CVE-2013-1798

[John Johansen]

The ioapic_read_indirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPIC_REG_SELECT and IOAPIC_REG_WINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of service (host OS OOPS) via a crafted application.

Break-Fix: - a2c118bfab8bc6b8bb213abfc35201e441693d55

[John Johansen (jjohansen)]

CVE-2013-1798

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.8.0-18.28

---------------
linux (3.8.0-18.28) raring; urgency=low

  [ Andy Whitcroft ]

  * (debian) fix internal linkage for separated header packages
    - LP: #1165259

  [ Gavin Guo ]

  * SAUCE: Bluetooth: Add support for Broadcom 413c:8143
    - LP: #1166113

  [ John Johansen ]

  * SAUCE: (no-up) apparmor: Fix quieting of audit messages for network
    mediation
    - LP: #1163259

  [ Kamal Mostafa ]

  * SAUCE: (no-up) drm/i915: quirk no PCH_PWM_ENABLE for Dell XPS13
    backlight
    - LP: #1162026, #1163720

  [ Leann Ogasawara ]

  * [Config] Disable CONFIG_PARPORT_PC_FIFO
    - LP: #339752

  [ Martin Pitt ]

  * SAUCE: (no-up) mac80211_hwsim: Register and bind to driver
    - LP: #1166250

  [ Paolo Pisati ]

  * [Config] RTC_DRV_PL031=y

  [ Stefan Bader ]

  * (debian) Abort build on unresolved symbols
    - LP: #1166197

  [ Tim Gardner ]

  * [Config] Add libceph to inclusion list
  * [Config] Drop all inclusion list modules with unsatisfied dependencies
  * SAUCE: (no-up) Remove emi62 files duplicated in linux-firmware
  * SAUCE: (no-up) Remove emi26 files duplicated in linux-firmware
  * SAUCE: (no-up) Remove whiteheat files duplicated in linux-firmware
  * Release Tracking Bug
    - LP: #1168040

  [ Upstream Kernel Changes ]

  * TTY: do not update atime/mtime on read/write
    - LP: #1097680
    - CVE-2013-0160
  * KVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions
    (CVE-2013-1797)
    - LP: #1158258
    - CVE-2013-1797
  * KVM: Fix bounds checking in ioapic indirect register reads
    (CVE-2013-1798)
    - LP: #1158262
    - CVE-2013-1798
  * drm/i915: HDMI/DP - ELD info refresh support for Haswell
    - LP: #1011438
  * ALSA - HDA: New PCI ID for Haswell ULT
    - LP: #1011438
  * ALSA: hda - Support rereading widgets under the function group
    - LP: #1011438
  * ALSA: hda - Add fixup for Haswell to enable all pin and convertor
    widgets
    - LP: #1011438
  * libata: fix DMA to stack in reading devslp_timing parameters
    - LP: #1031173
  * dmaengine: dw_dmac: remove CLK dependency
    - LP: #1031163
  * dmaengine: dw_dmac: Enhance device tree support
    - LP: #1031163
  * dmaengine: dw_dmac: amend description and indentation
    - LP: #1031163
  * dw_dmac: change dev_printk() to corresponding macros
    - LP: #1031163
  * dw_dmac: don't call platform_get_drvdata twice
    - LP: #1031163
  * dw_dmac: change dev_crit to dev_WARN in dwc_handle_error
    - LP: #1031163
  * dw_dmac: introduce to_dw_desc() macro
    - LP: #1031163
  * dw_dmac: absence of pdata isn't critical when autocfg is set
    - LP: #1031163
  * dw_dmac: check for mapping errors
    - LP: #1031163
  * dw_dmac: remove redundant check
    - LP: #1031163
  * dw_dmac: update tx_node_active in dwc_do_single_block
    - LP: #1031163
  * dma: dw_dmac: add dwc_chan_pause and dwc_chan_resume
    - LP: #1031163
  * dmaengine: introduce is_slave_direction function
    - LP: #1031163
  * dmaengine: add possibility for cyclic transfers
    - LP: #1031163
  * dma: dw_dmac: check direction properly in dw_dma_cyclic_prep
    - LP: #1031163
  * dma: ep93xx_dma: reuse is_slave_direction helpe...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.5.0-223.34

