CVE-2013-1798

[John Johansen]

The ioapic_read_indirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPIC_REG_SELECT and IOAPIC_REG_WINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of service (host OS OOPS) via a crafted application.

Break-Fix: - a2c118bfab8bc6b8bb213abfc35201e441693d55

[John Johansen (jjohansen)]

CVE-2013-1798

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.8.0-18.28

---------------
linux (3.8.0-18.28) raring; urgency=low

  [ Andy Whitcroft ]

  * (debian) fix internal linkage for separated header packages
    - LP: #1165259

  [ Gavin Guo ]

  * SAUCE: Bluetooth: Add support for Broadcom 413c:8143
    - LP: #1166113

  [ John Johansen ]

  * SAUCE: (no-up) apparmor: Fix quieting of audit messages for network
    mediation
    - LP: #1163259

  [ Kamal Mostafa ]

  * SAUCE: (no-up) drm/i915: quirk no PCH_PWM_ENABLE for Dell XPS13
    backlight
    - LP: #1162026, #1163720

  [ Leann Ogasawara ]

  * [Config] Disable CONFIG_PARPORT_PC_FIFO
    - LP: #339752

  [ Martin Pitt ]

  * SAUCE: (no-up) mac80211_hwsim: Register and bind to driver
    - LP: #1166250

  [ Paolo Pisati ]

  * [Config] RTC_DRV_PL031=y

  [ Stefan Bader ]

  * (debian) Abort build on unresolved symbols
    - LP: #1166197

  [ Tim Gardner ]

  * [Config] Add libceph to inclusion list
  * [Config] Drop all inclusion list modules with unsatisfied dependencies
  * SAUCE: (no-up) Remove emi62 files duplicated in linux-firmware
  * SAUCE: (no-up) Remove emi26 files duplicated in linux-firmware
  * SAUCE: (no-up) Remove whiteheat files duplicated in linux-firmware
  * Release Tracking Bug
    - LP: #1168040

  [ Upstream Kernel Changes ]

  * TTY: do not update atime/mtime on read/write
    - LP: #1097680
    - CVE-2013-0160
  * KVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions
    (CVE-2013-1797)
    - LP: #1158258
    - CVE-2013-1797
  * KVM: Fix bounds checking in ioapic indirect register reads
    (CVE-2013-1798)
    - LP: #1158262
    - CVE-2013-1798
  * drm/i915: HDMI/DP - ELD info refresh support for Haswell
    - LP: #1011438
  * ALSA - HDA: New PCI ID for Haswell ULT
    - LP: #1011438
  * ALSA: hda - Support rereading widgets under the function group
    - LP: #1011438
  * ALSA: hda - Add fixup for Haswell to enable all pin and convertor
    widgets
    - LP: #1011438
  * libata: fix DMA to stack in reading devslp_timing parameters
    - LP: #1031173
  * dmaengine: dw_dmac: remove CLK dependency
    - LP: #1031163
  * dmaengine: dw_dmac: Enhance device tree support
    - LP: #1031163
  * dmaengine: dw_dmac: amend description and indentation
    - LP: #1031163
  * dw_dmac: change dev_printk() to corresponding macros
    - LP: #1031163
  * dw_dmac: don't call platform_get_drvdata twice
    - LP: #1031163
  * dw_dmac: change dev_crit to dev_WARN in dwc_handle_error
    - LP: #1031163
  * dw_dmac: introduce to_dw_desc() macro
    - LP: #1031163
  * dw_dmac: absence of pdata isn't critical when autocfg is set
    - LP: #1031163
  * dw_dmac: check for mapping errors
    - LP: #1031163
  * dw_dmac: remove redundant check
    - LP: #1031163
  * dw_dmac: update tx_node_active in dwc_do_single_block
    - LP: #1031163
  * dma: dw_dmac: add dwc_chan_pause and dwc_chan_resume
    - LP: #1031163
  * dmaengine: introduce is_slave_direction function
    - LP: #1031163
  * dmaengine: add possibility for cyclic transfers
    - LP: #1031163
  * dma: dw_dmac: check direction properly in dw_dma_cyclic_prep
    - LP: #1031163
  * dma: ep93xx_dma: reuse is_slave_direction helpe...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.5.0-223.34

