Perf allows buildd user to run arbitrary code as another user

[Vasily Kulikov]

A certain Ubuntu build procedure for perf, as distributed in the Linux kernel packages in Ubuntu 10.04 LTS, 12.04 LTS, 12.10, 13.04, and 13.10, sets the HOME environment variable to the ~buildd directory and consequently reads the system configuration file from the ~buildd directory, which allows local users to gain privileges by leveraging control over the buildd account.

Break-Fix: - local-2013-1060

[Marc Deslauriers (mdeslaur)]

This is CVE-2013-1060

[Seth Arnold (seth-arnold)]

I believe the correct thing to do is modify debian/rules.d/2-binary-arch.mk

Add DESTDIR=/usr to the make invocation.

This may have more consequences beyond fixing the use of HOME in the resulting binary, however.

$(stampdir)/stamp-build-perarch: $(stampdir)/stamp-prepare-perarch
        @echo Debug: $@
ifeq ($(do_tools),true)
ifeq ($(do_tools_perf),true)
        cd $(builddirpa)/tools/perf && \
                make HAVE_CPLUS_DEMANGLE=1 CROSS_COMPILE=$(CROSS_COMPILE) NO_LIBPYTHON=1 NO_LIBPERL=1 PYTHON=python2.7
endif
        if [ "$(arch)" = "amd64" ] || [ "$(arch)" = "i386" ]; then \
                cd $(builddirpa)/tools/power/x86/x86_energy_perf_policy && make CROSS_COMPILE=$(CROSS_COMPILE); \
                cd $(builddirpa)/tools/power/x86/turbostat && make CROSS_COMPILE=$(CROSS_COMPILE); \
                if [ "$(do_hyperv)" = "true" ]; then \
                        cd $(builddirpa)/tools/hv && make CROSS_COMPILE=$(CROSS_COMPILE); \
                fi; \
        fi
endif
        @touch $@

[Andy Whitcroft (apw)]

We need to set prefix=/usr on that make incantation. Will apply this as appropriate.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.8.0-30.44

---------------
linux (3.8.0-30.44) raring; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1215596

  [ Upstream Kernel Changes ]

  * Don't attempt to send extended INQUIRY command if skip_vpd_pages is set
    - LP: #1215155

linux (3.8.0-30.43) raring; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1215095

  [ Andy Whitcroft ]

  * [Packaging] supply perf with appropriate prefix to ensure use of local
    config
    - LP: #1206200
    - CVE-2013-1060

  [ Brad Figg ]

  * Start new release

  [ John Johansen ]

  * Revert "SAUCE: (no-up) AppArmor: Disable Add PR_{GET,SET}_NO_NEW_PRIVS
    to prevent execve from granting privs"
    - LP: #1202161

  [ Joseph Salisbury ]

  * SAUCE: (no-up) intel_ips: blacklist ASUSTek G60JX laptops
    - LP: #1210848

  [ Kamal Mostafa ]

  * SAUCE: (no-up) Revert "SAUCE: (no-up) drm/i915: quirk no PCH_PWM_ENABLE
    for Dell XPS13 backlight"

  [ Tim Gardner ]

  * [Config] Include rbd and kvm in the virtual inclusion list
    - LP: #1206961

  [ Upstream Kernel Changes ]

  * Revert "drm/i915: Workaround incoherence between fences and LLC across
    multiple CPUs"
    - LP: #1207977
  * xen/blkback: Check device permissions before allowing OP_DISCARD
    - LP: #1207977
  * ASoC: sglt5000: Fix the default value of CHIP_SSS_CTRL
    - LP: #1207977
  * ASoC: sglt5000: Fix SGTL5000_PLL_FRAC_DIV_MASK
    - LP: #1207977
  * drm/i915: Correct obj->mm_list link to
    dev_priv->dev_priv->mm.inactive_list
    - LP: #1207977
  * drm/i915: fix up ring cleanup for the i830/i845 CS tlb w/a
    - LP: #1207977
  * Partially revert "drm/i915: unconditionally use mt forcewake on
    hsw/ivb"
    - LP: #1207977
  * drm/i915: Fix write-read race with multiple rings
    - LP: #1207977
  * drm/i915: merge {i965, sandybridge}_write_fence_reg()
    - LP: #1207977
  * drm/i915: Fix incoherence with fence updates on Sandybridge+
    - LP: #1207977
  * drm/i915: rename sdvox_reg to hdmi_reg on HDMI context
    - LP: #1207977
  * drm/i915: don't setup hdmi for port D edp in ddi_init
    - LP: #1207977
  * drm/i915: Preserve the DDI_A_4_LANES bit from the bios
    - LP: #1207977
  * drm/radeon/hdmi: make sure we have an afmt block assigned
    - LP: #1207977
  * drm/radeon: allocate SA bo in the requested domain
    - LP: #1207977
  * drm/radeon: allow selection of alignment in the sub-allocator
    - LP: #1207977
  * ACPI / memhotplug: Fix a stale pointer in error path
    - LP: #1207977
  * PM / Sleep: avoid 'autosleep' in shutdown progress
    - LP: #1207977
  * ext4: fix error handling in ext4_ext_truncate()
    - LP: #1207977
  * radeon kms: do not flush uninitialized hotplug work
    - LP: #1207977
  * ALSA: asihpi: Fix unlocked snd_pcm_stop() call
    - LP: #1207977
  * ALSA: atiixp: Fix unlocked snd_pcm_stop() call
    - LP: #1207977
  * ALSA: 6fire: Fix unlocked snd_pcm_stop() call
    - LP: #1207977
  * ALSA: ua101: Fix unlocked snd_pcm_stop() call
    - LP: #1207977
  * ALSA: usx2y: Fix unlocked snd_pcm_stop() call
    - LP: #1207977
  * ALSA: pxa2xx: Fix unlocked snd_pcm_stop() call
    - LP: #1207977
  * ASoC: atmel: Fix unl...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 2.6.32-51.113

---------------
linux (2.6.32-51.113) lucid; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1215005

