CVE-2010-4081

[Brad Figg]

ALSA: sound/pci/rme9652: prevent reading uninitialized stack memory

The SNDRV_HDSP_IOCTL_GET_CONFIG_INFO and
SNDRV_HDSP_IOCTL_GET_CONFIG_INFO ioctls in hdspm.c and hdsp.c allow
unprivileged users to read uninitialized kernel stack memory, because
several fields of the hdsp{m}_config_info structs declared on the stack
are not altered or zeroed before being copied back to the user. This
patch takes care of it.

[Brad Figg (brad-figg)]

The upstream commit for this patch is: e68d3b316ab7b02a074edc4f770e6a746390cb7d

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 2.6.24-28.86

---------------
linux (2.6.24-28.86) hardy-proposed; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #716166

  [Tim Gardner]

  * xen unified block-device I/O interface back end can orphan devices,
    CVE-2010-3699
    - LP: #708019
    - CVE-2010-3699

  [Upstream Kernel Changes]

  * Hardy SRU: thinkpad-acpi: lock down video output state access,
    CVE-2010-3448
    - LP: #706999
    - CVE-2010-3448
  * net: Limit socket I/O iovec total length to INT_MAX., CVE-2010-3859
    - LP: #711855, #708839
    - CVE-2010-4160
  * net: Truncate recvfrom and sendto length to INT_MAX., CVE-2010-3859
    - LP: #711855, #708839
    - CVE-2010-4160
  * net: ax25: fix information leak to userland, CVE-2010-3875
    - LP: #710714
    - CVE-2010-3875
  * net: ax25: fix information leak to userland harder, CVE-2010-3875
    - LP: #710714
    - CVE-2010-3875
  * memory corruption in X.25 facilities parsing, CVE-2010-3873
    - LP: #709372
    - CVE-2010-3873
  * net: packet: fix information leak to userland, CVE-2010-3876
    - LP: #710714
    - CVE-2010-3876
  * net: tipc: fix information leak to userland, CVE-2010-3877
    - LP: #711291
    - CVE-2010-3877
  * KVM: VMX: fix vmx null pointer dereference on debug register access,
    CVE-2010-0435
    - LP: #712615
    - CVE-2010-0435
  * gdth: integer overflow in ioctl, CVE-2010-4157
    - LP: #711797
    - CVE-2010-4157
  * posix-cpu-timers: workaround to suppress the problems with mt exec,
    CVE-2010-4248
    - LP: #712609
    - CVE-2010-4248
  * ALSA: sound/pci/rme9652: prevent reading uninitialized stack memory,
    CVE-2010-4080, CVE-2010-4081
    - LP: #712723, #712737
    - CVE-2010-4081
  * sys_semctl: fix kernel stack leakage, CVE-2010-4083
    - LP: #712749
    - CVE-2010-4083
  * inet_diag: Make sure we actually run the same bytecode we audited,
    CVE-2010-3880
    - LP: #711865
    - CVE-2010-3880

linux (2.6.24-28.85) hardy-proposed; urgency=low

  [ Brad Figg ]

  * Tracking Bug
    - LP: #708315

  [Upstream Kernel Changes]

  * ata_piix: IDE mode SATA patch for Intel ICH10 DeviceID's
    - LP: #693401
  * USB: serial/mos*: prevent reading uninitialized stack memory,
    CVE-2010-4074
    - LP: #706149
    - CVE-2010-4074
  * KVM: Fix fs/gs reload oops with invalid ldt
    - LP: #707000
    - CVE-2010-3698
  * drivers/video/sis/sis_main.c: prevent reading uninitialized stack
    memory, CVE-2010-4078
    - LP: #707579
    - CVE-2010-4078
  * V4L/DVB: ivtvfb: prevent reading uninitialized stack memory,
    CVE-2010-4079
    - LP: #707649
    - CVE-2010-4079

linux (2.6.24-28.84) hardy-proposed; urgency=low

  [ Steve Conklin ]

  * Tracking Bug
    - LP: #698185

linux (2.6.24-28.83) hardy-proposed; urgency=low

  [ Steve Conklin ]
  * tracking bug moved from here to latest entry

linux (2.6.24-28.82) hardy-proposed; urgency=low

  [ Leann Ogasawara ]