---------------
linux-ti-omap4 (3.5.0-223.34) quantal-proposed; urgency=low

  * Release Tracking Bug
    - LP: #1167153

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.5.0-28.47

  [ Ubuntu: 3.5.0-28.47 ]

  * Release Tracking Bug
    - LP: #1166876
  * SAUCE: Bluetooth: Add support for 105b:e065
    - LP: #1161261
  * SAUCE: (no-up) apparmor: Fix quieting of audit messages for network
    mediation
    - LP: #1163259
  * NFSv4: Fix the string length returned by the idmapper
    - LP: #1101292
  * Input: cypress_ps2 - fix trackpadi found in Dell XPS12
    - LP: #1103594
  * omap_vout: find_vma() needs ->mmap_sem held
    - LP: #1164714
  * nfsd: Fix memleak
    - LP: #1164714
  * iommu/amd: Initialize device table after dma_ops
    - LP: #1164714
  * svcrpc: make svc_age_temp_xprts enqueue under sv_lock
    - LP: #1164714
  * target: Add missing mapped_lun bounds checking during make_mappedlun
    setup
    - LP: #1164714
  * xen-blkback: do not leak mode property
    - LP: #1164714
  * btrfs: Init io_lock after cloning btrfs device struct
    - LP: #1164714
  * NFS: Don't allow NFS silly-renamed files to be deleted, no signal
    - LP: #1164714
  * SUNRPC: Don't start the retransmission timer when out of socket space
    - LP: #1164714
  * storvsc: Initialize the sglist
    - LP: #1164714
  * dc395x: uninitialized variable in device_alloc()
    - LP: #1164714
  * ALSA: bt87x: Make load_all parameter working again
    - LP: #1164714
  * ARM: VFP: fix emulation of second VFP instruction
    - LP: #1164714
  * ARM: fix scheduling while atomic warning in alignment handling code
    - LP: #1164714
  * doc, xen: Mention 'earlyprintk=xen' in the documentation.
    - LP: #1164714
  * doc, kernel-parameters: Document 'console=hvc<n>'
    - LP: #1164714
  * sony-laptop: fully enable SNY controlled modems
    - LP: #1164714
  * x86: Make sure we can boot in the case the BDA contains pure garbage
    - LP: #1164714
  * cifs: ensure that cifs_get_root() only traverses directories
    - LP: #1164714
  * iscsi-target: Fix immediate queue starvation regression with DATAIN
    - LP: #1164714
  * ocfs2: fix ocfs2_init_security_and_acl() to initialize acl correctly
    - LP: #1164714
  * ocfs2: ac->ac_allow_chain_relink=0 won't disable group relink
    - LP: #1164714
  * block: fix ext_devt_idr handling
    - LP: #1164714
  * idr: fix a subtle bug in idr_get_next()
    - LP: #1164714
  * block: fix synchronization and limit check in blk_alloc_devt()
    - LP: #1164714
  * firewire: add minor number range check to fw_device_init()
    - LP: #1164714
  * idr: fix top layer handling
    - LP: #1164714
  * sysctl: fix null checking in bin_dn_node_address()
    - LP: #1164714
  * nbd: fsync and kill block device on shutdown
    - LP: #1164714
  * target/pscsi: Fix page increment
    - LP: #1164714
  * xen/pat: Disable PAT using pat_enabled value.
    - LP: #1164714
  * xen/pci: We don't do multiple MSI's.
    - LP: #1164714
  * xenbus: fix compile failure on ARM with Xen enabled
    - LP: #1164714
  * dm snapshot: add missing module aliases
    - LP: #1164714
  * ext4: convert number of blocks to cluste...