  [ Andy Whitcroft ]

  * remove debian/changelog from git
  * [Packaging] supply perf with appropriate prefix to ensure use of local
    config
    - LP: #1206200
    - CVE-2013-1060

  [ Brad Figg ]

  * Start new release

  [ Upstream Kernel Changes ]

  * Revert "x86, ptrace: fix build breakage with gcc 4.7"
    - LP: #1199154
  * ipv6: call udp_push_pending_frames when uncorking a socket with AF_INET
    pending data
    - LP: #1205070
    - CVE-2013-4162
  * sctp: deal with multiple COOKIE_ECHO chunks
    - LP: #1194445
    - CVE-2013-2206
  * sctp: Use correct sideffect command in duplicate cookie handling
    - LP: #1194445
    - CVE-2013-2206
  * KVM: Validate userspace_addr of memslot when registered
    - LP: #1191918
    - CVE-2013-1943
  * KVM: add missing void __user * cast to access_ok() call
    - LP: #1191918
    - CVE-2013-1943
 -- Brad Figg <email address hidden> Wed, 21 Aug 2013 09:13:41 -0700

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ec2 - 2.6.32-356.69

---------------
linux-ec2 (2.6.32-356.69) lucid-proposed; urgency=low

  [ Stefan Bader ]

  * Rebased to Ubuntu-2.6.32-51.113
  * Release Tracking Bug
    - LP: #1215239

  [ Ubuntu: 2.6.32-51.113 ]

  * remove debian/changelog from git
  * [Packaging] supply perf with appropriate prefix to ensure use of local
    config
    - LP: #1206200
    - CVE-2013-1060
  * Start new release
  * Revert "x86, ptrace: fix build breakage with gcc 4.7"
    - LP: #1199154
  * ipv6: call udp_push_pending_frames when uncorking a socket with AF_INET
    pending data
    - LP: #1205070
    - CVE-2013-4162
  * sctp: deal with multiple COOKIE_ECHO chunks
    - LP: #1194445
    - CVE-2013-2206
  * sctp: Use correct sideffect command in duplicate cookie handling
    - LP: #1194445
    - CVE-2013-2206
  * KVM: Validate userspace_addr of memslot when registered
    - LP: #1191918
    - CVE-2013-1943
  * KVM: add missing void __user * cast to access_ok() call
    - LP: #1191918
    - CVE-2013-1943
 -- Stefan Bader <email address hidden> Mon, 26 Aug 2013 16:33:40 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.2.0-53.81

---------------
linux (3.2.0-53.81) precise; urgency=low

  [ Tim Gardner ]

  * SAUCE: net: ifb: Added include file <linux/sched.h>

linux (3.2.0-53.80) precise; urgency=low

  [Brad Figg]

  * Release Tracking Bug
    - LP: #1215173

  [ Andy Whitcroft ]

  * [Packaging] supply perf with appropriate prefix to ensure use of local
    config
    - LP: #1206200
    - CVE-2013-1060

  [ Joseph Salisbury ]

  * SAUCE: (no-up) intel_ips: blacklist ASUSTek G60JX laptops
    - LP: #1210848

  [ Tim Gardner ]

  * [Config] Include rbd and kvm in the virtual inclusion list
    - LP: #1206961

  [ Upstream Kernel Changes ]

  * qla2xxx: Properly set the tagging for commands.
    - LP: #1189928
  * r8169: fix offloaded tx checksum for small packets.
    - LP: #1214984
  * printk: Fix rq->lock vs logbuf_lock unlock lock inversion
    - LP: #1214984
  * zfcp: fix adapter (re)open recovery while link to SAN is down
    - LP: #1214984
  * zfcp: block queue limits with data router
    - LP: #1214984
  * zfcp: status read buffers on first adapter open with link down
    - LP: #1214984
  * ahci: Add AMD CZ SATA device ID
    - LP: #1214984
  * i2c-piix4: Add AMD CZ SMBus device ID
    - LP: #1214984
  * zram: avoid invalid memory access in zram_exit()
    - LP: #1214984
  * zram: use zram->lock to protect zram_free_page() in swap free notify
    path
    - LP: #1214984
  * zram: destroy all devices on error recovery path in zram_init()
    - LP: #1214984
  * zram: avoid access beyond the zram device
    - LP: #1214984
  * zram: protect sysfs handler from invalid memory access
    - LP: #1214984
  * ahci: remove pmp link online check in FBS EH
    - LP: #1214984
  * usb: gadget: f_mass_storage: add missing memory barrier for
    thread_wakeup_needed
    - LP: #1214984
  * libata: skip SRST for all SIMG [34]7x port-multipliers
    - LP: #1214984
  * b43: ensue that BCMA is "y" when B43 is "y"
    - LP: #1214984
  * ath9k_hw: Assign default xlna config for AR9485
    - LP: #1214984
  * ath9k: fill channel mode in caldata
    - LP: #1214984
  * ath9k: Fix noisefloor calibration
    - LP: #1214984
  * ath9k: Do not assign noise for NULL caldata
    - LP: #1214984
  * Bluetooth: Fix crash in l2cap_build_cmd() with small MTU
    - LP: #1214984
  * ASoC: wm8962: Remove remaining direct register cache accesses
    - LP: #1214984
  * rtlwifi: rtl8192cu: Add new USB ID for TP-Link TL-WN8200ND
    - LP: #1214984
  * ALSA: hda - Cache the MUX selection for generic HDMI
    - LP: #1214984
  * xhci: check for failed dma pool allocation
    - LP: #1214984
  * drivers: hv: switch to use mb() instead of smp_mb()
    - LP: #1214984
  * media: dmxdev: remove dvb_ringbuffer_flush() on writer side
    - LP: #1214984
  * rtlwifi: rtl8192cu: Fix duplicate if test
    - LP: #1214984
  * hw_breakpoint: Use cpu_possible_mask in {reserve,release}_bp_slot()
    - LP: #1214984
  * ata_piix: IDE-mode SATA patch for Intel Coleto Creek DeviceIDs
    - LP: #1214984
  * ahci: AHCI-mode SATA patch for Intel Coleto Creek DeviceIDs
    - LP: #1214984
  * iommu/amd: Only unmap large pages from the first pte
    - LP: #1214984
  * ARM: 7765/1: ...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-armadaxp - 3.2.0-1624.36