  * Revert "SAUCE: AF_ECONET saddr->cookie prevent NULL pointer
    dereference"
  * Revert "SAUCE: AF_ECONET SIOCSIFADDR ioctl does not check privileges"
  * Revert "SAUCE: AF_ECONET prevent kernel stack overflow"

  [Upstream Kernel Changes]

  * xfs: validate untrust...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 2.6.31-22.73

---------------
linux (2.6.31-22.73) karmic-proposed; urgency=low

  [ Steve Conklin ]

  * Release Tracking Bug
    - LP: #716648

  [ Upstream Kernel Changes ]

  * copied ABI directory
  * net: Limit socket I/O iovec total length to INT_MAX., CVE-2010-3859
    - LP: #708839, #711855
    - CVE-2010-4160
  * net: Truncate recvfrom and sendto length to INT_MAX., CVE-2010-3859
    - LP: #708839, #711855
    - CVE-2010-4160
  * net: fix rds_iovec page count overflow, CVE-2010-3865
    - LP: #709153
    - CVE-2010-3865
  * net: ax25: fix information leak to userland, CVE-2010-3875
    - LP: #710714
    - CVE-2010-3875
  * net: ax25: fix information leak to userland harder, CVE-2010-3875
    - LP: #710714
    - CVE-2010-3875
  * can-bcm: fix minor heap overflow
    - LP: #710680
    - CVE-2010-3874
  * memory corruption in X.25 facilities parsing, CVE-2010-3873
    - LP: #709372
    - CVE-2010-3873
  * net: packet: fix information leak to userland, CVE-2010-3876
    - LP: #710714
    - CVE-2010-3876
  * net: tipc: fix information leak to userland, CVE-2010-3877
    - LP: #711291
    - CVE-2010-3877
  * KVM: VMX: fix vmx null pointer dereference on debug register access,
    CVE-2010-0435
    - LP: #712615
    - CVE-2010-0435
  * gdth: integer overflow in ioctl, CVE-2010-4157
    - LP: #711797
    - CVE-2010-4157
  * posix-cpu-timers: workaround to suppress the problems with mt exec,
    CVE-2010-4248
    - LP: #712609
    - CVE-2010-4248
  * ALSA: sound/pci/rme9652: prevent reading uninitialized stack memory,
    CVE-2010-4080, CVE-2010-4081
    - LP: #712723, #712737
    - CVE-2010-4081
  * drivers/video/via/ioctl.c: prevent reading uninitialized stack memory,
    CVE-2010-4082
    - LP: #712744
    - CVE-2010-4082
  * sys_semctl: fix kernel stack leakage, CVE-2010-4083
    - LP: #712749
    - CVE-2010-4083
  * inet_diag: Make sure we actually run the same bytecode we audited,
    CVE-2010-3880
    - LP: #711865
    - CVE-2010-3880

linux (2.6.31-22.72) karmic-proposed; urgency=low

  [ Brad Figg ]

  * Tracking Bug
    - LP: #708860

  [ Upstream Kernel Changes ]

  * Karmic SRU: thinkpad-acpi: lock down video output state access, CVE-2010-3448
    - LP: #706999
    - CVE-2010-3448
  * USB: serial/mos*: prevent reading uninitialized stack memory,
    CVE-2010-4074
    - LP: #706149
    - CVE-2010-4074
  * KVM: Fix fs/gs reload oops with invalid ldt
    - LP: #707000
    - CVE-2010-3698
  * drivers/video/sis/sis_main.c: prevent reading uninitialized stack
    memory, CVE-2010-4078
    - LP: #707579
    - CVE-2010-4078
  * V4L/DVB: ivtvfb: prevent reading uninitialized stack memory,
    CVE-2010-4079
    - LP: #707649
    - CVE-2010-4079

linux (2.6.31-22.71) karmic-proposed; urgency=low

  [ Brad Figg ]

  - LP: #698214

  [ Upstream Kernel Changes ]

  * ipc: initialize structure memory to zero for compat functions
  * tcp: Increase TCP_MAXSEG socket option minimum.
    - CVE-2010-4165
  * perf_events: Fix perf_counter_mmap() hook in mprotect()
    - CVE-2010-4169
  * af_unix: limit unix_tot_inflight
    - CVE-2010-4249
 -- Steve Conklin <email address hidden> Thu, 10 Feb 2011 13:49:49...