[Adam Conrad (adconrad)]

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.2.0-41.66

---------------
linux (3.2.0-41.66) precise-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1172464

  [ Steve Conklin ]

  * Revert "drm/i915: GFX_MODE Flush TLB Invalidate Mode must be '1' for
    scanline waits"
    - LP: #1140716

  [ Upstream Kernel Changes ]

  * fbcon: fix locking harder
    - LP: #1168961, #1169380

linux (3.2.0-41.65) precise-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1167436

  [ John Johansen ]

  * SAUCE: (no-up) apparmor: Fix quieting of audit messages for network
    mediation
    - LP: #1163259

  [ Steve Conklin ]

  * SAUCE: Update configs for new efivars option
    - LP: #1164646

  [ Upstream Kernel Changes ]

  * Revert "powerpc/eeh: Fix crash when adding a device in a slot with DDW"
    - LP: #1164646
  * Input: cypress_ps2 - fix trackpadi found in Dell XPS12
    - LP: #1103594
  * btrfs: Init io_lock after cloning btrfs device struct
    - LP: #1164646
  * md: protect against crash upon fsync on ro array
    - LP: #1164646
  * NFS: Don't allow NFS silly-renamed files to be deleted, no signal
    - LP: #1164646
  * SUNRPC: Don't start the retransmission timer when out of socket space
    - LP: #1164646
  * storvsc: Initialize the sglist
    - LP: #1164646
  * dc395x: uninitialized variable in device_alloc()
    - LP: #1164646
  * ARM: VFP: fix emulation of second VFP instruction
    - LP: #1164646
  * ARM: fix scheduling while atomic warning in alignment handling code
    - LP: #1164646
  * md: fix two bugs when attempting to resize RAID0 array.
    - LP: #1164646
  * md: raid0: fix error return from create_stripe_zones.
    - LP: #1164646
  * proc connector: reject unprivileged listener bumps
    - LP: #1164646
  * ath9k: fix RSSI dummy marker value
    - LP: #1164646
  * ath9k_htc: fix signal strength handling issues
    - LP: #1164646
  * mwifiex: correct sleep delay counter
    - LP: #1164646
  * cifs: ensure that cifs_get_root() only traverses directories
    - LP: #1164646
  * xen/pci: We don't do multiple MSI's.
    - LP: #1164646
  * dm: fix truncated status strings
    - LP: #1164646
  * dm snapshot: add missing module aliases
    - LP: #1164646
  * drm/i915: Don't clobber crtc->fb when queue_flip fails
    - LP: #1164646
  * ARM: 7663/1: perf: fix ARMv7 EVTYPE_MASK to include NSH bit
    - LP: #1164646
  * hwmon: (pmbus/ltc2978) Fix peak attribute handling
    - LP: #1164646
  * hwmon: (pmbus/ltc2978) Use detected chip ID to select supported
    functionality
    - LP: #1164646
  * hwmon: (sht15) Check return value of regulator_enable()
    - LP: #1164646
  * hw_random: make buffer usable in scatterlist.
    - LP: #1164646
  * ALSA: vmaster: Fix slave change notification
    - LP: #1164646
  * drm/radeon: add primary dac adj quirk for R200 board
    - LP: #1164646
  * dmi_scan: fix missing check for _DMI_ signature in smbios_present()
    - LP: #1164646
  * iwlwifi: always copy first 16 bytes of commands
    - LP: #1164646
  * HID: add support for Sony RF receiver with USB product id 0x0374
    - LP: #1164646
  * HID: clean up quirk for Sony RF receivers
    - LP: #1164646
  * ...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-lts-quantal - 3.5.0-28.48~precise1

---------------
linux-lts-quantal (3.5.0-28.48~precise1) precise-proposed; urgency=low

  [Brad Figg]

  * Release Tracking Bug
    - LP: #1172327

  [ Steve Conklin ]

  * Revert "drm/i915: GFX_MODE Flush TLB Invalidate Mode must be '1' for
    scanline waits"
    - LP: #1140716

  [ Upstream Kernel Changes ]