---------------
linux-armadaxp (3.2.0-1624.36) precise-proposed; urgency=low

  [ Ike Panhc ]

  * Release Tracking Bug
    - LP: #1215690
  * Rebase onto Ubuntu-3.2.0-53.81

  [ Ubuntu: 3.2.0-53.81 ]

  * SAUCE: net: ifb: Added include file <linux/sched.h>

  [ Ubuntu: 3.2.0-53.80 ]

  * Release Tracking Bug
    - LP: #1215173
  * [Packaging] supply perf with appropriate prefix to ensure use of local
    config
    - LP: #1206200
    - CVE-2013-1060
  * SAUCE: (no-up) intel_ips: blacklist ASUSTek G60JX laptops
    - LP: #1210848
  * [Config] Include rbd and kvm in the virtual inclusion list
    - LP: #1206961
  * qla2xxx: Properly set the tagging for commands.
    - LP: #1189928
  * r8169: fix offloaded tx checksum for small packets.
    - LP: #1214984
  * printk: Fix rq->lock vs logbuf_lock unlock lock inversion
    - LP: #1214984
  * zfcp: fix adapter (re)open recovery while link to SAN is down
    - LP: #1214984
  * zfcp: block queue limits with data router
    - LP: #1214984
  * zfcp: status read buffers on first adapter open with link down
    - LP: #1214984
  * ahci: Add AMD CZ SATA device ID
    - LP: #1214984
  * i2c-piix4: Add AMD CZ SMBus device ID
    - LP: #1214984
  * zram: avoid invalid memory access in zram_exit()
    - LP: #1214984
  * zram: use zram->lock to protect zram_free_page() in swap free notify
    path
    - LP: #1214984
  * zram: destroy all devices on error recovery path in zram_init()
    - LP: #1214984
  * zram: avoid access beyond the zram device
    - LP: #1214984
  * zram: protect sysfs handler from invalid memory access
    - LP: #1214984
  * ahci: remove pmp link online check in FBS EH
    - LP: #1214984
  * usb: gadget: f_mass_storage: add missing memory barrier for
    thread_wakeup_needed
    - LP: #1214984
  * libata: skip SRST for all SIMG [34]7x port-multipliers
    - LP: #1214984
  * b43: ensue that BCMA is "y" when B43 is "y"
    - LP: #1214984
  * ath9k_hw: Assign default xlna config for AR9485
    - LP: #1214984
  * ath9k: fill channel mode in caldata
    - LP: #1214984
  * ath9k: Fix noisefloor calibration
    - LP: #1214984
  * ath9k: Do not assign noise for NULL caldata
    - LP: #1214984
  * Bluetooth: Fix crash in l2cap_build_cmd() with small MTU
    - LP: #1214984
  * ASoC: wm8962: Remove remaining direct register cache accesses
    - LP: #1214984
  * rtlwifi: rtl8192cu: Add new USB ID for TP-Link TL-WN8200ND
    - LP: #1214984
  * ALSA: hda - Cache the MUX selection for generic HDMI
    - LP: #1214984
  * xhci: check for failed dma pool allocation
    - LP: #1214984
  * drivers: hv: switch to use mb() instead of smp_mb()
    - LP: #1214984
  * media: dmxdev: remove dvb_ringbuffer_flush() on writer side
    - LP: #1214984
  * rtlwifi: rtl8192cu: Fix duplicate if test
    - LP: #1214984
  * hw_breakpoint: Use cpu_possible_mask in {reserve,release}_bp_slot()
    - LP: #1214984
  * ata_piix: IDE-mode SATA patch for Intel Coleto Creek DeviceIDs
    - LP: #1214984
  * ahci: AHCI-mode SATA patch for Intel Coleto Creek DeviceIDs
    - LP: #1214984
  * iommu/amd: Only unmap large pages from the first pte
    - LP: #1214984
  * ARM: 77...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.2.0-1437.56

---------------
linux-ti-omap4 (3.2.0-1437.56) precise; urgency=low

  * Release Tracking Bug
    - LP: #1215689

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.2.0-53.81

  [ Ubuntu: 3.2.0-53.81 ]

  * SAUCE: net: ifb: Added include file <linux/sched.h>

  [ Ubuntu: 3.2.0-53.80 ]

