Ubuntu
linux-ti-omap4 package

CVE-2010-4157

  1. Dapper (6.06)
  2. Bug #711797
Bug #711797 reported by Andy Whitcroft
258
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Invalid
Medium
Andy Whitcroft
Dapper
Won't Fix
Medium
Andy Whitcroft
Hardy
Fix Released
Medium
Andy Whitcroft
Karmic
Fix Released
Medium
Andy Whitcroft
Lucid
Fix Released
Medium
Andy Whitcroft
Maverick
Fix Released
Medium
Andy Whitcroft
Natty
Invalid
Medium
Andy Whitcroft
linux-fsl-imx51 (Ubuntu)
Invalid
Undecided
Unassigned
Dapper
Invalid
Undecided
Unassigned
Hardy
Invalid
Undecided
Unassigned
Karmic
Won't Fix
Undecided
Unassigned
Lucid
Fix Released
Undecided
Unassigned
Maverick
Invalid
Undecided
Unassigned
Natty
Invalid
Undecided
Unassigned
linux-ti-omap4 (Ubuntu)
Invalid
Undecided
Unassigned
Dapper
Invalid
Undecided
Unassigned
Hardy
Invalid
Undecided
Unassigned
Karmic
Invalid
Undecided
Unassigned
Lucid
Invalid
Undecided
Unassigned
Maverick
Won't Fix
Undecided
Unassigned
Natty
Invalid
Undecided
Unassigned

Bug Description

Integer overflow in the ioc_general function in drivers/scsi/gdth.c in the
Linux kernel before 2.6.36.1 on 64-bit platforms allows local users to
cause a denial of service (memory corruption) or possibly have unspecified
other impact via a large argument in an ioctl call.

Revision history for this message
Andy Whitcroft (apw) wrote :

Upstream commit as below:

  commit f63ae56e4e97fb12053590e41a4fa59e7daa74a4
  Author: Dan Carpenter <email address hidden>
  Date: Fri Oct 8 09:03:07 2010 +0200

    [SCSI] gdth: integer overflow in ioctl

    gdth_ioctl_alloc() takes the size variable as an int.
    copy_from_user() takes the size variable as an unsigned long.
    gen.data_len and gen.sense_len are unsigned longs.
    On x86_64 longs are 64 bit and ints are 32 bit.

    We could pass in a very large number and the allocation would truncate
    the size to 32 bits and allocate a small buffer. Then when we do the
    copy_from_user(), it would result in a memory corruption.

    CC: <email address hidden>
    Signed-off-by: Dan Carpenter <email address hidden>
    Signed-off-by: James Bottomley <email address hidden>

visibility: private → public
Revision history for this message
Andy Whitcroft (apw) wrote :

As this was in v2.6.37-rc1 Natty is not affected.

Changed in linux (Ubuntu Natty):
status: New → Invalid
Changed in linux (Ubuntu Maverick):
status: New → Fix Released
Changed in linux (Ubuntu Natty):
importance: Undecided → Medium
Changed in linux (Ubuntu Maverick):
importance: Undecided → Medium
Changed in linux (Ubuntu Lucid):
importance: Undecided → Medium
Changed in linux (Ubuntu Dapper):
importance: Undecided → Medium
Changed in linux (Ubuntu Maverick):
assignee: nobody → Andy Whitcroft (apw)
Changed in linux (Ubuntu Karmic):
importance: Undecided → Medium
Changed in linux (Ubuntu Natty):
assignee: nobody → Andy Whitcroft (apw)
Changed in linux (Ubuntu Hardy):
importance: Undecided → Medium
Changed in linux (Ubuntu Lucid):
status: New → Fix Released
assignee: nobody → Andy Whitcroft (apw)
Changed in linux (Ubuntu Karmic):
status: New → In Progress
assignee: nobody → Andy Whitcroft (apw)
Revision history for this message
Andy Whitcroft (apw) wrote :

This patch has already hit Maverick and Lucid via the mainline stable process. Closing there.

Andy Whitcroft (apw)
Changed in linux (Ubuntu Hardy):
status: New → In Progress
assignee: nobody → Andy Whitcroft (apw)
Changed in linux (Ubuntu Dapper):
assignee: nobody → Andy Whitcroft (apw)
status: New → In Progress
Revision history for this message
Andy Whitcroft (apw) wrote :

Patches for Dapper, Hardy and Karmic have been pushed out for review.

