Bug #714846 “CVE-2010-4242” : Bugs : linux package : Ubuntu

Revision history for this message

Brad Figg (brad-figg) wrote on 2011-02-07:

#1

The upstream commit for this patch is: c19483cc5e56ac5e22dd19cf25ba210ab1537773

security vulnerability:

no → yes

Brad Figg (brad-figg) on 2011-02-07

Changed in linux (Ubuntu Natty):
status:	New → Fix Released
Changed in linux (Ubuntu Maverick):
status:	New → Fix Released
Changed in linux (Ubuntu Lucid):
status:	New → Fix Released
Changed in linux (Ubuntu Karmic):
status:	New → In Progress
importance:	Undecided → Low
assignee:	nobody → Brad Figg (brad-figg)
Changed in linux (Ubuntu Hardy):
status:	New → In Progress
assignee:	nobody → Brad Figg (brad-figg)

Brad Figg (brad-figg) on 2011-02-07

Changed in linux (Ubuntu Hardy):
importance:	Undecided → Low

Brad Figg (brad-figg) on 2011-02-07

Changed in linux (Ubuntu Dapper):
status:	New → In Progress
assignee:	nobody → Brad Figg (brad-figg)
importance:	Undecided → Low

Revision history for this message

Brad Figg (brad-figg) wrote on 2011-02-09:

#2

0001-dapper.patch Edit (1.4 KiB, text/plain)

Revision history for this message

Brad Figg (brad-figg) wrote on 2011-02-09:

#3

0002-hardy.patch Edit (1.4 KiB, text/plain)

Revision history for this message

Brad Figg (brad-figg) wrote on 2011-02-09:

#4

0003-karmic.patch Edit (1.4 KiB, text/plain)

Brad Figg (brad-figg) on 2011-02-11

description:

updated

Revision history for this message

Launchpad Janitor (janitor) wrote on 2011-03-17:

#5

This bug was fixed in the package linux - 2.6.31-23.74

---------------
linux (2.6.31-23.74) karmic-proposed; urgency=low

[ Steve Conklin ]

* Release Tracking Bug
- LP: #725232

[ Upstream Kernel Changes ]

  * bluetooth: Fix missing NULL check, CVE-2010-4242
    - LP: #714846
    - CVE-2010-4242
  * bio: take care not overflow page count when mapping/copying user data,
    CVE-2010-4162
    - LP: #721441
    - CVE-2010-4162
  * filter: make sure filters dont read uninitialized memory
    - LP: #721282
    - CVE-2010-4158
  * tty: Make tiocgicount a handler, CVE-2010-4076, CVE-2010-4077
    - LP: #720189
    - CVE-2010-4077
  * block: check for proper length of iov entries in blk_rq_map_user_iov(),
    CVE-2010-4163
    - LP: #721504
    - CVE-2010-4163
  * block: check for proper length of iov entries earlier in
    blk_rq_map_user_iov(), CVE-2010-4163
    - LP: #721504
    - CVE-2010-4163
  * rds: Integer overflow in RDS cmsg handling, CVE-2010-4175
    - LP: #721455
    - CVE-2010-4175
-- Steve Conklin <email address hidden> Fri, 25 Feb 2011 14:20:16 -0600

Changed in linux (Ubuntu Karmic):
status:	In Progress → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2011-04-04:

#6

This bug was fixed in the package linux - 2.6.24-29.88

---------------
linux (2.6.24-29.88) hardy-proposed; urgency=low

[ Brad Figg ]

* Release Tracking Bug
- LP: #736290

[Steve Conklin]

* Ubuntu-2.6.24-29.87
* [Config] Allow insertchanges to work in later version chroots

[Upstream Kernel Changes]

  * do_exit(): make sure that we run with get_fs() == USER_DS,
    CVE-2010-4258
    - LP: #723945
    - CVE-2010-4258
  * Make the bulkstat_one compat ioctl handling more sane
    - LP: #692848
  * Fix xfs_bulkstat_one size checks & error handling
    - LP: #692848
  * xfs: always use iget in bulkstat
    - LP: #692848
  * x25: Prevent crashing when parsing bad X.25 facilities CVE-2010-4164
    - LP: #731199
    - CVE-2010-4164
  * Revised [CVE-2010-4346 Hardy] install_special_mapping skips
    security_file_mmap check. CVE-2010-4346
    - LP: #731971
    - CVE-2010-4346

linux (2.6.24-29.87) hardy-proposed; urgency=low

[ Steve Conklin ]