  * Release Tracking Bug
    - LP: #1215173
  * [Packaging] supply perf with appropriate prefix to ensure use of local
    config
    - LP: #1206200
    - CVE-2013-1060
  * SAUCE: (no-up) intel_ips: blacklist ASUSTek G60JX laptops
    - LP: #1210848
  * [Config] Include rbd and kvm in the virtual inclusion list
    - LP: #1206961
  * qla2xxx: Properly set the tagging for commands.
    - LP: #1189928
  * r8169: fix offloaded tx checksum for small packets.
    - LP: #1214984
  * printk: Fix rq->lock vs logbuf_lock unlock lock inversion
    - LP: #1214984
  * zfcp: fix adapter (re)open recovery while link to SAN is down
    - LP: #1214984
  * zfcp: block queue limits with data router
    - LP: #1214984
  * zfcp: status read buffers on first adapter open with link down
    - LP: #1214984
  * ahci: Add AMD CZ SATA device ID
    - LP: #1214984
  * i2c-piix4: Add AMD CZ SMBus device ID
    - LP: #1214984
  * zram: avoid invalid memory access in zram_exit()
    - LP: #1214984
  * zram: use zram->lock to protect zram_free_page() in swap free notify
    path
    - LP: #1214984
  * zram: destroy all devices on error recovery path in zram_init()
    - LP: #1214984
  * zram: avoid access beyond the zram device
    - LP: #1214984
  * zram: protect sysfs handler from invalid memory access
    - LP: #1214984
  * ahci: remove pmp link online check in FBS EH
    - LP: #1214984
  * usb: gadget: f_mass_storage: add missing memory barrier for
    thread_wakeup_needed
    - LP: #1214984
  * libata: skip SRST for all SIMG [34]7x port-multipliers
    - LP: #1214984
  * b43: ensue that BCMA is "y" when B43 is "y"
    - LP: #1214984
  * ath9k_hw: Assign default xlna config for AR9485
    - LP: #1214984
  * ath9k: fill channel mode in caldata
    - LP: #1214984
  * ath9k: Fix noisefloor calibration
    - LP: #1214984
  * ath9k: Do not assign noise for NULL caldata
    - LP: #1214984
  * Bluetooth: Fix crash in l2cap_build_cmd() with small MTU
    - LP: #1214984
  * ASoC: wm8962: Remove remaining direct register cache accesses
    - LP: #1214984
  * rtlwifi: rtl8192cu: Add new USB ID for TP-Link TL-WN8200ND
    - LP: #1214984
  * ALSA: hda - Cache the MUX selection for generic HDMI
    - LP: #1214984
  * xhci: check for failed dma pool allocation
    - LP: #1214984
  * drivers: hv: switch to use mb() instead of smp_mb()
    - LP: #1214984
  * media: dmxdev: remove dvb_ringbuffer_flush() on writer side
    - LP: #1214984
  * rtlwifi: rtl8192cu: Fix duplicate if test
    - LP: #1214984
  * hw_breakpoint: Use cpu_possible_mask in {reserve,release}_bp_slot()
    - LP: #1214984
  * ata_piix: IDE-mode SATA patch for Intel Coleto Creek DeviceIDs
    - LP: #1214984
  * ahci: AHCI-mode SATA patch for Intel Coleto Creek DeviceIDs
    - LP: #1214984
  * iommu/amd: Only unmap large pages from the first pte
    - LP: #1214984
  * ARM: 7765/1: ...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.5.0-40.62

---------------
linux (3.5.0-40.62) quantal; urgency=low

  [ Brad Figg ]

  * [Config] KUSER_HELPERS = Y
  * Release Tracking Bug
    - LP: #1215129

linux (3.5.0-40.61) quantal; urgency=low

  [ Andy Whitcroft ]

  * [Packaging] supply perf with appropriate prefix to ensure use of local
    config
    - LP: #1206200
    - CVE-2013-1060

  [ John Johansen ]

  * Revert "SAUCE: (no-up) AppArmor: Disable Add PR_{GET,SET}_NO_NEW_PRIVS
    to prevent execve from granting privs"
    - LP: #1202161

  [ Joseph Salisbury ]

  * SAUCE: (no-up) intel_ips: blacklist ASUSTek G60JX laptops
    - LP: #1210848

  [ Stefan Bader ]

  * (debian) Abort build on unresolved symbols
    - LP: #1166197

  [ Tim Gardner ]

  * [Config] Include rbd and kvm in the virtual inclusion list
    - LP: #1206961

  [ Upstream Kernel Changes ]

  * ALSA: usb: Parse UAC2 extension unit like for UAC1
    - LP: #1212430
  * Btrfs: fix hash overflow handling
    - LP: #1091187, #1091188
    - CVE-2012-5375
  * [media] media: dmxdev: remove dvb_ringbuffer_flush() on writer side
    - LP: #1214956
  * writeback: Fix periodic writeback after fs mount
    - LP: #1214956
  * nfsd4: fix decoding of compounds across page boundaries
    - LP: #1214956
  * ARM: shmobile: emev2 GIO3 resource fix
    - LP: #1214956
  * uprobes: Fix return value in error handling path
    - LP: #1214956
  * tracing: Fix irqs-off tag display in syscall tracing
    - LP: #1214956
  * [CIFS] use sensible file nlink values if unprovided
    - LP: #1214956
  * ASoC: sglt5000: Fix the default value of CHIP_SSS_CTRL
    - LP: #1214956
  * ASoC: sglt5000: Fix SGTL5000_PLL_FRAC_DIV_MASK
    - LP: #1214956
  * [SCSI] megaraid_sas: fix memory leak if SGL has zero length entries
    - LP: #1214956
  * iscsi-target: Fix tfc_tpg_nacl_auth_cit configfs length overflow
    - LP: #1214956
  * dm mpath: fix ioctl deadlock when no paths
    - LP: #1214956
  * dm verity: fix inability to use a few specific devices sizes
    - LP: #1214956
  * lockd: protect nlm_blocked access in nlmsvc_retry_blocked
    - LP: #1214956
  * ext4: don't show usrquota/grpquota twice in /proc/mounts
    - LP: #1214956
  * perf: Clone child context from parent context pmu
    - LP: #1214956
  * perf: Remove WARN_ON_ONCE() check in __perf_event_enable() for valid
    scenario
    - LP: #1214956
  * perf: Fix perf_lock_task_context() vs RCU
    - LP: #1214956
  * ext4: don't allow ext4_free_blocks() to fail due to ENOMEM
    - LP: #1214956
  * drm/radeon/hdmi: make sure we have an afmt block assigned
    - LP: #1214956
  * ACPI / memhotplug: Fix a stale pointer in error path
    - LP: #1214956
  * PM / Sleep: avoid 'autosleep' in shutdown progress
    - LP: #1214956
  * radeon kms: do not flush uninitialized hotplug work
    - LP: #1214956
  * svcrdma: underflow issue in decode_write_list()
    - LP: #1214956
  * ALSA: asihpi: Fix unlocked snd_pcm_stop() call
    - LP: #1214956
  * ALSA: atiixp: Fix unlocked snd_pcm_stop() call
    - LP: #1214956
  * ALSA: 6fire: Fix unlocked snd_pcm_stop() call
    - LP: #1214956
  * ALSA: ua101: Fix unlocked snd_pcm_stop() call
    - LP: #1214956
  * ALSA: usx...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.5.0-232.48