Andy Whitcroft (apw)
Changed in linux (Ubuntu Hardy):
status: In Progress → Fix Committed
Changed in linux (Ubuntu Karmic):
status: In Progress → Fix Committed
Changed in linux (Ubuntu Dapper):
status: In Progress → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (4.0 KiB)

This bug was fixed in the package linux - 2.6.24-28.86

---------------
linux (2.6.24-28.86) hardy-proposed; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #716166

  [Tim Gardner]

  * xen unified block-device I/O interface back end can orphan devices,
    CVE-2010-3699
    - LP: #708019
    - CVE-2010-3699

  [Upstream Kernel Changes]

  * Hardy SRU: thinkpad-acpi: lock down video output state access,
    CVE-2010-3448
    - LP: #706999
    - CVE-2010-3448
  * net: Limit socket I/O iovec total length to INT_MAX., CVE-2010-3859
    - LP: #711855, #708839
    - CVE-2010-4160
  * net: Truncate recvfrom and sendto length to INT_MAX., CVE-2010-3859
    - LP: #711855, #708839
    - CVE-2010-4160
  * net: ax25: fix information leak to userland, CVE-2010-3875
    - LP: #710714
    - CVE-2010-3875
  * net: ax25: fix information leak to userland harder, CVE-2010-3875
    - LP: #710714
    - CVE-2010-3875
  * memory corruption in X.25 facilities parsing, CVE-2010-3873
    - LP: #709372
    - CVE-2010-3873
  * net: packet: fix information leak to userland, CVE-2010-3876
    - LP: #710714
    - CVE-2010-3876
  * net: tipc: fix information leak to userland, CVE-2010-3877
    - LP: #711291
    - CVE-2010-3877
  * KVM: VMX: fix vmx null pointer dereference on debug register access,
    CVE-2010-0435
    - LP: #712615
    - CVE-2010-0435
  * gdth: integer overflow in ioctl, CVE-2010-4157
    - LP: #711797
    - CVE-2010-4157
  * posix-cpu-timers: workaround to suppress the problems with mt exec,
    CVE-2010-4248
    - LP: #712609
    - CVE-2010-4248
  * ALSA: sound/pci/rme9652: prevent reading uninitialized stack memory,
    CVE-2010-4080, CVE-2010-4081
    - LP: #712723, #712737
    - CVE-2010-4081
  * sys_semctl: fix kernel stack leakage, CVE-2010-4083
    - LP: #712749
    - CVE-2010-4083
  * inet_diag: Make sure we actually run the same bytecode we audited,
    CVE-2010-3880
    - LP: #711865
    - CVE-2010-3880

linux (2.6.24-28.85) hardy-proposed; urgency=low

  [ Brad Figg ]

  * Tracking Bug
    - LP: #708315

  [Upstream Kernel Changes]

  * ata_piix: IDE mode SATA patch for Intel ICH10 DeviceID's
    - LP: #693401
  * USB: serial/mos*: prevent reading uninitialized stack memory,
    CVE-2010-4074
    - LP: #706149
    - CVE-2010-4074
  * KVM: Fix fs/gs reload oops with invalid ldt
    - LP: #707000
    - CVE-2010-3698
  * drivers/video/sis/sis_main.c: prevent reading uninitialized stack
    memory, CVE-2010-4078
    - LP: #707579
    - CVE-2010-4078
  * V4L/DVB: ivtvfb: prevent reading uninitialized stack memory,
    CVE-2010-4079
    - LP: #707649
    - CVE-2010-4079

linux (2.6.24-28.84) hardy-proposed; urgency=low

  [ Steve Conklin ]

  * Tracking Bug
    - LP: #698185

linux (2.6.24-28.83) hardy-proposed; urgency=low

  [ Steve Conklin ]
  * tracking bug moved from here to latest entry

linux (2.6.24-28.82) hardy-proposed; urgency=low

  [ Leann Ogasawara ]

  * Revert "SAUCE: AF_ECONET saddr->cookie prevent NULL pointer
    dereference"
  * Revert "SAUCE: AF_ECONET SIOCSIFADDR ioctl does not check privileges"
  * Revert "SAUCE: AF_ECONET prevent kernel stack overflow"

  [Upstream Kernel Changes]

  * xfs: validate untrust...

Read more...