---------------
linux-ti-omap4 (3.5.0-223.34) quantal-proposed; urgency=low

  * Release Tracking Bug
    - LP: #1167153

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.5.0-28.47

  [ Ubuntu: 3.5.0-28.47 ]

  * Release Tracking Bug
    - LP: #1166876
  * SAUCE: Bluetooth: Add support for 105b:e065
    - LP: #1161261
  * SAUCE: (no-up) apparmor: Fix quieting of audit messages for network
    mediation
    - LP: #1163259
  * NFSv4: Fix the string length returned by the idmapper
    - LP: #1101292
  * Input: cypress_ps2 - fix trackpadi found in Dell XPS12
    - LP: #1103594
  * omap_vout: find_vma() needs ->mmap_sem held
    - LP: #1164714
  * nfsd: Fix memleak
    - LP: #1164714
  * iommu/amd: Initialize device table after dma_ops
    - LP: #1164714
  * svcrpc: make svc_age_temp_xprts enqueue under sv_lock
    - LP: #1164714
  * target: Add missing mapped_lun bounds checking during make_mappedlun
    setup
    - LP: #1164714
  * xen-blkback: do not leak mode property
    - LP: #1164714
  * btrfs: Init io_lock after cloning btrfs device struct
    - LP: #1164714
  * NFS: Don't allow NFS silly-renamed files to be deleted, no signal
    - LP: #1164714
  * SUNRPC: Don't start the retransmission timer when out of socket space
    - LP: #1164714
  * storvsc: Initialize the sglist
    - LP: #1164714
  * dc395x: uninitialized variable in device_alloc()
    - LP: #1164714
  * ALSA: bt87x: Make load_all parameter working again
    - LP: #1164714
  * ARM: VFP: fix emulation of second VFP instruction
    - LP: #1164714
  * ARM: fix scheduling while atomic warning in alignment handling code
    - LP: #1164714
  * doc, xen: Mention 'earlyprintk=xen' in the documentation.
    - LP: #1164714
  * doc, kernel-parameters: Document 'console=hvc<n>'
    - LP: #1164714
  * sony-laptop: fully enable SNY controlled modems
    - LP: #1164714
  * x86: Make sure we can boot in the case the BDA contains pure garbage
    - LP: #1164714
  * cifs: ensure that cifs_get_root() only traverses directories
    - LP: #1164714
  * iscsi-target: Fix immediate queue starvation regression with DATAIN
    - LP: #1164714
  * ocfs2: fix ocfs2_init_security_and_acl() to initialize acl correctly
    - LP: #1164714
  * ocfs2: ac->ac_allow_chain_relink=0 won't disable group relink
    - LP: #1164714
  * block: fix ext_devt_idr handling
    - LP: #1164714
  * idr: fix a subtle bug in idr_get_next()
    - LP: #1164714
  * block: fix synchronization and limit check in blk_alloc_devt()
    - LP: #1164714
  * firewire: add minor number range check to fw_device_init()
    - LP: #1164714
  * idr: fix top layer handling
    - LP: #1164714
  * sysctl: fix null checking in bin_dn_node_address()
    - LP: #1164714
  * nbd: fsync and kill block device on shutdown
    - LP: #1164714
  * target/pscsi: Fix page increment
    - LP: #1164714
  * xen/pat: Disable PAT using pat_enabled value.
    - LP: #1164714
  * xen/pci: We don't do multiple MSI's.
    - LP: #1164714
  * xenbus: fix compile failure on ARM with Xen enabled
    - LP: #1164714
  * dm snapshot: add missing module aliases
    - LP: #1164714
  * ext4: convert number of blocks to cluste...