---------------
linux-ti-omap4 (3.5.0-232.48) quantal; urgency=low

  * Release Tracking Bug
    - LP: #1215276

  [ Paolo Pisati ]

  * SAUCE: fixup between 6288223947 and db7981259
  * rebased on Ubuntu-3.5.0-40.62

  [ Ubuntu: 3.5.0-40.62 ]

  * [Config] KUSER_HELPERS = Y
  * Release Tracking Bug
    - LP: #1215129

  [ Ubuntu: 3.5.0-40.61 ]

  * [Packaging] supply perf with appropriate prefix to ensure use of local
    config
    - LP: #1206200
    - CVE-2013-1060
  * Revert "SAUCE: (no-up) AppArmor: Disable Add PR_{GET,SET}_NO_NEW_PRIVS
    to prevent execve from granting privs"
    - LP: #1202161
  * SAUCE: (no-up) intel_ips: blacklist ASUSTek G60JX laptops
    - LP: #1210848
  * (debian) Abort build on unresolved symbols
    - LP: #1166197
  * [Config] Include rbd and kvm in the virtual inclusion list
    - LP: #1206961
  * ALSA: usb: Parse UAC2 extension unit like for UAC1
    - LP: #1212430
  * Btrfs: fix hash overflow handling
    - LP: #1091187, #1091188
    - CVE-2012-5375
  * [media] media: dmxdev: remove dvb_ringbuffer_flush() on writer side
    - LP: #1214956
  * writeback: Fix periodic writeback after fs mount
    - LP: #1214956
  * nfsd4: fix decoding of compounds across page boundaries
    - LP: #1214956
  * ARM: shmobile: emev2 GIO3 resource fix
    - LP: #1214956
  * uprobes: Fix return value in error handling path
    - LP: #1214956
  * tracing: Fix irqs-off tag display in syscall tracing
    - LP: #1214956
  * [CIFS] use sensible file nlink values if unprovided
    - LP: #1214956
  * ASoC: sglt5000: Fix the default value of CHIP_SSS_CTRL
    - LP: #1214956
  * ASoC: sglt5000: Fix SGTL5000_PLL_FRAC_DIV_MASK
    - LP: #1214956
  * [SCSI] megaraid_sas: fix memory leak if SGL has zero length entries
    - LP: #1214956
  * iscsi-target: Fix tfc_tpg_nacl_auth_cit configfs length overflow
    - LP: #1214956
  * dm mpath: fix ioctl deadlock when no paths
    - LP: #1214956
  * dm verity: fix inability to use a few specific devices sizes
    - LP: #1214956
  * lockd: protect nlm_blocked access in nlmsvc_retry_blocked
    - LP: #1214956
  * ext4: don't show usrquota/grpquota twice in /proc/mounts
    - LP: #1214956
  * perf: Clone child context from parent context pmu
    - LP: #1214956
  * perf: Remove WARN_ON_ONCE() check in __perf_event_enable() for valid
    scenario
    - LP: #1214956
  * perf: Fix perf_lock_task_context() vs RCU
    - LP: #1214956
  * ext4: don't allow ext4_free_blocks() to fail due to ENOMEM
    - LP: #1214956
  * drm/radeon/hdmi: make sure we have an afmt block assigned
    - LP: #1214956
  * ACPI / memhotplug: Fix a stale pointer in error path
    - LP: #1214956
  * PM / Sleep: avoid 'autosleep' in shutdown progress
    - LP: #1214956
  * radeon kms: do not flush uninitialized hotplug work
    - LP: #1214956
  * svcrdma: underflow issue in decode_write_list()
    - LP: #1214956
  * ALSA: asihpi: Fix unlocked snd_pcm_stop() call
    - LP: #1214956
  * ALSA: atiixp: Fix unlocked snd_pcm_stop() call
    - LP: #1214956
  * ALSA: 6fire: Fix unlocked snd_pcm_stop() call
    - LP: #1214956
  * ALSA: ua101: Fix unlocked snd_pcm_stop() call
    - LP...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-lts-raring - 3.8.0-30.44~precise1

---------------
linux-lts-raring (3.8.0-30.44~precise1) precise; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1215677

  [ Upstream Kernel Changes ]

  * Don't attempt to send extended INQUIRY command if skip_vpd_pages is set
    - LP: #1215155

linux (3.8.0-30.43) raring; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1215095

  [ Andy Whitcroft ]

  * [Packaging] supply perf with appropriate prefix to ensure use of local
    config
    - LP: #1206200
    - CVE-2013-1060

  [ Brad Figg ]

  * Start new release

  [ John Johansen ]

  * Revert "SAUCE: (no-up) AppArmor: Disable Add PR_{GET,SET}_NO_NEW_PRIVS
    to prevent execve from granting privs"
    - LP: #1202161

  [ Joseph Salisbury ]

  * SAUCE: (no-up) intel_ips: blacklist ASUSTek G60JX laptops
    - LP: #1210848

  [ Kamal Mostafa ]

  * SAUCE: (no-up) Revert "SAUCE: (no-up) drm/i915: quirk no PCH_PWM_ENABLE
    for Dell XPS13 backlight"

  [ Tim Gardner ]

  * [Config] Include rbd and kvm in the virtual inclusion list
    - LP: #1206961

  [ Upstream Kernel Changes ]