[Paolo Pisati (p-pisati)]

karmic is EOL

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-fsl-imx51 - 2.6.31-609.26

---------------
linux-fsl-imx51 (2.6.31-609.26) lucid; urgency=low

  [ Paolo Pisati ]

  * Tracking bug
    - LP: #795219
  * [Config] Disable parport_pc on fsl-imx51
    - LP: #601226

  [ Upstream Kernel Changes ]

  * ALSA: sound/pci/rme9652: prevent reading uninitialized stack memory
    - LP: #712723, #712737
  * can-bcm: fix minor heap overflow
    - LP: #710680
  * drivers/video/via/ioctl.c: prevent reading uninitialized stack memory
    - LP: #712744
  * gdth: integer overflow in ioctl
    - LP: #711797
  * inet_diag: Make sure we actually run the same bytecode we audited, CVE-2010-3880
    - LP: #711865
    - CVE-2010-3880
  * net: fix rds_iovec page count overflow, CVE-2010-3865
    - LP: #709153
    - CVE-2010-3865
  * net: packet: fix information leak to userland, CVE-2010-3876
    - LP: #711045
    - CVE-2010-3876
  * net: tipc: fix information leak to userland, CVE-2010-3877
    - LP: #711291
    - CVE-2010-3877
  * net: Truncate recvfrom and sendto length to INT_MAX.
    - LP: #708839
  * posix-cpu-timers: workaround to suppress the problems with mt exec
    - LP: #712609
  * sys_semctl: fix kernel stack leakage
    - LP: #712749
  * x25: Patch to fix bug 15678 - x25 accesses fields beyond end of packet.
    - LP: #709372
  * memory corruption in X.25 facilities parsing
    - LP: #709372
  * net: ax25: fix information leak to userland, CVE-2010-3875
    - LP: #710714
    - CVE-2010-3875
  * net: ax25: fix information leak to userland harder, CVE-2010-3875
    - LP: #710714
    - CVE-2010-3875
  * fs/partitions/ldm.c: fix oops caused by corrupted partition table, CVE-2011-1017
    - LP: #771382
    - CVE-2011-1017
  * net: clear heap allocations for privileged ethtool actions
    - LP: #771445
  * Prevent rt_sigqueueinfo and rt_tgsigqueueinfo from spoofing the signal code
    - LP: #772543
  * Relax si_code check in rt_sigqueueinfo and rt_tgsigqueueinfo
    - LP: #772543
  * exec: make argv/envp memory visible to oom-killer
    - LP: #768408
  * next_pidmap: fix overflow condition
    - LP: #784727
  * proc: do proper range check on readdir offset
    - LP: #784727
  * mpt2sas: prevent heap overflows and unchecked reads
    - LP: #787145
  * agp: fix arbitrary kernel memory writes
    - LP: #788684
  * can: add missing socket check in can/raw release
    - LP: #788694
  * agp: fix OOM and buffer overflow
    - LP: #788700
  * do_exit(): make sure that we run with get_fs() == USER_DS - CVE-2010-4258
    - LP: #723945
    - CVE-2010-4258
  * x25: Prevent crashing when parsing bad X.25 facilities - CVE-2010-4164
    - LP: #731199
    - CVE-2010-4164
  * install_special_mapping skips security_file_mmap check - CVE-2010-4346
    - LP: #731971
    - CVE-2010-4346
  * econet: Fix crash in aun_incoming() - CVE-2010-4342
    - LP: #736394
    - CVE-2010-4342
  * sound: Prevent buffer overflow in OSS load_mixer_volumes - CVE-2010-4527
    - LP: #737073
    - CVE-2010-4527
  * irda: prevent integer underflow in IRLMP_ENUMDEVICES, CVE-2010-4529
    - LP: #737823
    - CVE-2010-4529
  * CAN: Use inode instead of kernel address for /proc file - CVE-2010-4565
    - LP: #765007...