CVE-2014-6417

[John Johansen]

net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly consider the possibility of kmalloc failure, which allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a long unencrypted auth ticket.

Break-Fix: ec0994e48ea2aebf62ff08376227f3a9ccf46262 c27a3e4d667fdcad3db7b104f75659478e0c68d8

[John Johansen (jjohansen)]

CVE-2014-6417

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.13.0-37.64

---------------
linux (3.13.0-37.64) trusty; urgency=low

  [ Joseph Salisbury ]

  * Release Tracking Bug
    - LP: #1372576

  [ dann frazier ]

  * [Config] CONFIG_HW_RANDOM_XGENE=m on arm64

  [ Edward Lin ]

  * SAUCE: Add use_native_backlight quirk for Dell Inspiron 5721/3521
    - LP: #1354253, #1354313

  [ Tim Gardner ]

  * SAUCE: Fix nfs oops stable regression
    - LP: #1348670
  * [Config] Add mpt3sas to d-i
    - LP: #1368907
  * [Config] CONFIG_X86_16BIT=y
    - LP: #1371601

  [ Timo Aaltonen ]

  * SAUCE: i915_bdw: Rebase to v3.15.8
    - LP: #1359213

  [ Upstream Kernel Changes ]

  * Revert "x86-64, modify_ldt: Make support for 16-bit segments a runtime
    option"
    - LP: #1371601
  * mmc: rtsx: add R1-no-CRC mmc command type handle
    - LP: #1365378
  * rpc_pipe: remove the clntXX dir if creating the pipe fails
    - LP: #1365869
  * sunrpc: add an "info" file for the dummy gssd pipe
    - LP: #1365869
  * rpc_pipe: fix cleanup of dummy gssd directory when notification fails
    - LP: #1365869
  * hwrng: xgene - add support for APM X-Gene SoC RNG support
    - LP: #1365593
  * Documentation: rng: Add X-Gene SoC RNG driver documentation
    - LP: #1365593
  * arm64: dts: add random number generator dts node to APM X-Gene
    platform.
    - LP: #1365593
  * xen/balloon: cancel ballooning if adding new memory failed
    - LP: #1304001
  * x86/xen: resume timer irqs early
    - LP: #1368724
  * xen/manage: Always freeze/thaw processes when suspend/resuming
    - LP: #1368724
  * scsi_transport_sas: move bsg destructor into sas_rphy_remove
    - LP: #1368991
  * drm/i915: Enable 5.4Ghz (HBR2) link rate for Displayport 1.2-capable
    devices
    - LP: #1369633
  * bnx2x: Fix link for KR with swapped polarity lane
    - LP: #1370716
  * drm: add DRM_CAPs for cursor size
    - LP: #1359213
  * drm/dp: Add AUX channel infrastructure
    - LP: #1359213
  * drm/dp: Add drm_dp_dpcd_read_link_status()
    - LP: #1359213
  * drm/dp: Add DisplayPort link helpers
    - LP: #1359213
  * drm/dp: Allow registering AUX channels as I2C busses
    - LP: #1359213
  * drm/dp: let drivers specify the name of the I2C-over-AUX adapter
    - LP: #1359213
  * drm/dp: make aux retries less chatty
    - LP: #1359213
  * Bluetooth: Enable Atheros 0cf3:311e for firmware upload
    - LP: #1371477
  * bnx2x: fix crash during TSO tunneling
    - LP: #1371601
  * inetpeer: get rid of ip_id_count
    - LP: #1371601
  * ip: make IP identifiers less predictable
    - LP: #1371601
  * tcp: Fix integer-overflows in TCP veno
    - LP: #1371601
  * tcp: Fix integer-overflow in TCP vegas
    - LP: #1371601
  * macvlan: Initialize vlan_features to turn on offload support.
    - LP: #1371601
  * net: Correctly set segment mac_len in skb_segment().
    - LP: #1371601
  * iovec: make sure the caller actually wants anything in
    memcpy_fromiovecend
    - LP: #1371601
  * batman-adv: Fix out-of-order fragmentation support
    - LP: #1371601
  * sctp: fix possible seqlock seadlock in sctp_packet_transmit()
    - LP: #1371601
  * sparc64: Fix argument sign extension for compat_sys_futex().
    - LP: #1371601
  ...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.2.0-70.105