  * fbcon: fix locking harder
    - LP: #1167114

linux (3.5.0-28.47) quantal-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1166876

  [ Adam Lee ]

  * SAUCE: Bluetooth: Add support for 105b:e065
    - LP: #1161261

  [ John Johansen ]

  * SAUCE: (no-up) apparmor: Fix quieting of audit messages for network
    mediation
    - LP: #1163259

  [ Upstream Kernel Changes ]

  * NFSv4: Fix the string length returned by the idmapper
    - LP: #1101292
  * Input: cypress_ps2 - fix trackpadi found in Dell XPS12
    - LP: #1103594
  * omap_vout: find_vma() needs ->mmap_sem held
    - LP: #1164714
  * nfsd: Fix memleak
    - LP: #1164714
  * iommu/amd: Initialize device table after dma_ops
    - LP: #1164714
  * svcrpc: make svc_age_temp_xprts enqueue under sv_lock
    - LP: #1164714
  * target: Add missing mapped_lun bounds checking during make_mappedlun
    setup
    - LP: #1164714
  * xen-blkback: do not leak mode property
    - LP: #1164714
  * btrfs: Init io_lock after cloning btrfs device struct
    - LP: #1164714
  * NFS: Don't allow NFS silly-renamed files to be deleted, no signal
    - LP: #1164714
  * SUNRPC: Don't start the retransmission timer when out of socket space
    - LP: #1164714
  * storvsc: Initialize the sglist
    - LP: #1164714
  * dc395x: uninitialized variable in device_alloc()
    - LP: #1164714
  * ALSA: bt87x: Make load_all parameter working again
    - LP: #1164714
  * ARM: VFP: fix emulation of second VFP instruction
    - LP: #1164714
  * ARM: fix scheduling while atomic warning in alignment handling code
    - LP: #1164714
  * doc, xen: Mention 'earlyprintk=xen' in the documentation.
    - LP: #1164714
  * doc, kernel-parameters: Document 'console=hvc<n>'
    - LP: #1164714
  * sony-laptop: fully enable SNY controlled modems
    - LP: #1164714
  * x86: Make sure we can boot in the case the BDA contains pure garbage
    - LP: #1164714
  * cifs: ensure that cifs_get_root() only traverses directories
    - LP: #1164714
  * iscsi-target: Fix immediate queue starvation regression with DATAIN
    - LP: #1164714
  * ocfs2: fix ocfs2_init_security_and_acl() to initialize acl correctly
    - LP: #1164714
  * ocfs2: ac->ac_allow_chain_relink=0 won't disable group relink
    - LP: #1164714
  * block: fix ext_devt_idr handling
    - LP: #1164714
  * idr: fix a subtle bug in idr_get_next()
    - LP: #1164714
  * block: fix synchronization and limit check in blk_alloc_devt()
    - LP: #1164714
  * firewire: add minor number range check to fw_device_init()
    - LP: #1164714
  * idr: fix top layer handling
    - LP: #1164714
  * sysctl: fix null checking in bin_dn_node_address()
    - LP: #1164714
  * nbd: fsync and kill block device on shutdown
    - LP: #1164714
  * target/pscsi: Fix page increment
    - LP: #1164714
...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-armadaxp - 3.2.0-1617.27

---------------
linux-armadaxp (3.2.0-1617.27) precise-proposed; urgency=low

  [ Ike Panhc ]

  * Release Tracking Bug
    - LP: #1172683
  * Rebase onto Ubuntu-3.2.0-41.66

  [ Ubuntu: 3.2.0-41.66 ]

  * Release Tracking Bug
    - LP: #1172464
  * Revert "drm/i915: GFX_MODE Flush TLB Invalidate Mode must be '1' for
    scanline waits"
    - LP: #1140716
  * fbcon: fix locking harder
    - LP: #1168961, #1169380
 -- Ike Panhc <email address hidden> Fri, 26 Apr 2013 14:59:30 +0800