* Release Tracking Bug
- LP: #725138

[Upstream Kernel Changes]

  * bluetooth: Fix missing NULL check, CVE-2010-4242
    - LP: #714846
    - CVE-2010-4242
  * NFS: fix the return value of nfs_file_fsync()
    - LP: #585657
  * bio: take care not overflow page count when mapping/copying user data,
    CVE-2010-4162
    - LP: #721441
    - CVE-2010-4162
  * filter: make sure filters dont read uninitialized memory
    - LP: #721282
    - CVE-2010-4158
  * tty: Make tiocgicount a handler, CVE-2010-4076, CVE-2010-4077
    - LP: #720189
    - CVE-2010-4077
  * block: check for proper length of iov entries earlier in
    blk_rq_map_user_iov(), CVE-2010-4163
    - LP: #721504
    - CVE-2010-4163
-- Brad Figg <email address hidden> Wed, 16 Mar 2011 09:43:35 -0700

Changed in linux (Ubuntu Hardy):
status:	In Progress → Fix Released

Paolo Pisati (p-pisati) on 2011-06-10

Changed in linux-ti-omap4 (Ubuntu):
status:	New → Invalid
Changed in linux-ti-omap4 (Ubuntu Dapper):
status:	New → Invalid
Changed in linux-ti-omap4 (Ubuntu Hardy):
status:	New → Invalid
Changed in linux-ti-omap4 (Ubuntu Karmic):
status:	New → Invalid
Changed in linux-ti-omap4 (Ubuntu Lucid):
status:	New → Invalid
Changed in linux-ti-omap4 (Ubuntu Natty):
status:	New → Fix Released
Changed in linux-ti-omap4 (Ubuntu Maverick):
status:	New → In Progress
assignee:	nobody → Paolo Pisati (p-pisati)

Paolo Pisati (p-pisati) on 2011-06-20

Changed in linux-fsl-imx51 (Ubuntu):
status:	New → Invalid
Changed in linux-fsl-imx51 (Ubuntu Dapper):
status:	New → Invalid
Changed in linux-fsl-imx51 (Ubuntu Hardy):
status:	New → Invalid
Changed in linux-fsl-imx51 (Ubuntu Karmic):
status:	New → Invalid
Changed in linux-fsl-imx51 (Ubuntu Maverick):
status:	New → Invalid
Changed in linux-fsl-imx51 (Ubuntu Natty):
status:	New → Invalid
Changed in linux-fsl-imx51 (Ubuntu Lucid):
assignee:	nobody → Paolo Pisati (p-pisati)
status:	New → In Progress

Tim Gardner (timg-tpi) on 2011-06-22

Changed in linux-fsl-imx51 (Ubuntu Lucid):
status:	In Progress → Fix Committed

Andy Whitcroft (apw) on 2011-07-07

tags:

added: kernel-cve-tracking-bug
removed: kernel-cve-tracker

Revision history for this message

Launchpad Janitor (janitor) wrote on 2011-09-13:

#7

Download full text (6.2 KiB)

This bug was fixed in the package linux-fsl-imx51 - 2.6.31-610.28

---------------
linux-fsl-imx51 (2.6.31-610.28) lucid-proposed; urgency=low

* Release tracking bug
- LP: #837802

[ Upstream Kernel Changes ]

  * ipv6: make fragment identifications less predictable, CVE-2011-2699
    - LP: #827685
    - CVE-2011-2699
  * perf: Fix software event overflow, CVE-2011-2918
    - LP: #834121
    - CVE-2011-2918
  * proc: fix oops on invalid /proc/<pid>/maps access, CVE-2011-1020
    - LP: #813026
    - CVE-2011-1020

linux-fsl-imx51 (2.6.31-610.27) lucid-proposed; urgency=low

* Release tracking bug
- LP: #829160

[ Upstream Kernel Changes ]

