CVE-2014-5472

[John Johansen]

The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry.

Break-Fix: - 410dd3cf4c9b36f27ed4542ee18b1af5e68645a4

[John Johansen (jjohansen)]

CVE-2014-5472

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.16.0-12.18

---------------
linux (3.16.0-12.18) utopic; urgency=low

  [ Paolo Pisati ]

  * Revert "[Debian] dtb: symlink /lib/firmware/(uname -r)/device-tree to
    /boot/dtb-(uname -r) to make flash-kernel happy"
  * Revert "[Debian] dtb: don't remove a symlink dereferencing an existing
    directory"
  * Revert "[Debian] dtb: don't follow symlink when checking for a
    directory"
  * Revert "[Debian] dtb: symlink from /boot/dtb-$(uname -r) to /boot/dtb"
  * Revert "[Debian] dtb: move dtbs installation to /boot/dtb-$(uname -r)"

linux (3.16.0-12.17) utopic; urgency=low

  [ Andy Whitcroft ]

  * Release Tracking Bug
    - LP: #1363032
  * Revert "[Config] Switch kernel to vmlinuz (from vmlinux) on ppc64el"

  [ dann frazier ]

  * [Config] CONFIG_ARM_GIC_V3=y

  [ Douglas Lehr ]

  * SAUCE: (no-up) PCI: Increase BAR size quirk for IBM ipr SAS Crocodile
    adapters
    - LP: #1361364

  [ Marc Dietrich ]

  * [Config] arm/tegra/d-i: framebuffer and usb support for Tegra SoCs

  [ Paolo Pisati ]

  * [Config] armhf: REGULATOR_TWL4030=y
  * [Debian] dtb: move dtbs installation to /boot/dtb-$(uname -r)
  * [Debian] dtb: symlink from /boot/dtb-$(uname -r) to /boot/dtb
  * [Debian] dtb: don't follow symlink when checking for a directory
  * [Debian] dtb: don't remove a symlink dereferencing an existing
    directory
  * [Debian] dtb: symlink /lib/firmware/(uname -r)/device-tree to
    /boot/dtb-(uname -r) to make flash-kernel happy

  [ Stefan Bader ]

  * SAUCE: x86/xen: Fix setup of 64bit kernel pagetables
    - LP: #1350522

  [ Upstream Kernel Changes ]

  * drm/tegra: add MODULE_DEVICE_TABLEs
  * kvm: iommu: fix the third parameter of kvm_iommu_put_pages
    (CVE-2014-3601)
    - LP: #1362443
    - CVE-2014-3601
  * isofs: Fix unbounded recursion when processing relocated directories
    - LP: #1362447, #1362448
    - CVE-2014-5472
  * arm64/crypto: fix makefile rule for aes-glue-%.o
  * irq-gic: remove file name from heading comment
  * irqchip: gic: Move some bits of GICv2 to a library-type file
  * irqchip: gic-v3: Initial support for GICv3
  * arm64: GICv3 device tree binding documentation
  * arm64: boot protocol documentation update for GICv3
  * KVM: arm/arm64: vgic: move GICv2 registers to their own structure
  * KVM: ARM: vgic: introduce vgic_ops and LR manipulation primitives
  * KVM: ARM: vgic: abstract access to the ELRSR bitmap
  * KVM: ARM: vgic: abstract EISR bitmap access
  * KVM: ARM: vgic: abstract MISR decoding
  * KVM: ARM: vgic: move underflow handling to vgic_ops
  * KVM: ARM: vgic: abstract VMCR access
  * KVM: ARM: vgic: introduce vgic_enable
  * KVM: ARM: introduce vgic_params structure
  * KVM: ARM: vgic: split GICv2 backend from the main vgic code
  * KVM: ARM: vgic: revisit implementation of irqchip_in_kernel
  * arm64: KVM: remove __kvm_hyp_code_{start,end} from hyp.S
  * arm64: KVM: split GICv2 world switch from hyp code
  * arm64: KVM: move HCR_EL2.{IMO,FMO} manipulation into the vgic switch
    code
  * KVM: ARM: vgic: add the GICv3 backend
  * arm64: KVM: vgic: add GICv3 world switch
  * arm64: KVM: vgic: enable GICv2 emulation on top on GICv3 hardware
  * arm64...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.13.0-36.63

---------------
linux (3.13.0-36.63) trusty; urgency=low

  [ Joseph Salisbury ]

  * Release Tracking Bug
    - LP: #1365052

  [ Feng Kan ]

  * SAUCE: (no-up) irqchip:gic: change access of gicc_ctrl register to read
    modify write.
    - LP: #1357527
  * SAUCE: (no-up) arm64: optimized copy_to_user and copy_from_user
    assembly code
    - LP: #1358949

  [ Ming Lei ]

  * SAUCE: (no-up) Drop APM X-Gene SoC Ethernet driver
    - LP: #1360140
  * [Config] Drop XGENE entries
    - LP: #1360140
  * [Config] CONFIG_NET_XGENE=m for arm64
    - LP: #1360140

  [ Stefan Bader ]

  * SAUCE: Add compat macro for skb_get_hash
    - LP: #1358162
  * SAUCE: bcache: prevent crash on changing writeback_running
    - LP: #1357295

  [ Suman Tripathi ]

  * SAUCE: (no-up) arm64: Fix the csr-mask for APM X-Gene SoC AHCI SATA PHY
    clock DTS node.
    - LP: #1359489
  * SAUCE: (no-up) ahci_xgene: Skip the PHY and clock initialization if
    already configured by the firmware.
    - LP: #1359501
  * SAUCE: (no-up) ahci_xgene: Fix the link down in first attempt for the
    APM X-Gene SoC AHCI SATA host controller driver.
    - LP: #1359507