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.2.0-1430.39

---------------
linux-ti-omap4 (3.2.0-1430.39) precise-proposed; urgency=low

  * Release Tracking Bug
    - LP: #1167977

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.2.0-41.65

  [ Ubuntu: 3.2.0-41.65 ]

  * Release Tracking Bug
    - LP: #1167436
  * SAUCE: (no-up) apparmor: Fix quieting of audit messages for network
    mediation
    - LP: #1163259
  * SAUCE: Update configs for new efivars option
    - LP: #1164646
  * Revert "powerpc/eeh: Fix crash when adding a device in a slot with DDW"
    - LP: #1164646
  * Input: cypress_ps2 - fix trackpadi found in Dell XPS12
    - LP: #1103594
  * btrfs: Init io_lock after cloning btrfs device struct
    - LP: #1164646
  * md: protect against crash upon fsync on ro array
    - LP: #1164646
  * NFS: Don't allow NFS silly-renamed files to be deleted, no signal
    - LP: #1164646
  * SUNRPC: Don't start the retransmission timer when out of socket space
    - LP: #1164646
  * storvsc: Initialize the sglist
    - LP: #1164646
  * dc395x: uninitialized variable in device_alloc()
    - LP: #1164646
  * ARM: VFP: fix emulation of second VFP instruction
    - LP: #1164646
  * ARM: fix scheduling while atomic warning in alignment handling code
    - LP: #1164646
  * md: fix two bugs when attempting to resize RAID0 array.
    - LP: #1164646
  * md: raid0: fix error return from create_stripe_zones.
    - LP: #1164646
  * proc connector: reject unprivileged listener bumps
    - LP: #1164646
  * ath9k: fix RSSI dummy marker value
    - LP: #1164646
  * ath9k_htc: fix signal strength handling issues
    - LP: #1164646
  * mwifiex: correct sleep delay counter
    - LP: #1164646
  * cifs: ensure that cifs_get_root() only traverses directories
    - LP: #1164646
  * xen/pci: We don't do multiple MSI's.
    - LP: #1164646
  * dm: fix truncated status strings
    - LP: #1164646
  * dm snapshot: add missing module aliases
    - LP: #1164646
  * drm/i915: Don't clobber crtc->fb when queue_flip fails
    - LP: #1164646
  * ARM: 7663/1: perf: fix ARMv7 EVTYPE_MASK to include NSH bit
    - LP: #1164646
  * hwmon: (pmbus/ltc2978) Fix peak attribute handling
    - LP: #1164646
  * hwmon: (pmbus/ltc2978) Use detected chip ID to select supported
    functionality
    - LP: #1164646
  * hwmon: (sht15) Check return value of regulator_enable()
    - LP: #1164646
  * hw_random: make buffer usable in scatterlist.
    - LP: #1164646
  * ALSA: vmaster: Fix slave change notification
    - LP: #1164646
  * drm/radeon: add primary dac adj quirk for R200 board
    - LP: #1164646
  * dmi_scan: fix missing check for _DMI_ signature in smbios_present()
    - LP: #1164646
  * iwlwifi: always copy first 16 bytes of commands
    - LP: #1164646
  * HID: add support for Sony RF receiver with USB product id 0x0374
    - LP: #1164646
  * HID: clean up quirk for Sony RF receivers
    - LP: #1164646
  * ahci: Add Device IDs for Intel Lynx Point-LP PCH
    - LP: #1164646
  * ahci: AHCI-mode SATA patch for Intel Avoton DeviceIDs
    - LP: #1164646
  * ahci: Add Device IDs for Intel Wellsburg PCH
    - LP: #1164646
  * iommu/amd: Initialize device table after dma_ops
    - LP: #1164646
 ...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.5.0-28.48

---------------
linux (3.5.0-28.48) quantal-proposed; urgency=low

  [Brad Figg]

  * Release Tracking Bug
    - LP: #1172023

  [ Steve Conklin ]

  * Revert "drm/i915: GFX_MODE Flush TLB Invalidate Mode must be '1' for
    scanline waits"
    - LP: #1140716