[Adam Conrad (adconrad)]

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.2.0-41.66

---------------
linux (3.2.0-41.66) precise-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1172464

  [ Steve Conklin ]

  * Revert "drm/i915: GFX_MODE Flush TLB Invalidate Mode must be '1' for
    scanline waits"
    - LP: #1140716

  [ Upstream Kernel Changes ]

  * fbcon: fix locking harder
    - LP: #1168961, #1169380

linux (3.2.0-41.65) precise-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1167436

  [ John Johansen ]

  * SAUCE: (no-up) apparmor: Fix quieting of audit messages for network
    mediation
    - LP: #1163259

  [ Steve Conklin ]

  * SAUCE: Update configs for new efivars option
    - LP: #1164646

  [ Upstream Kernel Changes ]

  * Revert "powerpc/eeh: Fix crash when adding a device in a slot with DDW"
    - LP: #1164646
  * Input: cypress_ps2 - fix trackpadi found in Dell XPS12
    - LP: #1103594
  * btrfs: Init io_lock after cloning btrfs device struct
    - LP: #1164646
  * md: protect against crash upon fsync on ro array
    - LP: #1164646
  * NFS: Don't allow NFS silly-renamed files to be deleted, no signal
    - LP: #1164646
  * SUNRPC: Don't start the retransmission timer when out of socket space
    - LP: #1164646
  * storvsc: Initialize the sglist
    - LP: #1164646
  * dc395x: uninitialized variable in device_alloc()
    - LP: #1164646
  * ARM: VFP: fix emulation of second VFP instruction
    - LP: #1164646
  * ARM: fix scheduling while atomic warning in alignment handling code
    - LP: #1164646
  * md: fix two bugs when attempting to resize RAID0 array.
    - LP: #1164646
  * md: raid0: fix error return from create_stripe_zones.
    - LP: #1164646
  * proc connector: reject unprivileged listener bumps
    - LP: #1164646
  * ath9k: fix RSSI dummy marker value
    - LP: #1164646
  * ath9k_htc: fix signal strength handling issues
    - LP: #1164646
  * mwifiex: correct sleep delay counter
    - LP: #1164646
  * cifs: ensure that cifs_get_root() only traverses directories
    - LP: #1164646
  * xen/pci: We don't do multiple MSI's.
    - LP: #1164646
  * dm: fix truncated status strings
    - LP: #1164646
  * dm snapshot: add missing module aliases
    - LP: #1164646
  * drm/i915: Don't clobber crtc->fb when queue_flip fails
    - LP: #1164646
  * ARM: 7663/1: perf: fix ARMv7 EVTYPE_MASK to include NSH bit
    - LP: #1164646
  * hwmon: (pmbus/ltc2978) Fix peak attribute handling
    - LP: #1164646
  * hwmon: (pmbus/ltc2978) Use detected chip ID to select supported
    functionality
    - LP: #1164646
  * hwmon: (sht15) Check return value of regulator_enable()
    - LP: #1164646
  * hw_random: make buffer usable in scatterlist.
    - LP: #1164646
  * ALSA: vmaster: Fix slave change notification
    - LP: #1164646
  * drm/radeon: add primary dac adj quirk for R200 board
    - LP: #1164646
  * dmi_scan: fix missing check for _DMI_ signature in smbios_present()
    - LP: #1164646
  * iwlwifi: always copy first 16 bytes of commands
    - LP: #1164646
  * HID: add support for Sony RF receiver with USB product id 0x0374
    - LP: #1164646
  * HID: clean up quirk for Sony RF receivers
    - LP: #1164646
  * ...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-lts-quantal - 3.5.0-28.48~precise1

---------------
linux-lts-quantal (3.5.0-28.48~precise1) precise-proposed; urgency=low

  [Brad Figg]

  * Release Tracking Bug
    - LP: #1172327

  [ Steve Conklin ]

  * Revert "drm/i915: GFX_MODE Flush TLB Invalidate Mode must be '1' for
    scanline waits"
    - LP: #1140716