  * fs/partitions/efi.c: corrupted GUID partition tables can cause kernel
    oops
    - LP: #795418
    - CVE-2011-1577
  * Fix corrupted OSF partition table parsing
    - LP: #796606
    - CVE-2011-1163
  * can: Add missing socket check in can/bcm release.
    - LP: #796502
    - CVE-2011-1598
  * proc: protect mm start_code/end_code in /proc/pid/stat
    - LP: #799906
    - CVE-2011-0726
  * sctp: Fix a race between ICMP protocol unreachable and connect()
  * tty: Make tiocgicount a handler, CVE-2010-4076, CVE-2010-4077
    - LP: #794034
    - CVE-2010-4077
  * filter: make sure filters dont read uninitialized memory CVE-2010-4158
    - LP: #721282
    - CVE-2010-4158
  * bio: take care not overflow page count when mapping/copying user data
    CVE-2010-4162
    - LP: #721441
    - CVE-2010-4162
  * block: check for proper length of iov entries in blk_rq_map_user_iov()
    - LP: #721504
    - CVE-2010-4163
  * block: check for proper length of iov entries earlier in
    blk_rq_map_user_iov(), CVE-2010-4163
    - LP: #721504
    - CVE-2010-4163
  * rds: Integer overflow in RDS cmsg handling, CVE-2010-4175
    - LP: #721455
    - CVE-2010-4175
  * bluetooth: Fix missing NULL check CVE-2010-4242
    - LP: #714846
    - CVE-2010-4242
  * IB/uverbs: Handle large number of entries in poll CQ CVE-2010-4649
    - LP: #800121
    - CVE-2010-4649
  * epoll: prevent creating circular epoll structures CVE-2011-1082
    - LP: #800758
    - CVE-2011-1082
  * nfs4: Ensure that ACL pages sent over NFS were not allocated from the
    slab (v3) CVE-2011-1090
    - LP: #800775
  * ldm: corrupted partition table can cause kernel oops CVE-2011-1012
    - LP: #801083
    - CVE-2011-1012
  * netfilter: ipt_CLUSTERIP: fix buffer overflow CVE-2011-2534
    - LP: #801473
    - CVE-2011-2534
  * netfilter: arp_tables: fix infoleak to userspace CVE-2011-1170
    - LP: #801480
    - CVE-2011-1170
  * netfilter: ip_tables: fix infoleak to userspace CVE-2011-1171
    - LP: #801482
    - CVE-2011-1171
  * ipv6: netfilter: ip6_tables: fix infoleak to userspace CVE-2011-1172
    - LP: #801483
    - CVE-2011-1172
  * econet: 4 byte infoleak to the network CVE-2011-1173
    - LP: #801484
    - CVE-2011-1173
  * net: Limit socket I/O iovec total length to INT_MAX.
    - LP: #708839
  * fs/partitions: Validate map_count in Mac partition tables -
    CVE-2011-1010
    - LP: #804225
    - CVE-2011-1010
  * drm: fix unsigned vs signed comparison issue in modeset ctl ioctl,
    CVE-2011-1013
    - LP: #804229
    - CVE-2011-1013
...

This bug was fixed in the package linux-fsl-imx51 - 2.6.31-610.28

---------------
linux-fsl-imx51 (2.6.31-610.28) lucid-proposed; urgency=low

* Release tracking bug
    - LP: #837802

[ Upstream Kernel Changes ]

* ipv6: make fragment identifications less predictable, CVE-2011-2699
    - LP: #827685
    - CVE-2011-2699
  * perf: Fix software event overflow, CVE-2011-2918
    - LP: #834121
    - CVE-2011-2918
  * proc: fix oops on invalid /proc/<pid>/maps access, CVE-2011-1020
    - LP: #813026
    - CVE-2011-1020

linux-fsl-imx51 (2.6.31-610.27) lucid-proposed; urgency=low

* Release tracking bug
    - LP: #829160

[ Upstream Kernel Changes ]