  [ Upstream Kernel Changes ]

  * fbcon: fix locking harder
    - LP: #1167114

linux (3.5.0-28.47) quantal-proposed; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1166876

  [ Adam Lee ]

  * SAUCE: Bluetooth: Add support for 105b:e065
    - LP: #1161261

  [ John Johansen ]

  * SAUCE: (no-up) apparmor: Fix quieting of audit messages for network
    mediation
    - LP: #1163259

  [ Upstream Kernel Changes ]

  * NFSv4: Fix the string length returned by the idmapper
    - LP: #1101292
  * Input: cypress_ps2 - fix trackpadi found in Dell XPS12
    - LP: #1103594
  * omap_vout: find_vma() needs ->mmap_sem held
    - LP: #1164714
  * nfsd: Fix memleak
    - LP: #1164714
  * iommu/amd: Initialize device table after dma_ops
    - LP: #1164714
  * svcrpc: make svc_age_temp_xprts enqueue under sv_lock
    - LP: #1164714
  * target: Add missing mapped_lun bounds checking during make_mappedlun
    setup
    - LP: #1164714
  * xen-blkback: do not leak mode property
    - LP: #1164714
  * btrfs: Init io_lock after cloning btrfs device struct
    - LP: #1164714
  * NFS: Don't allow NFS silly-renamed files to be deleted, no signal
    - LP: #1164714
  * SUNRPC: Don't start the retransmission timer when out of socket space
    - LP: #1164714
  * storvsc: Initialize the sglist
    - LP: #1164714
  * dc395x: uninitialized variable in device_alloc()
    - LP: #1164714
  * ALSA: bt87x: Make load_all parameter working again
    - LP: #1164714
  * ARM: VFP: fix emulation of second VFP instruction
    - LP: #1164714
  * ARM: fix scheduling while atomic warning in alignment handling code
    - LP: #1164714
  * doc, xen: Mention 'earlyprintk=xen' in the documentation.
    - LP: #1164714
  * doc, kernel-parameters: Document 'console=hvc<n>'
    - LP: #1164714
  * sony-laptop: fully enable SNY controlled modems
    - LP: #1164714
  * x86: Make sure we can boot in the case the BDA contains pure garbage
    - LP: #1164714
  * cifs: ensure that cifs_get_root() only traverses directories
    - LP: #1164714
  * iscsi-target: Fix immediate queue starvation regression with DATAIN
    - LP: #1164714
  * ocfs2: fix ocfs2_init_security_and_acl() to initialize acl correctly
    - LP: #1164714
  * ocfs2: ac->ac_allow_chain_relink=0 won't disable group relink
    - LP: #1164714
  * block: fix ext_devt_idr handling
    - LP: #1164714
  * idr: fix a subtle bug in idr_get_next()
    - LP: #1164714
  * block: fix synchronization and limit check in blk_alloc_devt()
    - LP: #1164714
  * firewire: add minor number range check to fw_device_init()
    - LP: #1164714
  * idr: fix top layer handling
    - LP: #1164714
  * sysctl: fix null checking in bin_dn_node_address()
    - LP: #1164714
  * nbd: fsync and kill block device on shutdown
    - LP: #1164714
  * target/pscsi: Fix page increment
    - LP: #1164714
  * xen/pat: Disable PAT using pat_enabled...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-armadaxp - 3.5.0-1612.19

---------------
linux-armadaxp (3.5.0-1612.19) quantal-proposed; urgency=low

  [ Ike Panhc ]

  * Release Tracking Bug
    - LP: #1172323
  * Rebase onto Ubuntu-3.5.0-28.48

  [ Ubuntu: 3.5.0-28.48 ]

  * Release Tracking Bug
    - LP: #1172023
  * Revert "drm/i915: GFX_MODE Flush TLB Invalidate Mode must be '1' for
    scanline waits"
    - LP: #1140716
  * fbcon: fix locking harder
    - LP: #1167114
 -- Ike Panhc <email address hidden> Thu, 11 Apr 2013 09:14:58 +0800