  [ Upstream Kernel Changes ]

  * fbcon: fix locking harder
    - LP: #1167114

linux (3.5.0-28.47) quantal-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1166876

  [ Adam Lee ]

  * SAUCE: Bluetooth: Add support for 105b:e065
    - LP: #1161261

  [ John Johansen ]

  * SAUCE: (no-up) apparmor: Fix quieting of audit messages for network
    mediation
    - LP: #1163259

  [ Upstream Kernel Changes ]

  * NFSv4: Fix the string length returned by the idmapper
    - LP: #1101292
  * Input: cypress_ps2 - fix trackpadi found in Dell XPS12
    - LP: #1103594
  * omap_vout: find_vma() needs ->mmap_sem held
    - LP: #1164714
  * nfsd: Fix memleak
    - LP: #1164714
  * iommu/amd: Initialize device table after dma_ops
    - LP: #1164714
  * svcrpc: make svc_age_temp_xprts enqueue under sv_lock
    - LP: #1164714
  * target: Add missing mapped_lun bounds checking during make_mappedlun
    setup
    - LP: #1164714
  * xen-blkback: do not leak mode property
    - LP: #1164714
  * btrfs: Init io_lock after cloning btrfs device struct
    - LP: #1164714
  * NFS: Don't allow NFS silly-renamed files to be deleted, no signal
    - LP: #1164714
  * SUNRPC: Don't start the retransmission timer when out of socket space
    - LP: #1164714
  * storvsc: Initialize the sglist
    - LP: #1164714
  * dc395x: uninitialized variable in device_alloc()
    - LP: #1164714
  * ALSA: bt87x: Make load_all parameter working again
    - LP: #1164714
  * ARM: VFP: fix emulation of second VFP instruction
    - LP: #1164714
  * ARM: fix scheduling while atomic warning in alignment handling code
    - LP: #1164714
  * doc, xen: Mention 'earlyprintk=xen' in the documentation.
    - LP: #1164714
  * doc, kernel-parameters: Document 'console=hvc<n>'
    - LP: #1164714
  * sony-laptop: fully enable SNY controlled modems
    - LP: #1164714
  * x86: Make sure we can boot in the case the BDA contains pure garbage
    - LP: #1164714
  * cifs: ensure that cifs_get_root() only traverses directories
    - LP: #1164714
  * iscsi-target: Fix immediate queue starvation regression with DATAIN
    - LP: #1164714
  * ocfs2: fix ocfs2_init_security_and_acl() to initialize acl correctly
    - LP: #1164714
  * ocfs2: ac->ac_allow_chain_relink=0 won't disable group relink
    - LP: #1164714
  * block: fix ext_devt_idr handling
    - LP: #1164714
  * idr: fix a subtle bug in idr_get_next()
    - LP: #1164714
  * block: fix synchronization and limit check in blk_alloc_devt()
    - LP: #1164714
  * firewire: add minor number range check to fw_device_init()
    - LP: #1164714
  * idr: fix top layer handling
    - LP: #1164714
  * sysctl: fix null checking in bin_dn_node_address()
    - LP: #1164714
  * nbd: fsync and kill block device on shutdown
    - LP: #1164714
  * target/pscsi: Fix page increment
    - LP: #1164714
...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-armadaxp - 3.2.0-1617.27

---------------
linux-armadaxp (3.2.0-1617.27) precise-proposed; urgency=low

  [ Ike Panhc ]

  * Release Tracking Bug
    - LP: #1172683
  * Rebase onto Ubuntu-3.2.0-41.66

  [ Ubuntu: 3.2.0-41.66 ]

  * Release Tracking Bug
    - LP: #1172464
  * Revert "drm/i915: GFX_MODE Flush TLB Invalidate Mode must be '1' for
    scanline waits"
    - LP: #1140716
  * fbcon: fix locking harder
    - LP: #1168961, #1169380
 -- Ike Panhc <email address hidden> Fri, 26 Apr 2013 14:59:30 +0800