---------------
linux (3.2.0-70.105) precise; urgency=low

  [ Kamal Mostafa ]

  * Release Tracking Bug
    - re-used previous tracking bug

  [ Upstream Kernel Changes ]

  * udf: Avoid infinite loop when processing indirect ICBs
    - LP: #1370042
    - CVE-2014-6410

linux (3.2.0-70.104) precise; urgency=low

  [ Joseph Salisbury ]

  * Release Tracking Bug
    - LP: #1372522

  [ Tim Gardner ]

  * SAUCE: Fix nfs oops stable regression
    - LP: #1348670
  * [Config] updateconfigs
    - LP: #1369711

  [ Upstream Kernel Changes ]

  * Revert "x86-64, modify_ldt: Make support for 16-bit segments a runtime
    option"
    - LP: #1369711
  * KVM: x86: Inter-privilege level ret emulation is not implemeneted
    - LP: #1369711
  * ASoC: samsung: Correct I2S DAI suspend/resume ops
    - LP: #1369711
  * block: don't assume last put of shared tags is for the host
    - LP: #1369711
  * stable_kernel_rules: Add pointer to netdev-FAQ for network patches
    - LP: #1369711
  * debugfs: Fix corrupted loop in debugfs_remove_recursive
    - LP: #1369711
  * serial: core: Preserve termios c_cflag for console resume
    - LP: #1369711
  * tda10071: force modulation to QPSK on DVB-S
    - LP: #1369711
  * gspca_pac7302: Add new usb-id for Genius i-Look 317
    - LP: #1369711
  * mtd/ftl: fix the double free of the buffers allocated in build_maps()
    - LP: #1369711
  * x86: don't exclude low BIOS area when allocating address space for
    non-PCI cards
    - LP: #1369711
  * Bluetooth: never linger on process exit
    - LP: #1369711
  * scsi: handle flush errors properly
    - LP: #1369711
  * USB: OHCI: don't lose track of EDs when a controller dies
    - LP: #1369711
  * ahci: add support for the Promise FastTrak TX8660 SATA HBA (ahci mode)
    - LP: #1369711
  * usbcore: don't log on consecutive debounce failures of the same port
    - LP: #1369711
  * USB: Fix persist resume of some SS USB devices
    - LP: #1369711
  * drm/radeon: fix irq ring buffer overflow handling
    - LP: #1369711
  * hwmon: (smsc47m192) Fix temperature limit and vrm write operations
    - LP: #1369711
  * staging: vt6655: Fix Warning on boot handle_irq_event_percpu.
    - LP: #1369711
  * staging: vt6655: Fix disassociated messages every 10 seconds
    - LP: #1369711
  * bfa: Fix undefined bit shift on big-endian architectures with 32-bit
    DMA address
    - LP: #1369711
  * hpsa: fix bad -ENOMEM return value in hpsa_big_passthru_ioctl
    - LP: #1369711
  * Drivers: scsi: storvsc: Implement a eh_timed_out handler
    - LP: #1369711
  * Fix gcc-4.9.0 miscompilation of load_balance() in scheduler
    - LP: #1369711
  * iommu/vt-d: Exclude devices using RMRRs from IOMMU API domains
    - LP: #1369711
  * net: sendmsg: fix NULL pointer dereference
    - LP: #1369711
  * tpm: Provide a generic means to override the chip returned timeouts
    - LP: #1369711
  * hwmon: (ads1015) Fix off-by-one for valid channel index checking
    - LP: #1369711
  * MIPS: tlbex: Fix a missing statement for HUGETLB
    - LP: #1369711
  * MIPS: Prevent user from setting FCSR cause bits
    - LP: #1369711
  * mm, thp: do not allow thp faults t...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.2.0-1455.75

---------------
linux-ti-omap4 (3.2.0-1455.75) precise; urgency=low

  * Release Tracking Bug
    - LP: #1372683

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.2.0-70.105

  [ Ubuntu: 3.2.0-70.105 ]