  * Revert "drm/i915: Workaround incoherence between fences and LLC across
    multiple CPUs"
    - LP: #1207977
  * xen/blkback: Check device permissions before allowing OP_DISCARD
    - LP: #1207977
  * ASoC: sglt5000: Fix the default value of CHIP_SSS_CTRL
    - LP: #1207977
  * ASoC: sglt5000: Fix SGTL5000_PLL_FRAC_DIV_MASK
    - LP: #1207977
  * drm/i915: Correct obj->mm_list link to
    dev_priv->dev_priv->mm.inactive_list
    - LP: #1207977
  * drm/i915: fix up ring cleanup for the i830/i845 CS tlb w/a
    - LP: #1207977
  * Partially revert "drm/i915: unconditionally use mt forcewake on
    hsw/ivb"
    - LP: #1207977
  * drm/i915: Fix write-read race with multiple rings
    - LP: #1207977
  * drm/i915: merge {i965, sandybridge}_write_fence_reg()
    - LP: #1207977
  * drm/i915: Fix incoherence with fence updates on Sandybridge+
    - LP: #1207977
  * drm/i915: rename sdvox_reg to hdmi_reg on HDMI context
    - LP: #1207977
  * drm/i915: don't setup hdmi for port D edp in ddi_init
    - LP: #1207977
  * drm/i915: Preserve the DDI_A_4_LANES bit from the bios
    - LP: #1207977
  * drm/radeon/hdmi: make sure we have an afmt block assigned
    - LP: #1207977
  * drm/radeon: allocate SA bo in the requested domain
    - LP: #1207977
  * drm/radeon: allow selection of alignment in the sub-allocator
    - LP: #1207977
  * ACPI / memhotplug: Fix a stale pointer in error path
    - LP: #1207977
  * PM / Sleep: avoid 'autosleep' in shutdown progress
    - LP: #1207977
  * ext4: fix error handling in ext4_ext_truncate()
    - LP: #1207977
  * radeon kms: do not flush uninitialized hotplug work
    - LP: #1207977
  * ALSA: asihpi: Fix unlocked snd_pcm_stop() call
    - LP: #1207977
  * ALSA: atiixp: Fix unlocked snd_pcm_stop() call
    - LP: #1207977
  * ALSA: 6fire: Fix unlocked snd_pcm_stop() call
    - LP: #1207977
  * ALSA: ua101: Fix unlocked snd_pcm_stop() call
    - LP: #1207977
  * ALSA: usx2y: Fix unlocked snd_pcm_stop() call
    - LP: #1207977
  * ALSA: pxa2xx: Fix unlocked snd_pcm_stop() call
  ...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-armadaxp - 3.5.0-1621.29

---------------
linux-armadaxp (3.5.0-1621.29) quantal-proposed; urgency=low

  [ Ike Panhc ]

  * Release Tracking Bug
    - LP: #1215278
  * [Config] Enable CONFIG_KUSER_HELPERS
  * Rebase onto Ubuntu-3.5.0-40.62

  [ Ubuntu: 3.5.0-40.62 ]

  * [Config] KUSER_HELPERS = Y
  * Release Tracking Bug
    - LP: #1215129

  [ Ubuntu: 3.5.0-40.61 ]

  * [Packaging] supply perf with appropriate prefix to ensure use of local
    config
    - LP: #1206200
    - CVE-2013-1060
  * Revert "SAUCE: (no-up) AppArmor: Disable Add PR_{GET,SET}_NO_NEW_PRIVS
    to prevent execve from granting privs"
    - LP: #1202161
  * SAUCE: (no-up) intel_ips: blacklist ASUSTek G60JX laptops
    - LP: #1210848
  * (debian) Abort build on unresolved symbols
    - LP: #1166197
  * [Config] Include rbd and kvm in the virtual inclusion list
    - LP: #1206961
  * ALSA: usb: Parse UAC2 extension unit like for UAC1
    - LP: #1212430
  * Btrfs: fix hash overflow handling
    - LP: #1091187, #1091188
    - CVE-2012-5375
  * [media] media: dmxdev: remove dvb_ringbuffer_flush() on writer side
    - LP: #1214956
  * writeback: Fix periodic writeback after fs mount
    - LP: #1214956
  * nfsd4: fix decoding of compounds across page boundaries
    - LP: #1214956
  * ARM: shmobile: emev2 GIO3 resource fix
    - LP: #1214956
  * uprobes: Fix return value in error handling path
    - LP: #1214956
  * tracing: Fix irqs-off tag display in syscall tracing
    - LP: #1214956
  * [CIFS] use sensible file nlink values if unprovided
    - LP: #1214956
  * ASoC: sglt5000: Fix the default value of CHIP_SSS_CTRL
    - LP: #1214956
  * ASoC: sglt5000: Fix SGTL5000_PLL_FRAC_DIV_MASK
    - LP: #1214956
  * [SCSI] megaraid_sas: fix memory leak if SGL has zero length entries
    - LP: #1214956
  * iscsi-target: Fix tfc_tpg_nacl_auth_cit configfs length overflow
    - LP: #1214956
  * dm mpath: fix ioctl deadlock when no paths
    - LP: #1214956
  * dm verity: fix inability to use a few specific devices sizes
    - LP: #1214956
  * lockd: protect nlm_blocked access in nlmsvc_retry_blocked
    - LP: #1214956
  * ext4: don't show usrquota/grpquota twice in /proc/mounts
    - LP: #1214956
  * perf: Clone child context from parent context pmu
    - LP: #1214956
  * perf: Remove WARN_ON_ONCE() check in __perf_event_enable() for valid
    scenario
    - LP: #1214956
  * perf: Fix perf_lock_task_context() vs RCU
    - LP: #1214956
  * ext4: don't allow ext4_free_blocks() to fail due to ENOMEM
    - LP: #1214956
  * drm/radeon/hdmi: make sure we have an afmt block assigned
    - LP: #1214956
  * ACPI / memhotplug: Fix a stale pointer in error path
    - LP: #1214956
  * PM / Sleep: avoid 'autosleep' in shutdown progress
    - LP: #1214956
  * radeon kms: do not flush uninitialized hotplug work
    - LP: #1214956
  * svcrdma: underflow issue in decode_write_list()
    - LP: #1214956
  * ALSA: asihpi: Fix unlocked snd_pcm_stop() call
    - LP: #1214956
  * ALSA: atiixp: Fix unlocked snd_pcm_stop() call
    - LP: #1214956
  * ALSA: 6fire: Fix unlocked snd_pcm_stop() call
    - LP: #1214956
  * ALSA: ua101: Fix unlocked snd_pcm_stop() call
    - LP: ...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.5.0-232.48