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.2.0-1430.39

---------------
linux-ti-omap4 (3.2.0-1430.39) precise-proposed; urgency=low

  * Release Tracking Bug
    - LP: #1167977

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.2.0-41.65

  [ Ubuntu: 3.2.0-41.65 ]

  * Release Tracking Bug
    - LP: #1167436
  * SAUCE: (no-up) apparmor: Fix quieting of audit messages for network
    mediation
    - LP: #1163259
  * SAUCE: Update configs for new efivars option
    - LP: #1164646
  * Revert "powerpc/eeh: Fix crash when adding a device in a slot with DDW"
    - LP: #1164646
  * Input: cypress_ps2 - fix trackpadi found in Dell XPS12
    - LP: #1103594
  * btrfs: Init io_lock after cloning btrfs device struct
    - LP: #1164646
  * md: protect against crash upon fsync on ro array
    - LP: #1164646
  * NFS: Don't allow NFS silly-renamed files to be deleted, no signal
    - LP: #1164646
  * SUNRPC: Don't start the retransmission timer when out of socket space
    - LP: #1164646
  * storvsc: Initialize the sglist
    - LP: #1164646
  * dc395x: uninitialized variable in device_alloc()
    - LP: #1164646
  * ARM: VFP: fix emulation of second VFP instruction
    - LP: #1164646
  * ARM: fix scheduling while atomic warning in alignment handling code
    - LP: #1164646
  * md: fix two bugs when attempting to resize RAID0 array.
    - LP: #1164646
  * md: raid0: fix error return from create_stripe_zones.
    - LP: #1164646
  * proc connector: reject unprivileged listener bumps
    - LP: #1164646
  * ath9k: fix RSSI dummy marker value
    - LP: #1164646
  * ath9k_htc: fix signal strength handling issues
    - LP: #1164646
  * mwifiex: correct sleep delay counter
    - LP: #1164646
  * cifs: ensure that cifs_get_root() only traverses directories
    - LP: #1164646
  * xen/pci: We don't do multiple MSI's.
    - LP: #1164646
  * dm: fix truncated status strings
    - LP: #1164646
  * dm snapshot: add missing module aliases
    - LP: #1164646
  * drm/i915: Don't clobber crtc->fb when queue_flip fails
    - LP: #1164646
  * ARM: 7663/1: perf: fix ARMv7 EVTYPE_MASK to include NSH bit
    - LP: #1164646
  * hwmon: (pmbus/ltc2978) Fix peak attribute handling
    - LP: #1164646
  * hwmon: (pmbus/ltc2978) Use detected chip ID to select supported
    functionality
    - LP: #1164646
  * hwmon: (sht15) Check return value of regulator_enable()
    - LP: #1164646
  * hw_random: make buffer usable in scatterlist.
    - LP: #1164646
  * ALSA: vmaster: Fix slave change notification
    - LP: #1164646
  * drm/radeon: add primary dac adj quirk for R200 board
    - LP: #1164646
  * dmi_scan: fix missing check for _DMI_ signature in smbios_present()
    - LP: #1164646
  * iwlwifi: always copy first 16 bytes of commands
    - LP: #1164646
  * HID: add support for Sony RF receiver with USB product id 0x0374
    - LP: #1164646
  * HID: clean up quirk for Sony RF receivers
    - LP: #1164646
  * ahci: Add Device IDs for Intel Lynx Point-LP PCH
    - LP: #1164646
  * ahci: AHCI-mode SATA patch for Intel Avoton DeviceIDs
    - LP: #1164646
  * ahci: Add Device IDs for Intel Wellsburg PCH
    - LP: #1164646
  * iommu/amd: Initialize device table after dma_ops
    - LP: #1164646
 ...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.5.0-28.48

---------------
linux (3.5.0-28.48) quantal-proposed; urgency=low

  [Brad Figg]

  * Release Tracking Bug
    - LP: #1172023

  [ Steve Conklin ]