  * Release Tracking Bug
    - re-used previous tracking bug
  * udf: Avoid infinite loop when processing indirect ICBs
    - LP: #1370042
    - CVE-2014-6410

linux-ti-omap4 (3.2.0-1454.74) precise; urgency=low

  * Release Tracking Bug
    - LP: #1372683

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.2.0-70.104

  [ Ubuntu: 3.2.0-70.104 ]

  * Release Tracking Bug
    - LP: #1372522
  * SAUCE: Fix nfs oops stable regression
    - LP: #1348670
  * [Config] updateconfigs
    - LP: #1369711
  * Revert "x86-64, modify_ldt: Make support for 16-bit segments a runtime
    option"
    - LP: #1369711
  * KVM: x86: Inter-privilege level ret emulation is not implemeneted
    - LP: #1369711
  * ASoC: samsung: Correct I2S DAI suspend/resume ops
    - LP: #1369711
  * block: don't assume last put of shared tags is for the host
    - LP: #1369711
  * stable_kernel_rules: Add pointer to netdev-FAQ for network patches
    - LP: #1369711
  * debugfs: Fix corrupted loop in debugfs_remove_recursive
    - LP: #1369711
  * serial: core: Preserve termios c_cflag for console resume
    - LP: #1369711
  * tda10071: force modulation to QPSK on DVB-S
    - LP: #1369711
  * gspca_pac7302: Add new usb-id for Genius i-Look 317
    - LP: #1369711
  * mtd/ftl: fix the double free of the buffers allocated in build_maps()
    - LP: #1369711
  * x86: don't exclude low BIOS area when allocating address space for
    non-PCI cards
    - LP: #1369711
  * Bluetooth: never linger on process exit
    - LP: #1369711
  * scsi: handle flush errors properly
    - LP: #1369711
  * USB: OHCI: don't lose track of EDs when a controller dies
    - LP: #1369711
  * ahci: add support for the Promise FastTrak TX8660 SATA HBA (ahci mode)
    - LP: #1369711
  * usbcore: don't log on consecutive debounce failures of the same port
    - LP: #1369711
  * USB: Fix persist resume of some SS USB devices
    - LP: #1369711
  * drm/radeon: fix irq ring buffer overflow handling
    - LP: #1369711
  * hwmon: (smsc47m192) Fix temperature limit and vrm write operations
    - LP: #1369711
  * staging: vt6655: Fix Warning on boot handle_irq_event_percpu.
    - LP: #1369711
  * staging: vt6655: Fix disassociated messages every 10 seconds
    - LP: #1369711
  * bfa: Fix undefined bit shift on big-endian architectures with 32-bit
    DMA address
    - LP: #1369711
  * hpsa: fix bad -ENOMEM return value in hpsa_big_passthru_ioctl
    - LP: #1369711
  * Drivers: scsi: storvsc: Implement a eh_timed_out handler
    - LP: #1369711
  * Fix gcc-4.9.0 miscompilation of load_balance() in scheduler
    - LP: #1369711
  * iommu/vt-d: Exclude devices using RMRRs from IOMMU API domains
    - LP: #1369711
  * net: sendmsg: fix NULL pointer dereference
    - LP: #1369711
  * tpm: Provide a generic means to override the chip returned timeouts
    - LP: #1369711
  * hwmon: (ads1015) Fix off-by-one for valid channel index checking
    - LP: #1369711
  * MIPS: tlbex: Fix a...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-armadaxp - 3.2.0-1639.57

---------------
linux-armadaxp (3.2.0-1639.57) precise; urgency=low

  [ Ike Panhc ]

  * Release Tracking Bug
    - LP: #1373656
  * Rebase to Ubuntu-3.2.0-70.105

  [ Ubuntu: 3.2.0-70.105 ]

  * Release Tracking Bug
    - re-used previous tracking bug
  * udf: Avoid infinite loop when processing indirect ICBs
    - LP: #1370042
    - CVE-2014-6410
 -- Ike Panhc <email address hidden> Thu, 25 Sep 2014 13:34:49 +0800

[Rolf Leggewie (r0lf)]

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".

[Andy Whitcroft (apw)]

This bug was nominated against a series that is no longer supported, ie vivid. The bug task representing the vivid nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.