CVE-2012-2100

[Andy Whitcroft]

The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 3.2.2, on the x86 platform and unspecified other platforms, allows user-assisted remote attackers to trigger inconsistent filesystem-groups data and possibly cause a denial of service via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value). NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-4307.

Break-Fix: 503358ae01b70ce6909d19dd01287093f6b6271c d50f2ab6f050311dbf7b8f5501b25f0bf64a439b

[Andy Whitcroft (apw)]

CVE-2012-2100

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 2.6.38-15.59

---------------
linux (2.6.38-15.59) natty-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #987281

  [ Brad Figg ]

  * SAUCE (no-up) Provide a param for allowing the BIOS to handle changing
    the brightness on AC/battery status changes.
    - LP: #949311

  [ Tim Gardner ]

  * SAUCE: ubuntu drivers: use UMH_WAIT_PROC consistently
    - LP: #963685
  * SAUCE: disable_nx should not be in __cpuinitdata section for X86_32
    - LP: #968233
  * SAUCE: (no-up) remove __initdata from vesafb_fix
    - LP: #969309

  [ Upstream Kernel Changes ]

  * usermodehelper: use UMH_WAIT_PROC consistently
    - LP: #963685
  * usermodehelper: introduce umh_complete(sub_info)
    - LP: #963685
  * usermodehelper: implement UMH_KILLABLE
    - LP: #963685
  * usermodehelper: kill umh_wait, renumber UMH_* constants
    - LP: #963685
  * usermodehelper: ____call_usermodehelper() doesn't need do_exit()
    - LP: #963685
  * kmod: introduce call_modprobe() helper
    - LP: #963685
  * kmod: make __request_module() killable
    - LP: #963685
  * drm/i915: Fixes distorted external screen image on HP 2730p
    - LP: #796030
  * ext4: fix undefined behavior in ext4_fill_flex_info()
    - LP: #984757
    - CVE-2012-2100
  * jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer
    - LP: #929781
    - CVE-2011-4086
  * cifs: fix dentry refcount leak when opening a FIFO on lookup
    - LP: #947997
    - CVE-2012-1090
 -- Luis Henriques <email address hidden> Mon, 23 Apr 2012 14:02:53 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-lts-backport-natty - 2.6.38-15.59~lucid1

---------------
linux-lts-backport-natty (2.6.38-15.59~lucid1) lucid-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #990208

  [ Brad Figg ]

  * SAUCE (no-up) Provide a param for allowing the BIOS to handle changing
    the brightness on AC/battery status changes.
    - LP: #949311

  [ Tim Gardner ]

  * SAUCE: ubuntu drivers: use UMH_WAIT_PROC consistently
    - LP: #963685
  * SAUCE: disable_nx should not be in __cpuinitdata section for X86_32
    - LP: #968233
  * SAUCE: (no-up) remove __initdata from vesafb_fix
    - LP: #969309

  [ Upstream Kernel Changes ]

  * usermodehelper: use UMH_WAIT_PROC consistently
    - LP: #963685
  * usermodehelper: introduce umh_complete(sub_info)
    - LP: #963685
  * usermodehelper: implement UMH_KILLABLE
    - LP: #963685
  * usermodehelper: kill umh_wait, renumber UMH_* constants
    - LP: #963685
  * usermodehelper: ____call_usermodehelper() doesn't need do_exit()
    - LP: #963685
  * kmod: introduce call_modprobe() helper
    - LP: #963685
  * kmod: make __request_module() killable
    - LP: #963685
  * drm/i915: Fixes distorted external screen image on HP 2730p
    - LP: #796030
  * ext4: fix undefined behavior in ext4_fill_flex_info()
    - LP: #984757
    - CVE-2012-2100
  * jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer
    - LP: #929781
    - CVE-2011-4086
  * cifs: fix dentry refcount leak when opening a FIFO on lookup
    - LP: #947997
    - CVE-2012-1090
 -- Luis Henriques <email address hidden> Mon, 30 Apr 2012 09:52:55 +0100

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 2.6.38-1209.24

---------------
linux-ti-omap4 (2.6.38-1209.24) natty-proposed; urgency=low

  * Release Tracking Bug
    - LP: #990206

  [ Upstream Kernel Changes ]

  * ext4: fix undefined behavior in ext4_fill_flex_info()
    - LP: #984757
    - CVE-2012-2100
  * jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer
    - LP: #929781
    - CVE-2011-4086
  * cifs: fix dentry refcount leak when opening a FIFO on lookup
    - LP: #947997
    - CVE-2012-1090
 -- Paolo Pisati <email address hidden> Fri, 30 Apr 2012 10:12:35 +0200

[Ike Panhc (ikepanhc)]

Patch 503358ae01b70ce6909d19dd01287093f6b6271c d50f2ab6f050311dbf7b8f5501b25f0bf64a439b already in upstream 3.5

[Ike Panhc (ikepanhc)]

03358ae01b70ce6909d19dd01287093f6b6271c ext4: avoid divide by zero when trying to mount a corrupted file system in upstream 2.6.32-rc8
e2860111eaf589699ff399191dd13b5d3409ef2b ext4: fix undefined behavior in ext4_fill_flex_info() is in linux-armadaxp through 3.2.2 and Ubuntu-3.2.0-12.20

[Andy Whitcroft (apw)]

This bug was nominated against a series that is no longer supported, ie vivid. The bug task representing the vivid nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.