  * Revert "drm/i915: GFX_MODE Flush TLB Invalidate Mode must be '1' for
    scanline waits"
    - LP: #1140716

  [ Upstream Kernel Changes ]

  * fbcon: fix locking harder
    - LP: #1167114

linux (3.5.0-28.47) quantal-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1166876

  [ Adam Lee ]

  * SAUCE: Bluetooth: Add support for 105b:e065
    - LP: #1161261

  [ John Johansen ]

  * SAUCE: (no-up) apparmor: Fix quieting of audit messages for network
    mediation
    - LP: #1163259

  [ Upstream Kernel Changes ]

  * NFSv4: Fix the string length returned by the idmapper
    - LP: #1101292
  * Input: cypress_ps2 - fix trackpadi found in Dell XPS12
    - LP: #1103594
  * omap_vout: find_vma() needs ->mmap_sem held
    - LP: #1164714
  * nfsd: Fix memleak
    - LP: #1164714
  * iommu/amd: Initialize device table after dma_ops
    - LP: #1164714
  * svcrpc: make svc_age_temp_xprts enqueue under sv_lock
    - LP: #1164714
  * target: Add missing mapped_lun bounds checking during make_mappedlun
    setup
    - LP: #1164714
  * xen-blkback: do not leak mode property
    - LP: #1164714
  * btrfs: Init io_lock after cloning btrfs device struct
    - LP: #1164714
  * NFS: Don't allow NFS silly-renamed files to be deleted, no signal
    - LP: #1164714
  * SUNRPC: Don't start the retransmission timer when out of socket space
    - LP: #1164714
  * storvsc: Initialize the sglist
    - LP: #1164714
  * dc395x: uninitialized variable in device_alloc()
    - LP: #1164714
  * ALSA: bt87x: Make load_all parameter working again
    - LP: #1164714
  * ARM: VFP: fix emulation of second VFP instruction
    - LP: #1164714
  * ARM: fix scheduling while atomic warning in alignment handling code
    - LP: #1164714
  * doc, xen: Mention 'earlyprintk=xen' in the documentation.
    - LP: #1164714
  * doc, kernel-parameters: Document 'console=hvc<n>'
    - LP: #1164714
  * sony-laptop: fully enable SNY controlled modems
    - LP: #1164714
  * x86: Make sure we can boot in the case the BDA contains pure garbage
    - LP: #1164714
  * cifs: ensure that cifs_get_root() only traverses directories
    - LP: #1164714
  * iscsi-target: Fix immediate queue starvation regression with DATAIN
    - LP: #1164714
  * ocfs2: fix ocfs2_init_security_and_acl() to initialize acl correctly
    - LP: #1164714
  * ocfs2: ac->ac_allow_chain_relink=0 won't disable group relink
    - LP: #1164714
  * block: fix ext_devt_idr handling
    - LP: #1164714
  * idr: fix a subtle bug in idr_get_next()
    - LP: #1164714
  * block: fix synchronization and limit check in blk_alloc_devt()
    - LP: #1164714
  * firewire: add minor number range check to fw_device_init()
    - LP: #1164714
  * idr: fix top layer handling
    - LP: #1164714
  * sysctl: fix null checking in bin_dn_node_address()
    - LP: #1164714
  * nbd: fsync and kill block device on shutdown
    - LP: #1164714
  * target/pscsi: Fix page increment
    - LP: #1164714
  * xen/pat: Disable PAT using pat_enabled...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-armadaxp - 3.5.0-1612.19

---------------
linux-armadaxp (3.5.0-1612.19) quantal-proposed; urgency=low

  [ Ike Panhc ]

  * Release Tracking Bug
    - LP: #1172323
  * Rebase onto Ubuntu-3.5.0-28.48

  [ Ubuntu: 3.5.0-28.48 ]