* fs/partitions/efi.c: corrupted GUID partition tables can cause kernel
    oops
    - LP: #795418
    - CVE-2011-1577
  * Fix corrupted OSF partition table parsing
    - LP: #796606
    - CVE-2011-1163
  * can: Add missing socket check in can/bcm release.
    - LP: #796502
    - CVE-2011-1598
  * proc: protect mm start_code/end_code in /proc/pid/stat
    - LP: #799906
    - CVE-2011-0726
  * sctp: Fix a race between ICMP protocol unreachable and connect()
  * tty: Make tiocgicount a handler, CVE-2010-4076, CVE-2010-4077
    - LP: #794034
    - CVE-2010-4077
  * filter: make sure filters dont read uninitialized memory CVE-2010-4158
    - LP: #721282
    - CVE-2010-4158
  * bio: take care not overflow page count when mapping/copying user data
    CVE-2010-4162
    - LP: #721441
    - CVE-2010-4162
  * block: check for proper length of iov entries in blk_rq_map_user_iov()
    - LP: #721504
    - CVE-2010-4163
  * block: check for proper length of iov entries earlier in
    blk_rq_map_user_iov(), CVE-2010-4163
    - LP: #721504
    - CVE-2010-4163
  * rds: Integer overflow in RDS cmsg handling, CVE-2010-4175
    - LP: #721455
    - CVE-2010-4175
  * bluetooth: Fix missing NULL check CVE-2010-4242
    - LP: #714846
    - CVE-2010-4242
  * IB/uverbs: Handle large number of entries in poll CQ CVE-2010-4649
    - LP: #800121
    - CVE-2010-4649
  * epoll: prevent creating circular epoll structures CVE-2011-1082
    - LP: #800758
    - CVE-2011-1082
  * nfs4: Ensure that ACL pages sent over NFS were not allocated from the
    slab (v3) CVE-2011-1090
    - LP: #800775
  * ldm: corrupted partition table can cause kernel oops CVE-2011-1012
    - LP: #801083
    - CVE-2011-1012
  * netfilter: ipt_CLUSTERIP: fix buffer overflow CVE-2011-2534
    - LP: #801473
    - CVE-2011-2534
  * netfilter: arp_tables: fix infoleak to userspace CVE-2011-1170
    - LP: #801480
    - CVE-2011-1170
  * netfilter: ip_tables: fix infoleak to userspace CVE-2011-1171
    - LP: #801482
    - CVE-2011-1171
  * ipv6: netfilter: ip6_tables: fix infoleak to userspace CVE-2011-1172
    - LP: #801483
    - CVE-2011-1172
  * econet: 4 byte infoleak to the network CVE-2011-1173
    - LP: #801484
    - CVE-2011-1173
  * net: Limit socket I/O iovec total length to INT_MAX.
    - LP: #708839
  * fs/partitions: Validate map_count in Mac partition tables -
    CVE-2011-1010
    - LP: #804225
    - CVE-2011-1010
  * drm: fix unsigned vs signed comparison issue in modeset ctl ioctl,
    CVE-2011-1013
    - LP: #804229
    - CVE-2011-1013
  * exec: copy-and-paste the fixes into compat_do_execve() paths -
    CVE-2010-4243
    - LP: #804234
    - CVE-2010-4243
  * taskstats: don't allow duplicate entries in listener mode,
    CVE-2011-2484
    - LP: #806390
    - CVE-2011-2484
  * dccp: handle invalid feature options length, CVE-2011-1770
    - LP: #806375
    - CVE-2011-1770
  * pagemap: close races with suid execve, CVE-2011-1020
    - LP: #813026
    - CVE-2011-1020
  * report errors in /proc/*/*map* sanely, CVE-2011-1020
    - LP: #813026
    - CVE-2011-1020
  * close race in /proc/*/environ, CVE-2011-1020
    - LP: #813026
    - CVE-2011-1020
  * auxv: require the target to be tracable (or yourself), CVE-2011-1020
    - LP: #813026
    - CVE-2011-1020
  * deal with races in /proc/*/{syscall, stack, personality}, CVE-2011-1020
    - LP: #813026
    - CVE-2011-1020
  * dccp: fix oops on Reset after close, CVE-2011-1093
    - LP: #814087
    - CVE-2011-1093
  * net: add limit for socket backlog CVE-2010-4251
    - LP: #807462
  * tcp: use limited socket backlog CVE-2010-4251
    - LP: #807462
  * ipv6: udp: Optimise multicast reception
    - LP: #807462
  * ipv4: udp: Optimise multicast reception
    - LP: #807462
  * udp: multicast RX should increment SNMP/sk_drops counter in allocation
    failures CVE-2010-4251
    - LP: #807462
  * udp: use limited socket backlog CVE-2010-4251
    - LP: #807462
  * llc: use limited socket backlog CVE-2010-4251
    - LP: #807462
  * sctp: use limited socket backlog CVE-2010-4251
    - LP: #807462
  * tipc: use limited socket backlog CVE-2010-4251
    - LP: #807462
  * x25: use limited socket backlog CVE-2010-4251
    - LP: #807462
  * net: backlog functions rename CVE-2010-4251
    - LP: #807462
  * net: sk_add_backlog() take rmem_alloc into account CVE-2010-4805
    - LP: #809318
  * Bluetooth: sco: fix information leak to userspace, CVE-2011-1078
    - LP: #816542
    - CVE-2011-1078
  * Bluetooth: bnep: fix buffer overflow, CVE-2011-1079
    - LP: #816544
    - CVE-2011-1079
  * bridge: netfilter: fix information leak, CVE-2011-1080
    - LP: #816545
    - CVE-2011-1080
  * char/tpm: Fix unitialized usage of data buffer, CVE-2011-1160
    - LP: #816546
    - CVE-2011-1160
  * irda: validate peer name and attribute lengths, CVE-2011-1180
    - LP: #816547
    - CVE-2011-1180
  * gro: Reset dev pointer on reuse, CVE-2011-1478
    - LP: #816549
    - CVE-2011-1478
  * gro: reset skb_iif on reuse, CVE-2011-1478
    - LP: #816549
    - CVE-2011-1478
  * rose_loopback_timer sets VC number <= ROSE_DEFAULT_MAXVC, CVE-2011-1493
    - LP: #816550
    - CVE-2011-1493
  * ROSE: prevent heap corruption with bad facilities, CVE-2011-1493
    - LP: #816550
    - CVE-2011-1493
  * rose: Add length checks to CALL_REQUEST parsing, CVE-2011-1493
    - LP: #816550
    - CVE-2011-1493
  * Bluetooth: l2cap and rfcomm: fix 1 byte infoleak to userspace.
    - LP: #819569
    - CVE-2011-2492
  * Add mount option to check uid of device being mounted = expect uid,
    CVE-2011-1833
    - LP: #732628
    - CVE-2011-1833
 -- Paolo Pisati <paolo.pisati@canonical.com>   Wed, 31 Aug 2011 10:26:26 +0200

