CVE-2013-1828

[John Johansen]

The sctp_getsockopt_assoc_stats function in net/sctp/socket.c in the Linux kernel before 3.8.4 does not validate a size value before proceeding to a copy_from_user operation, which allows local users to gain privileges via a crafted application that contains an SCTP_GET_ASSOC_STATS getsockopt system call.

Break-Fix: 196d67593439b03088913227093e374235596e33 726bc6b092da4c093eb74d13c07184b18c1af0f1

[John Johansen (jjohansen)]

CVE-2013-1828

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.8.0-13.22

---------------
linux (3.8.0-13.22) raring; urgency=low

  [ Andy Whitcroft ]

  * Revert "SAUCE: fireware: add NO_MSI quirks for o2micro controller"

  [ Kamal Mostafa ]

  * SAUCE: alx: use github.com/qca/alx repo
    - LP: #1154238
  * [packaging] do not use ../.$(series)-env file
  * SAUCE: Convert bnx2x firmware files to ihex format

  [ Qualcomm Atheros, Inc ]

  * SAUCE: alx: Update to heads/master
    - LP: #1154238

  [ Seth Forshee ]

  * SAUCE: efivars: Allow disabling use as a pstore backend
  * [Config] Re-enable CONFIG_PSTORE for x86

  [ Tim Gardner ]

  * Drop efivarfs reverts in favor of 3.8.3 stable updates
    Revert "efivarfs: Validate filenames much more aggressively"
    Revert "efivarfs: guid part of filenames are case-insensitive"
  * [Config] CONFIG_I2C_ISMT=m
    - LP: #1011449
  * [Config] CONFIG_SERIAL_8250_DMA=y,CONFIG_SERIAL_8250_DW=m for x86en
    - LP: #1031162
  * Release Tracking Bug
    - LP: #1155680

  [ Upstream Kernel Changes ]

  * net/sctp: Validate parameter size for SCTP_GET_ASSOC_STATS
    - LP: #1152791
    - CVE-2013-1828
  * mfd: rtsx: Implement driving adjustment to device-dependent callbacks
    - LP: #1153618
  * mfd: rtsx: Support RTS5227
    - LP: #1153618
  * mmc: rtsx: remove driving adjustment
    - LP: #1153618
  * i2c: Adding support for Intel iSMT SMBus 2.0 host controller
    - LP: #1011449
  * i2c: fix i2c-ismt.c printk format warning
    - LP: #1011449
  * serial: quatech: add the other serial identifiers and preliminary
    control code
    - LP: #1031162
  * serial: Remove RM9000 series serial driver.
    - LP: #1031162
  * serial: 8250_pci: remove __devexit usage
    - LP: #1031162
  * serial: 8250: Allow drivers to deliver capabilities
    - LP: #1031162
  * serial: 8250_dw: Don't use UPF_FIXED_TYPE
    - LP: #1031162
  * serial: 8250_dw: Map IO memory
    - LP: #1031162
  * serial: 8250_dw: Move device tree code to separate function
    - LP: #1031162
  * serial: 8250_dw: Set FIFO size dynamically
    - LP: #1031162
  * serial: 8250_dw: Add ACPI 5.0 support
    - LP: #1031162
  * serial: 8250: Add support for dmaengine
    - LP: #1031162
  * serial: 8250_dw: Enable DMA support with ACPI
    - LP: #1031162

  [ Upstream Kernel Changes ]

  * rebase to v3.8.3
 -- Tim Gardner <email address hidden> Mon, 11 Mar 2013 06:53:51 -0600

[Adam Conrad (adconrad)]

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.