---------------
linux-ti-omap4 (3.5.0-232.48) quantal; urgency=low

  * Release Tracking Bug
    - LP: #1215276

  [ Paolo Pisati ]

  * SAUCE: fixup between 6288223947 and db7981259
  * rebased on Ubuntu-3.5.0-40.62

  [ Ubuntu: 3.5.0-40.62 ]

  * [Config] KUSER_HELPERS = Y
  * Release Tracking Bug
    - LP: #1215129

  [ Ubuntu: 3.5.0-40.61 ]

  * [Packaging] supply perf with appropriate prefix to ensure use of local
    config
    - LP: #1206200
    - CVE-2013-1060
  * Revert "SAUCE: (no-up) AppArmor: Disable Add PR_{GET,SET}_NO_NEW_PRIVS
    to prevent execve from granting privs"
    - LP: #1202161
  * SAUCE: (no-up) intel_ips: blacklist ASUSTek G60JX laptops
    - LP: #1210848
  * (debian) Abort build on unresolved symbols
    - LP: #1166197
  * [Config] Include rbd and kvm in the virtual inclusion list
    - LP: #1206961
  * ALSA: usb: Parse UAC2 extension unit like for UAC1
    - LP: #1212430
  * Btrfs: fix hash overflow handling
    - LP: #1091187, #1091188
    - CVE-2012-5375
  * [media] media: dmxdev: remove dvb_ringbuffer_flush() on writer side
    - LP: #1214956
  * writeback: Fix periodic writeback after fs mount
    - LP: #1214956
  * nfsd4: fix decoding of compounds across page boundaries
    - LP: #1214956
  * ARM: shmobile: emev2 GIO3 resource fix
    - LP: #1214956
  * uprobes: Fix return value in error handling path
    - LP: #1214956
  * tracing: Fix irqs-off tag display in syscall tracing
    - LP: #1214956
  * [CIFS] use sensible file nlink values if unprovided
    - LP: #1214956
  * ASoC: sglt5000: Fix the default value of CHIP_SSS_CTRL
    - LP: #1214956
  * ASoC: sglt5000: Fix SGTL5000_PLL_FRAC_DIV_MASK
    - LP: #1214956
  * [SCSI] megaraid_sas: fix memory leak if SGL has zero length entries
    - LP: #1214956
  * iscsi-target: Fix tfc_tpg_nacl_auth_cit configfs length overflow
    - LP: #1214956
  * dm mpath: fix ioctl deadlock when no paths
    - LP: #1214956
  * dm verity: fix inability to use a few specific devices sizes
    - LP: #1214956
  * lockd: protect nlm_blocked access in nlmsvc_retry_blocked
    - LP: #1214956
  * ext4: don't show usrquota/grpquota twice in /proc/mounts
    - LP: #1214956
  * perf: Clone child context from parent context pmu
    - LP: #1214956
  * perf: Remove WARN_ON_ONCE() check in __perf_event_enable() for valid
    scenario
    - LP: #1214956
  * perf: Fix perf_lock_task_context() vs RCU
    - LP: #1214956
  * ext4: don't allow ext4_free_blocks() to fail due to ENOMEM
    - LP: #1214956
  * drm/radeon/hdmi: make sure we have an afmt block assigned
    - LP: #1214956
  * ACPI / memhotplug: Fix a stale pointer in error path
    - LP: #1214956
  * PM / Sleep: avoid 'autosleep' in shutdown progress
    - LP: #1214956
  * radeon kms: do not flush uninitialized hotplug work
    - LP: #1214956
  * svcrdma: underflow issue in decode_write_list()
    - LP: #1214956
  * ALSA: asihpi: Fix unlocked snd_pcm_stop() call
    - LP: #1214956
  * ALSA: atiixp: Fix unlocked snd_pcm_stop() call
    - LP: #1214956
  * ALSA: 6fire: Fix unlocked snd_pcm_stop() call
    - LP: #1214956
  * ALSA: ua101: Fix unlocked snd_pcm_stop() call
    - LP...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-lts-quantal - 3.5.0-40.62~precise1

---------------
linux-lts-quantal (3.5.0-40.62~precise1) precise; urgency=low

  [ Brad Figg ]

  * [Config] KUSER_HELPERS = Y
  * Release Tracking Bug
    - LP: #1215280

linux (3.5.0-40.61) quantal; urgency=low

  [ Andy Whitcroft ]

  * [Packaging] supply perf with appropriate prefix to ensure use of local
    config
    - LP: #1206200
    - CVE-2013-1060

  [ John Johansen ]

  * Revert "SAUCE: (no-up) AppArmor: Disable Add PR_{GET,SET}_NO_NEW_PRIVS
    to prevent execve from granting privs"
    - LP: #1202161

  [ Joseph Salisbury ]

  * SAUCE: (no-up) intel_ips: blacklist ASUSTek G60JX laptops
    - LP: #1210848

  [ Stefan Bader ]

  * (debian) Abort build on unresolved symbols
    - LP: #1166197

  [ Tim Gardner ]

  * [Config] Include rbd and kvm in the virtual inclusion list
    - LP: #1206961

  [ Upstream Kernel Changes ]