  * Release Tracking Bug
    - LP: #1172023
  * Revert "drm/i915: GFX_MODE Flush TLB Invalidate Mode must be '1' for
    scanline waits"
    - LP: #1140716
  * fbcon: fix locking harder
    - LP: #1167114
 -- Ike Panhc <email address hidden> Thu, 11 Apr 2013 09:14:58 +0800

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.5.0-223.34

---------------
linux-ti-omap4 (3.5.0-223.34) quantal-proposed; urgency=low

  * Release Tracking Bug
    - LP: #1167153

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.5.0-28.47

  [ Ubuntu: 3.5.0-28.47 ]

  * Release Tracking Bug
    - LP: #1166876
  * SAUCE: Bluetooth: Add support for 105b:e065
    - LP: #1161261
  * SAUCE: (no-up) apparmor: Fix quieting of audit messages for network
    mediation
    - LP: #1163259
  * NFSv4: Fix the string length returned by the idmapper
    - LP: #1101292
  * Input: cypress_ps2 - fix trackpadi found in Dell XPS12
    - LP: #1103594
  * omap_vout: find_vma() needs ->mmap_sem held
    - LP: #1164714
  * nfsd: Fix memleak
    - LP: #1164714
  * iommu/amd: Initialize device table after dma_ops
    - LP: #1164714
  * svcrpc: make svc_age_temp_xprts enqueue under sv_lock
    - LP: #1164714
  * target: Add missing mapped_lun bounds checking during make_mappedlun
    setup
    - LP: #1164714
  * xen-blkback: do not leak mode property
    - LP: #1164714
  * btrfs: Init io_lock after cloning btrfs device struct
    - LP: #1164714
  * NFS: Don't allow NFS silly-renamed files to be deleted, no signal
    - LP: #1164714
  * SUNRPC: Don't start the retransmission timer when out of socket space
    - LP: #1164714
  * storvsc: Initialize the sglist
    - LP: #1164714
  * dc395x: uninitialized variable in device_alloc()
    - LP: #1164714
  * ALSA: bt87x: Make load_all parameter working again
    - LP: #1164714
  * ARM: VFP: fix emulation of second VFP instruction
    - LP: #1164714
  * ARM: fix scheduling while atomic warning in alignment handling code
    - LP: #1164714
  * doc, xen: Mention 'earlyprintk=xen' in the documentation.
    - LP: #1164714
  * doc, kernel-parameters: Document 'console=hvc<n>'
    - LP: #1164714
  * sony-laptop: fully enable SNY controlled modems
    - LP: #1164714
  * x86: Make sure we can boot in the case the BDA contains pure garbage
    - LP: #1164714
  * cifs: ensure that cifs_get_root() only traverses directories
    - LP: #1164714
  * iscsi-target: Fix immediate queue starvation regression with DATAIN
    - LP: #1164714
  * ocfs2: fix ocfs2_init_security_and_acl() to initialize acl correctly
    - LP: #1164714
  * ocfs2: ac->ac_allow_chain_relink=0 won't disable group relink
    - LP: #1164714
  * block: fix ext_devt_idr handling
    - LP: #1164714
  * idr: fix a subtle bug in idr_get_next()
    - LP: #1164714
  * block: fix synchronization and limit check in blk_alloc_devt()
    - LP: #1164714
  * firewire: add minor number range check to fw_device_init()
    - LP: #1164714
  * idr: fix top layer handling
    - LP: #1164714
  * sysctl: fix null checking in bin_dn_node_address()
    - LP: #1164714
  * nbd: fsync and kill block device on shutdown
    - LP: #1164714
  * target/pscsi: Fix page increment
    - LP: #1164714
  * xen/pat: Disable PAT using pat_enabled value.
    - LP: #1164714
  * xen/pci: We don't do multiple MSI's.
    - LP: #1164714
  * xenbus: fix compile failure on ARM with Xen enabled
    - LP: #1164714
  * dm snapshot: add missing module aliases
    - LP: #1164714
  * ext4: convert number of blocks to cluste...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 2.6.32-48.110

---------------
linux (2.6.32-48.110) lucid; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1186340