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.5.0-223.34

---------------
linux-ti-omap4 (3.5.0-223.34) quantal-proposed; urgency=low

  * Release Tracking Bug
    - LP: #1167153

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.5.0-28.47

  [ Ubuntu: 3.5.0-28.47 ]

  * Release Tracking Bug
    - LP: #1166876
  * SAUCE: Bluetooth: Add support for 105b:e065
    - LP: #1161261
  * SAUCE: (no-up) apparmor: Fix quieting of audit messages for network
    mediation
    - LP: #1163259
  * NFSv4: Fix the string length returned by the idmapper
    - LP: #1101292
  * Input: cypress_ps2 - fix trackpadi found in Dell XPS12
    - LP: #1103594
  * omap_vout: find_vma() needs ->mmap_sem held
    - LP: #1164714
  * nfsd: Fix memleak
    - LP: #1164714
  * iommu/amd: Initialize device table after dma_ops
    - LP: #1164714
  * svcrpc: make svc_age_temp_xprts enqueue under sv_lock
    - LP: #1164714
  * target: Add missing mapped_lun bounds checking during make_mappedlun
    setup
    - LP: #1164714
  * xen-blkback: do not leak mode property
    - LP: #1164714
  * btrfs: Init io_lock after cloning btrfs device struct
    - LP: #1164714
  * NFS: Don't allow NFS silly-renamed files to be deleted, no signal
    - LP: #1164714
  * SUNRPC: Don't start the retransmission timer when out of socket space
    - LP: #1164714
  * storvsc: Initialize the sglist
    - LP: #1164714
  * dc395x: uninitialized variable in device_alloc()
    - LP: #1164714
  * ALSA: bt87x: Make load_all parameter working again
    - LP: #1164714
  * ARM: VFP: fix emulation of second VFP instruction
    - LP: #1164714
  * ARM: fix scheduling while atomic warning in alignment handling code
    - LP: #1164714
  * doc, xen: Mention 'earlyprintk=xen' in the documentation.
    - LP: #1164714
  * doc, kernel-parameters: Document 'console=hvc<n>'
    - LP: #1164714
  * sony-laptop: fully enable SNY controlled modems
    - LP: #1164714
  * x86: Make sure we can boot in the case the BDA contains pure garbage
    - LP: #1164714
  * cifs: ensure that cifs_get_root() only traverses directories
    - LP: #1164714
  * iscsi-target: Fix immediate queue starvation regression with DATAIN
    - LP: #1164714
  * ocfs2: fix ocfs2_init_security_and_acl() to initialize acl correctly
    - LP: #1164714
  * ocfs2: ac->ac_allow_chain_relink=0 won't disable group relink
    - LP: #1164714
  * block: fix ext_devt_idr handling
    - LP: #1164714
  * idr: fix a subtle bug in idr_get_next()
    - LP: #1164714
  * block: fix synchronization and limit check in blk_alloc_devt()
    - LP: #1164714
  * firewire: add minor number range check to fw_device_init()
    - LP: #1164714
  * idr: fix top layer handling
    - LP: #1164714
  * sysctl: fix null checking in bin_dn_node_address()
    - LP: #1164714
  * nbd: fsync and kill block device on shutdown
    - LP: #1164714
  * target/pscsi: Fix page increment
    - LP: #1164714
  * xen/pat: Disable PAT using pat_enabled value.
    - LP: #1164714
  * xen/pci: We don't do multiple MSI's.
    - LP: #1164714
  * xenbus: fix compile failure on ARM with Xen enabled
    - LP: #1164714
  * dm snapshot: add missing module aliases
    - LP: #1164714
  * ext4: convert number of blocks to cluste...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 2.6.32-48.110

---------------
linux (2.6.32-48.110) lucid; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1186340

  [ Stefan Bader ]