  * ALSA: usb: Parse UAC2 extension unit like for UAC1
    - LP: #1212430
  * Btrfs: fix hash overflow handling
    - LP: #1091187, #1091188
    - CVE-2012-5375
  * [media] media: dmxdev: remove dvb_ringbuffer_flush() on writer side
    - LP: #1214956
  * writeback: Fix periodic writeback after fs mount
    - LP: #1214956
  * nfsd4: fix decoding of compounds across page boundaries
    - LP: #1214956
  * ARM: shmobile: emev2 GIO3 resource fix
    - LP: #1214956
  * uprobes: Fix return value in error handling path
    - LP: #1214956
  * tracing: Fix irqs-off tag display in syscall tracing
    - LP: #1214956
  * [CIFS] use sensible file nlink values if unprovided
    - LP: #1214956
  * ASoC: sglt5000: Fix the default value of CHIP_SSS_CTRL
    - LP: #1214956
  * ASoC: sglt5000: Fix SGTL5000_PLL_FRAC_DIV_MASK
    - LP: #1214956
  * [SCSI] megaraid_sas: fix memory leak if SGL has zero length entries
    - LP: #1214956
  * iscsi-target: Fix tfc_tpg_nacl_auth_cit configfs length overflow
    - LP: #1214956
  * dm mpath: fix ioctl deadlock when no paths
    - LP: #1214956
  * dm verity: fix inability to use a few specific devices sizes
    - LP: #1214956
  * lockd: protect nlm_blocked access in nlmsvc_retry_blocked
    - LP: #1214956
  * ext4: don't show usrquota/grpquota twice in /proc/mounts
    - LP: #1214956
  * perf: Clone child context from parent context pmu
    - LP: #1214956
  * perf: Remove WARN_ON_ONCE() check in __perf_event_enable() for valid
    scenario
    - LP: #1214956
  * perf: Fix perf_lock_task_context() vs RCU
    - LP: #1214956
  * ext4: don't allow ext4_free_blocks() to fail due to ENOMEM
    - LP: #1214956
  * drm/radeon/hdmi: make sure we have an afmt block assigned
    - LP: #1214956
  * ACPI / memhotplug: Fix a stale pointer in error path
    - LP: #1214956
  * PM / Sleep: avoid 'autosleep' in shutdown progress
    - LP: #1214956
  * radeon kms: do not flush uninitialized hotplug work
    - LP: #1214956
  * svcrdma: underflow issue in decode_write_list()
    - LP: #1214956
  * ALSA: asihpi: Fix unlocked snd_pcm_stop() call
    - LP: #1214956
  * ALSA: atiixp: Fix unlocked snd_pcm_stop() call
    - LP: #1214956
  * ALSA: 6fire: Fix unlocked snd_pcm_stop() call
    - LP: #1214956
  * ALSA: ua101: Fix unlocked snd_pcm_st...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.5.0-232.48

---------------
linux-ti-omap4 (3.5.0-232.48) quantal; urgency=low

  * Release Tracking Bug
    - LP: #1215276

  [ Paolo Pisati ]

  * SAUCE: fixup between 6288223947 and db7981259
  * rebased on Ubuntu-3.5.0-40.62

  [ Ubuntu: 3.5.0-40.62 ]

  * [Config] KUSER_HELPERS = Y
  * Release Tracking Bug
    - LP: #1215129

  [ Ubuntu: 3.5.0-40.61 ]

  * [Packaging] supply perf with appropriate prefix to ensure use of local
    config
    - LP: #1206200
    - CVE-2013-1060
  * Revert "SAUCE: (no-up) AppArmor: Disable Add PR_{GET,SET}_NO_NEW_PRIVS
    to prevent execve from granting privs"
    - LP: #1202161
  * SAUCE: (no-up) intel_ips: blacklist ASUSTek G60JX laptops
    - LP: #1210848
  * (debian) Abort build on unresolved symbols
    - LP: #1166197
  * [Config] Include rbd and kvm in the virtual inclusion list
    - LP: #1206961
  * ALSA: usb: Parse UAC2 extension unit like for UAC1
    - LP: #1212430
  * Btrfs: fix hash overflow handling
    - LP: #1091187, #1091188
    - CVE-2012-5375
  * [media] media: dmxdev: remove dvb_ringbuffer_flush() on writer side
    - LP: #1214956
  * writeback: Fix periodic writeback after fs mount
    - LP: #1214956
  * nfsd4: fix decoding of compounds across page boundaries
    - LP: #1214956
  * ARM: shmobile: emev2 GIO3 resource fix
    - LP: #1214956
  * uprobes: Fix return value in error handling path
    - LP: #1214956
  * tracing: Fix irqs-off tag display in syscall tracing
    - LP: #1214956
  * [CIFS] use sensible file nlink values if unprovided
    - LP: #1214956
  * ASoC: sglt5000: Fix the default value of CHIP_SSS_CTRL
    - LP: #1214956
  * ASoC: sglt5000: Fix SGTL5000_PLL_FRAC_DIV_MASK
    - LP: #1214956
  * [SCSI] megaraid_sas: fix memory leak if SGL has zero length entries
    - LP: #1214956
  * iscsi-target: Fix tfc_tpg_nacl_auth_cit configfs length overflow
    - LP: #1214956
  * dm mpath: fix ioctl deadlock when no paths
    - LP: #1214956
  * dm verity: fix inability to use a few specific devices sizes
    - LP: #1214956
  * lockd: protect nlm_blocked access in nlmsvc_retry_blocked
    - LP: #1214956
  * ext4: don't show usrquota/grpquota twice in /proc/mounts
    - LP: #1214956
  * perf: Clone child context from parent context pmu
    - LP: #1214956
  * perf: Remove WARN_ON_ONCE() check in __perf_event_enable() for valid
    scenario
    - LP: #1214956
  * perf: Fix perf_lock_task_context() vs RCU
    - LP: #1214956
  * ext4: don't allow ext4_free_blocks() to fail due to ENOMEM
    - LP: #1214956
  * drm/radeon/hdmi: make sure we have an afmt block assigned
    - LP: #1214956
  * ACPI / memhotplug: Fix a stale pointer in error path
    - LP: #1214956
  * PM / Sleep: avoid 'autosleep' in shutdown progress
    - LP: #1214956
  * radeon kms: do not flush uninitialized hotplug work
    - LP: #1214956
  * svcrdma: underflow issue in decode_write_list()
    - LP: #1214956
  * ALSA: asihpi: Fix unlocked snd_pcm_stop() call
    - LP: #1214956
  * ALSA: atiixp: Fix unlocked snd_pcm_stop() call
    - LP: #1214956
  * ALSA: 6fire: Fix unlocked snd_pcm_stop() call
    - LP: #1214956
  * ALSA: ua101: Fix unlocked snd_pcm_stop() call
    - LP...