CVE-2013-4588

[John Johansen]

Multiple stack-based buffer overflows in net/netfilter/ipvs/ip_vs_ctl.c in the Linux kernel before 2.6.33, when CONFIG_IP_VS is used, allow local users to gain privileges by leveraging the CAP_NET_ADMIN capability for (1) a getsockopt system call, related to the do_ip_vs_get_ctl function, or (2) a setsockopt system call, related to the do_ip_vs_set_ctl function. A user/program with CAP_NET_ADMIN privileges could use this flaw to further escalate their privileges on a system.

Break-Fix: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 04bcef2a83f40c6db24222b27a52892cba39dffb

[John Johansen (jjohansen)]

CVE-2013-4588

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 2.6.32-55.117

---------------
linux (2.6.32-55.117) lucid; urgency=low

  [Steve Conklin]

  * Release Tracking Bug
    - LP: #1257364

  [ Upstream Kernel Changes ]

  * ipvs: Add boundary check on ioctl arguments
    - LP: #1252424
    - CVE-2013-4588
  * vm: add vm_iomap_memory() helper function
    - LP: #1252426
    - CVE-2013-6763
  * Fix a few incorrectly checked [io_]remap_pfn_range() calls
    - LP: #1252426
    - CVE-2013-6763
  * crypto: ansi_cprng - Fix off by one error in non-block size request
    - LP: #1229981
    - CVE-2013-4345
  * libertas: potential oops in debugfs
    - LP: #1256080
    - CVE-2013-6378
 -- Steve Conklin <email address hidden> Tue, 03 Dec 2013 10:26:46 -0600

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ec2 - 2.6.32-360.73

---------------
linux-ec2 (2.6.32-360.73) lucid-proposed; urgency=low

  [ Stefan Bader ]

  * Rebased to Ubuntu-2.6.32-55.117
  * Release Tracking Bug
    - LP: #1257527

  [ Ubuntu: 2.6.32-55.117 ]

  * ipvs: Add boundary check on ioctl arguments
    - LP: #1252424
    - CVE-2013-4588
  * vm: add vm_iomap_memory() helper function
    - LP: #1252426
    - CVE-2013-6763
  * Fix a few incorrectly checked [io_]remap_pfn_range() calls
    - LP: #1252426
    - CVE-2013-6763
  * crypto: ansi_cprng - Fix off by one error in non-block size request
    - LP: #1229981
    - CVE-2013-4345
  * libertas: potential oops in debugfs
    - LP: #1256080
    - CVE-2013-6378
 -- Stefan Bader <email address hidden> Wed, 04 Dec 2013 14:12:21 +0100