Changed in linux (Ubuntu Hardy):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (3.1 KiB)

This bug was fixed in the package linux - 2.6.31-22.73

---------------
linux (2.6.31-22.73) karmic-proposed; urgency=low

  [ Steve Conklin ]

  * Release Tracking Bug
    - LP: #716648

  [ Upstream Kernel Changes ]

  * copied ABI directory
  * net: Limit socket I/O iovec total length to INT_MAX., CVE-2010-3859
    - LP: #708839, #711855
    - CVE-2010-4160
  * net: Truncate recvfrom and sendto length to INT_MAX., CVE-2010-3859
    - LP: #708839, #711855
    - CVE-2010-4160
  * net: fix rds_iovec page count overflow, CVE-2010-3865
    - LP: #709153
    - CVE-2010-3865
  * net: ax25: fix information leak to userland, CVE-2010-3875
    - LP: #710714
    - CVE-2010-3875
  * net: ax25: fix information leak to userland harder, CVE-2010-3875
    - LP: #710714
    - CVE-2010-3875
  * can-bcm: fix minor heap overflow
    - LP: #710680
    - CVE-2010-3874
  * memory corruption in X.25 facilities parsing, CVE-2010-3873
    - LP: #709372
    - CVE-2010-3873
  * net: packet: fix information leak to userland, CVE-2010-3876
    - LP: #710714
    - CVE-2010-3876
  * net: tipc: fix information leak to userland, CVE-2010-3877
    - LP: #711291
    - CVE-2010-3877
  * KVM: VMX: fix vmx null pointer dereference on debug register access,
    CVE-2010-0435
    - LP: #712615
    - CVE-2010-0435
  * gdth: integer overflow in ioctl, CVE-2010-4157
    - LP: #711797
    - CVE-2010-4157
  * posix-cpu-timers: workaround to suppress the problems with mt exec,
    CVE-2010-4248
    - LP: #712609
    - CVE-2010-4248
  * ALSA: sound/pci/rme9652: prevent reading uninitialized stack memory,
    CVE-2010-4080, CVE-2010-4081
    - LP: #712723, #712737
    - CVE-2010-4081
  * drivers/video/via/ioctl.c: prevent reading uninitialized stack memory,
    CVE-2010-4082
    - LP: #712744
    - CVE-2010-4082
  * sys_semctl: fix kernel stack leakage, CVE-2010-4083
    - LP: #712749
    - CVE-2010-4083
  * inet_diag: Make sure we actually run the same bytecode we audited,
    CVE-2010-3880
    - LP: #711865
    - CVE-2010-3880

linux (2.6.31-22.72) karmic-proposed; urgency=low

  [ Brad Figg ]

  * Tracking Bug
    - LP: #708860

  [ Upstream Kernel Changes ]

  * Karmic SRU: thinkpad-acpi: lock down video output state access, CVE-2010-3448
    - LP: #706999
    - CVE-2010-3448
  * USB: serial/mos*: prevent reading uninitialized stack memory,
    CVE-2010-4074
    - LP: #706149
    - CVE-2010-4074
  * KVM: Fix fs/gs reload oops with invalid ldt
    - LP: #707000
    - CVE-2010-3698
  * drivers/video/sis/sis_main.c: prevent reading uninitialized stack
    memory, CVE-2010-4078
    - LP: #707579
    - CVE-2010-4078
  * V4L/DVB: ivtvfb: prevent reading uninitialized stack memory,
    CVE-2010-4079
    - LP: #707649
    - CVE-2010-4079

linux (2.6.31-22.71) karmic-proposed; urgency=low

  [ Brad Figg ]

  - LP: #698214

  [ Upstream Kernel Changes ]

  * ipc: initialize structure memory to zero for compat functions
  * tcp: Increase TCP_MAXSEG socket option minimum.
    - CVE-2010-4165
  * perf_events: Fix perf_counter_mmap() hook in mprotect()
    - CVE-2010-4169
  * af_unix: limit unix_tot_inflight
    - CVE-2010-4249
 -- Steve Conklin <email address hidden> Thu, 10 Feb 2011 13:49:49...

Read more...

Changed in linux (Ubuntu Karmic):
status: Fix Committed → Fix Released
Revision history for this message
Paolo Pisati (p-pisati) wrote :

karmic is EOL

Changed in linux-fsl-imx51 (Ubuntu):
status: New → Invalid
Changed in linux-fsl-imx51 (Ubuntu Dapper):
status: New → Invalid
Changed in linux-fsl-imx51 (Ubuntu Hardy):
status: New → Invalid
Changed in linux-fsl-imx51 (Ubuntu Maverick):
status: New → Invalid
Changed in linux-fsl-imx51 (Ubuntu Natty):
status: New → Invalid
Changed in linux-fsl-imx51 (Ubuntu Karmic):
status: New → Won't Fix
Changed in linux-fsl-imx51 (Ubuntu Lucid):
status: New → In Progress
Paolo Pisati (p-pisati)
Changed in linux-ti-omap4 (Ubuntu):
status: New → Invalid
Changed in linux-ti-omap4 (Ubuntu Dapper):
status: New → Invalid
Changed in linux-ti-omap4 (Ubuntu Hardy):
status: New → Invalid
Changed in linux-ti-omap4 (Ubuntu Karmic):
status: New → Invalid
Changed in linux-ti-omap4 (Ubuntu Lucid):
status: New → Invalid
Changed in linux-ti-omap4 (Ubuntu Natty):
status: New → Invalid
Changed in linux-ti-omap4 (Ubuntu Maverick):
status: New → In Progress
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (4.2 KiB)

