
  * v4l: Reset subdev v4l2_dev field to NULL if registration fails
    - LP: #1144961
  * powerpc/eeh: Fix crash when adding a device in a slot with DDW
    - LP: #1144961
  * pcmcia/vrc4171: Add missing spinlock init
    - LP: #1144961
  * USB: DWC3: Generate interrupt on each TRB as default option
    - LP: #1144961
  * usb: dwc3: gadget: fix skip LINK_TRB on ISOC
    - LP: #1144961
  * usb: dwc3: gadget: req->queued must be forced to false in cleanup
    - LP: #1144961
  * Purge existing TLB entries in set_pte_at and ptep_set_wrprotect
    - LP: #1144961
  * ARM: PXA3xx: program the CSMSADRCFG register
    - LP: #1144961
  * ab8500-chargalg: Only root should have write permission on sysfs file
    - LP: #1144961
  * USB: option: add and update Alcatel modems
    - LP: #1144961
  * uprobes/powerpc: Add dependency on single step emulation
    - LP: #1144961
  * drivers/video: fsl-diu-fb: fix pixel formats for 24 and 16 bpp
    - LP: #1144961
  * s390/kvm: Fix store status for ACRS/FPRS
    - LP: #1144961
  * staging: comedi: disallow COMEDI_DEVCONFIG on non-board minors
    - LP: #1144961
  * ALSA: usb-audio: fix Roland A-PRO support
    - LP: #1144961
  * x86-32, mm: Rip out x86_32 NUMA remapping code
    - LP: #1144961
  * x86-32, mm: Remove reference to resume_map_numa_kva()
    - LP: #1144961
  * x86-32, mm: Remove reference to alloc_remap()
    - LP: #1144961
  * ALSA: hda - Release assigned pin/cvt at error path of hdmi_pcm_open()
    - LP: #1144961
  * ab8500_btemp: Demote initcall sequence
    - LP: #1144961
  * Driver core: treat unregistered bus_types as having no devices
    - LP: #1144961
  * ALSA...