  * (config) Import Xen specific config options from ec2
    - LP: #1177431
  * SAUCE: xen: Send spinlock IPI to all waiters
    - LP: #1011792, #1177431

  [ Upstream Kernel Changes ]

  * ax25: fix info leak via msg_name in ax25_recvmsg()
    - LP: #1172366
    - CVE-2013-3223
  * Bluetooth: fix possible info leak in bt_sock_recvmsg()
    - LP: #1172368
    - CVE-2013-3224
  * tipc: fix info leaks via msg_name in recv_msg/recv_stream
    - LP: #1172403
    - CVE-2013-3235
  * rose: fix info leak via msg_name in rose_recvmsg()
    - LP: #1172394
    - CVE-2013-3234
  * Bluetooth: RFCOMM - Fix missing msg_namelen update in
    rfcomm_sock_recvmsg()
    - LP: #1172369
    - CVE-2013-3225
  * atm: update msg_namelen in vcc_recvmsg()
    - LP: #1172365
    - CVE-2013-3222
  * KVM: Fix bounds checking in ioapic indirect register reads
    (CVE-2013-1798)
    - LP: #1158262
    - CVE-2013-1798
  * llc: Fix missing msg_namelen update in llc_ui_recvmsg()
    - LP: #1172385
    - CVE-2013-3231
  * netrom: fix info leak via msg_name in nr_recvmsg()
    - LP: #1172386
    - CVE-2013-3232
  * irda: Fix missing msg_namelen update in irda_recvmsg_dgram()
    - LP: #1172380
    - CVE-2013-3228
  * iucv: Fix missing msg_namelen update in iucv_sock_recvmsg()
    - LP: #1172381
    - CVE-2013-3229
 -- Steve Conklin <email address hidden> Fri, 31 May 2013 12:03:46 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ec2 - 2.6.32-353.66

---------------
linux-ec2 (2.6.32-353.66) lucid-proposed; urgency=low

  [ Stefan Bader ]

  * Rebased to Ubuntu-2.6.32-48.110
  * Release Tracking Bug
    - LP: #1186479

  [ Ubuntu: 2.6.32-48.110 ]

  * (config) Import Xen specific config options from ec2
    - LP: #1177431
  * SAUCE: xen: Send spinlock IPI to all waiters
    - LP: #1011792, #1177431
  * ax25: fix info leak via msg_name in ax25_recvmsg()
    - LP: #1172366
    - CVE-2013-3223
  * Bluetooth: fix possible info leak in bt_sock_recvmsg()
    - LP: #1172368
    - CVE-2013-3224
  * tipc: fix info leaks via msg_name in recv_msg/recv_stream
    - LP: #1172403
    - CVE-2013-3235
  * rose: fix info leak via msg_name in rose_recvmsg()
    - LP: #1172394
    - CVE-2013-3234
  * Bluetooth: RFCOMM - Fix missing msg_namelen update in
    rfcomm_sock_recvmsg()
    - LP: #1172369
    - CVE-2013-3225
  * atm: update msg_namelen in vcc_recvmsg()
    - LP: #1172365
    - CVE-2013-3222
  * KVM: Fix bounds checking in ioapic indirect register reads
    (CVE-2013-1798)
    - LP: #1158262
    - CVE-2013-1798
  * llc: Fix missing msg_namelen update in llc_ui_recvmsg()
    - LP: #1172385
    - CVE-2013-3231
  * netrom: fix info leak via msg_name in nr_recvmsg()
    - LP: #1172386
    - CVE-2013-3232
  * irda: Fix missing msg_namelen update in irda_recvmsg_dgram()
    - LP: #1172380
    - CVE-2013-3228
  * iucv: Fix missing msg_namelen update in iucv_sock_recvmsg()
    - LP: #1172381
    - CVE-2013-3229
 -- Stefan Bader <email address hidden> Tue, 04 Jun 2013 10:12:05 +0200

[Andy Whitcroft (apw)]

This bug was nominated against a series that is no longer supported, ie vivid. The bug task representing the vivid nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.