  [ Stefan Bader ]

  * (config) Import Xen specific config options from ec2
    - LP: #1177431
  * SAUCE: xen: Send spinlock IPI to all waiters
    - LP: #1011792, #1177431

  [ Upstream Kernel Changes ]

  * ax25: fix info leak via msg_name in ax25_recvmsg()
    - LP: #1172366
    - CVE-2013-3223
  * Bluetooth: fix possible info leak in bt_sock_recvmsg()
    - LP: #1172368
    - CVE-2013-3224
  * tipc: fix info leaks via msg_name in recv_msg/recv_stream
    - LP: #1172403
    - CVE-2013-3235
  * rose: fix info leak via msg_name in rose_recvmsg()
    - LP: #1172394
    - CVE-2013-3234
  * Bluetooth: RFCOMM - Fix missing msg_namelen update in
    rfcomm_sock_recvmsg()
    - LP: #1172369
    - CVE-2013-3225
  * atm: update msg_namelen in vcc_recvmsg()
    - LP: #1172365
    - CVE-2013-3222
  * KVM: Fix bounds checking in ioapic indirect register reads
    (CVE-2013-1798)
    - LP: #1158262
    - CVE-2013-1798
  * llc: Fix missing msg_namelen update in llc_ui_recvmsg()
    - LP: #1172385
    - CVE-2013-3231
  * netrom: fix info leak via msg_name in nr_recvmsg()
    - LP: #1172386
    - CVE-2013-3232
  * irda: Fix missing msg_namelen update in irda_recvmsg_dgram()
    - LP: #1172380
    - CVE-2013-3228
  * iucv: Fix missing msg_namelen update in iucv_sock_recvmsg()
    - LP: #1172381
    - CVE-2013-3229
 -- Steve Conklin <email address hidden> Fri, 31 May 2013 12:03:46 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ec2 - 2.6.32-353.66

---------------
linux-ec2 (2.6.32-353.66) lucid-proposed; urgency=low

  [ Stefan Bader ]

  * Rebased to Ubuntu-2.6.32-48.110
  * Release Tracking Bug
    - LP: #1186479

  [ Ubuntu: 2.6.32-48.110 ]

  * (config) Import Xen specific config options from ec2
    - LP: #1177431
  * SAUCE: xen: Send spinlock IPI to all waiters
    - LP: #1011792, #1177431
  * ax25: fix info leak via msg_name in ax25_recvmsg()
    - LP: #1172366
    - CVE-2013-3223
  * Bluetooth: fix possible info leak in bt_sock_recvmsg()
    - LP: #1172368
    - CVE-2013-3224
  * tipc: fix info leaks via msg_name in recv_msg/recv_stream
    - LP: #1172403
    - CVE-2013-3235
  * rose: fix info leak via msg_name in rose_recvmsg()
    - LP: #1172394
    - CVE-2013-3234
  * Bluetooth: RFCOMM - Fix missing msg_namelen update in
    rfcomm_sock_recvmsg()
    - LP: #1172369
    - CVE-2013-3225
  * atm: update msg_namelen in vcc_recvmsg()
    - LP: #1172365
    - CVE-2013-3222
  * KVM: Fix bounds checking in ioapic indirect register reads
    (CVE-2013-1798)
    - LP: #1158262
    - CVE-2013-1798
  * llc: Fix missing msg_namelen update in llc_ui_recvmsg()
    - LP: #1172385
    - CVE-2013-3231
  * netrom: fix info leak via msg_name in nr_recvmsg()
    - LP: #1172386
    - CVE-2013-3232
  * irda: Fix missing msg_namelen update in irda_recvmsg_dgram()
    - LP: #1172380
    - CVE-2013-3228
  * iucv: Fix missing msg_namelen update in iucv_sock_recvmsg()
    - LP: #1172381
    - CVE-2013-3229
 -- Stefan Bader <email address hidden> Tue, 04 Jun 2013 10:12:05 +0200