Changed in linux-fsl-imx51 (Ubuntu Lucid):
status:	Fix Committed → Fix Released

Jamie Strandboge (jdstrand) on 2011-10-14

Changed in linux (Ubuntu Dapper):
status:	In Progress → Won't Fix

Jamie Strandboge (jdstrand) on 2013-05-21

Changed in linux-ti-omap4 (Ubuntu Maverick):
status:	In Progress → Won't Fix

Ubuntu
linux package

CVE-2010-4242

Bug Description

Related branches

CVE References

Other bug subscribers

Patches

Remote bug watches

	Status	Importance	Assigned to
linux (Ubuntu)	Fix Released	Undecided	Unassigned
Dapper	Won't Fix	Low	Brad Figg
Hardy	Fix Released	Low	Brad Figg
Karmic	Fix Released	Low	Brad Figg
Lucid	Fix Released	Undecided	Unassigned
Maverick	Fix Released	Undecided	Unassigned
Natty	Fix Released	Undecided	Unassigned
linux-fsl-imx51 (Ubuntu)	Invalid	Undecided	Unassigned
Dapper	Invalid	Undecided	Unassigned
Hardy	Invalid	Undecided	Unassigned
Karmic	Invalid	Undecided	Unassigned
Lucid	Fix Released	Undecided	Paolo Pisati
Maverick	Invalid	Undecided	Unassigned
Natty	Invalid	Undecided	Unassigned
linux-ti-omap4 (Ubuntu)	Invalid	Undecided	Unassigned
Dapper	Invalid	Undecided	Unassigned
Hardy	Invalid	Undecided	Unassigned
Karmic	Invalid	Undecided	Unassigned
Lucid	Invalid	Undecided	Unassigned
Maverick	Won't Fix	Undecided	Paolo Pisati
Natty	Fix Released	Undecided	Unassigned

Ubuntulinux package

CVE-2010-4242

Bug Description

Related branches

CVE References

Other bug subscribers

Patches

Remote bug watches

Ubuntu
linux package