  [ Tuan Phan ]

  * SAUCE: (no-up) pci-xgene-msi: fixed deadlock in irq_set_affinity
    - LP: #1359514

  [ Upstream Kernel Changes ]

  * iwlwifi: mvm: Add a missed beacons threshold
    - LP: #1349572
  * mac80211: reset probe_send_count also in HW_CONNECTION_MONITOR case
    - LP: #1349572
  * genirq: Add an accessor for IRQ_PER_CPU flag
    - LP: #1357527
  * arm64: perf: add support for percpu pmu interrupt
    - LP: #1357527
  * cifs: sanity check length of data to send before sending
    - LP: #1283101
  * KVM: nVMX: Pass vmexit parameters to nested_vmx_vmexit
    - LP: #1329434
  * KVM: nVMX: Rework interception of IRQs and NMIs
    - LP: #1329434
  * KVM: vmx: disable APIC virtualization in nested guests
    - LP: #1329434
  * HID: Add transport-driver functions to the USB HID interface.
    - LP: #1353021
  * ahci_xgene: Removing NCQ support from the APM X-Gene SoC AHCI SATA Host
    Controller driver.
    - LP: #1358498
  * fold d_kill() and d_free()
    - LP: #1354234
  * fold try_prune_one_dentry()
    - LP: #1354234
  * new helper: dentry_free()
    - LP: #1354234
  * expand the call of dentry_lru_del() in dentry_kill()
    - LP: #1354234
  * dentry_kill(): don't try to remove from shrink list
    - LP: #1354234
  * don't remove from shrink list in select_collect()
    - LP: #1354234
  * more graceful recovery in umount_collect()
    - LP: #1354234
  * dcache: don't need rcu in shrink_dentry_list()
    - LP: #1354234
  * lift the "already marked killed" case into shrink_dentry_list()
  * split dentry_kill()
    - LP: #1354234
  * expand dentry_kill(dentry, 0) in shrink_dentry_list()
    - LP: #1354234
  * shrink_dentry_list(): take parent's ->d_lock earlier
    - LP: #1354234
  * dealing with the rest of shrink_dentry_list() livelock
    - LP: #1354234
  * dentry_kill() doesn't need the second argument now
    - LP: #1354234
  * dcache: add missing lockdep annotation
    - LP: #1354234
  * fs: convert use of typedef ctl_table to struct ctl_table
 ...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.2.0-69.103

---------------
linux (3.2.0-69.103) precise; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1364208

  [ Upstream Kernel Changes ]

  * kvm: iommu: fix the third parameter of kvm_iommu_put_pages
    (CVE-2014-3601)
    - LP: #1362443
    - CVE-2014-3601
  * isofs: Fix unbounded recursion when processing relocated directories
    - LP: #1362447, #1362448
    - CVE-2014-5472
 -- Brad Figg <email address hidden> Mon, 01 Sep 2014 20:33:44 -0700

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.2.0-1453.73

---------------
linux-ti-omap4 (3.2.0-1453.73) precise; urgency=low

  * Release Tracking Bug
    - LP: #1364290

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.2.0-69.103

  [ Ubuntu: 3.2.0-69.103 ]

  * Release Tracking Bug
    - LP: #1364208
  * kvm: iommu: fix the third parameter of kvm_iommu_put_pages
    (CVE-2014-3601)
    - LP: #1362443
    - CVE-2014-3601
  * isofs: Fix unbounded recursion when processing relocated directories
    - LP: #1362447, #1362448
    - CVE-2014-5472
 -- Paolo Pisati <email address hidden> Wed, 03 Sep 2014 15:06:15 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-armadaxp - 3.2.0-1638.55

---------------
linux-armadaxp (3.2.0-1638.55) precise; urgency=low

  [ Ike Panhc ]

  * Release Tracking Bug
    - LP: #1364291
  * Rebase to Ubuntu-3.2.0-69.103

  [ Ubuntu: 3.2.0-69.103 ]

  * Release Tracking Bug
    - LP: #1364208
  * kvm: iommu: fix the third parameter of kvm_iommu_put_pages
    (CVE-2014-3601)
    - LP: #1362443
    - CVE-2014-3601
  * isofs: Fix unbounded recursion when processing relocated directories
    - LP: #1362447, #1362448
    - CVE-2014-5472
 -- Ike Panhc <email address hidden> Tue, 02 Sep 2014 15:05:27 +0800

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 2.6.32-66.132

---------------
linux (2.6.32-66.132) lucid; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1364092

  [ Upstream Kernel Changes ]

  * isofs: Fix unbounded recursion when processing relocated directories
    - LP: #1362447, #1362448
    - CVE-2014-5472
 -- Brad Figg <email address hidden> Mon, 01 Sep 2014 10:05:24 -0700

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ec2 - 2.6.32-370.86

---------------
linux-ec2 (2.6.32-370.86) lucid; urgency=low

  [ Brad Figg ]

  * Release Tracking Bug
    - LP: #1364189

  [ Upstream Kernel Changes ]

  * isofs: Fix unbounded recursion when processing relocated directories
    - LP: #1362447, #1362448
    - CVE-2014-5472
 -- Brad Figg <email address hidden> Tue, 02 Sep 2014 08:34:56 -0700

[Rolf Leggewie (r0lf)]

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".

[Rolf Leggewie (r0lf)]

utopic has seen the end of its life and is no longer receiving any updates. Marking the utopic task for this ticket as "Won't Fix".

[Andy Whitcroft (apw)]

This bug was nominated against a series that is no longer supported, ie vivid. The bug task representing the vivid nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.