This bug was fixed in the package linux-fsl-imx51 - 2.6.31-609.26

---------------
linux-fsl-imx51 (2.6.31-609.26) lucid; urgency=low

  [ Paolo Pisati ]

  * Tracking bug
    - LP: #795219
  * [Config] Disable parport_pc on fsl-imx51
    - LP: #601226

  [ Upstream Kernel Changes ]

  * ALSA: sound/pci/rme9652: prevent reading uninitialized stack memory
    - LP: #712723, #712737
  * can-bcm: fix minor heap overflow
    - LP: #710680
  * drivers/video/via/ioctl.c: prevent reading uninitialized stack memory
    - LP: #712744
  * gdth: integer overflow in ioctl
    - LP: #711797
  * inet_diag: Make sure we actually run the same bytecode we audited, CVE-2010-3880
    - LP: #711865
    - CVE-2010-3880
  * net: fix rds_iovec page count overflow, CVE-2010-3865
    - LP: #709153
    - CVE-2010-3865
  * net: packet: fix information leak to userland, CVE-2010-3876
    - LP: #711045
    - CVE-2010-3876
  * net: tipc: fix information leak to userland, CVE-2010-3877
    - LP: #711291
    - CVE-2010-3877
  * net: Truncate recvfrom and sendto length to INT_MAX.
    - LP: #708839
  * posix-cpu-timers: workaround to suppress the problems with mt exec
    - LP: #712609
  * sys_semctl: fix kernel stack leakage
    - LP: #712749
  * x25: Patch to fix bug 15678 - x25 accesses fields beyond end of packet.
    - LP: #709372
  * memory corruption in X.25 facilities parsing
    - LP: #709372
  * net: ax25: fix information leak to userland, CVE-2010-3875
    - LP: #710714
    - CVE-2010-3875
  * net: ax25: fix information leak to userland harder, CVE-2010-3875
    - LP: #710714
    - CVE-2010-3875
  * fs/partitions/ldm.c: fix oops caused by corrupted partition table, CVE-2011-1017
    - LP: #771382
    - CVE-2011-1017
  * net: clear heap allocations for privileged ethtool actions
    - LP: #771445
  * Prevent rt_sigqueueinfo and rt_tgsigqueueinfo from spoofing the signal code
    - LP: #772543
  * Relax si_code check in rt_sigqueueinfo and rt_tgsigqueueinfo
    - LP: #772543
  * exec: make argv/envp memory visible to oom-killer
    - LP: #768408
  * next_pidmap: fix overflow condition
    - LP: #784727
  * proc: do proper range check on readdir offset
    - LP: #784727
  * mpt2sas: prevent heap overflows and unchecked reads
    - LP: #787145
  * agp: fix arbitrary kernel memory writes
    - LP: #788684
  * can: add missing socket check in can/raw release
    - LP: #788694
  * agp: fix OOM and buffer overflow
    - LP: #788700
  * do_exit(): make sure that we run with get_fs() == USER_DS - CVE-2010-4258
    - LP: #723945
    - CVE-2010-4258
  * x25: Prevent crashing when parsing bad X.25 facilities - CVE-2010-4164
    - LP: #731199
    - CVE-2010-4164
  * install_special_mapping skips security_file_mmap check - CVE-2010-4346
    - LP: #731971
    - CVE-2010-4346
  * econet: Fix crash in aun_incoming() - CVE-2010-4342
    - LP: #736394
    - CVE-2010-4342
  * sound: Prevent buffer overflow in OSS load_mixer_volumes - CVE-2010-4527
    - LP: #737073
    - CVE-2010-4527
  * irda: prevent integer underflow in IRLMP_ENUMDEVICES, CVE-2010-4529
    - LP: #737823
    - CVE-2010-4529
  * CAN: Use inode instead of kernel address for /proc file - CVE-2010-4565
    - LP: #765007...

Read more...

Changed in linux-fsl-imx51 (Ubuntu Lucid):
status: In Progress → Fix Released
Andy Whitcroft (apw)
tags: added: kernel-cve-tracking-bug
removed: kernel-cve-tracker
Jamie Strandboge (jdstrand)
Changed in linux (Ubuntu Dapper):
status: Fix Committed → Won't Fix
Jamie Strandboge (jdstrand)
Changed in linux-ti-omap4 (Ubuntu Maverick):
status: In Progress → Won't Fix
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.