CVE-2012-4398

[Tetsuo Handa]

The __request_module function in kernel/kmod.c in the Linux kernel before 3.4 does not set a certain killable attribute, which allows local users to cause a denial of service (memory consumption) via a crafted application.

Break-Fix: - 70834d3070c3f3015ab5c05176d54bd4a0100546
Break-Fix: - b3449922502f5a161ee2b5022a33aec8472fbf18
Break-Fix: - d0bd587a80960d7ba7e0c8396e154028c9045c54
Break-Fix: - 9d944ef32e83405a07376f112e9f02161d3e9731
Break-Fix: - 5b9bd473e3b8a8c6c4ae99be475e6e9b27568555
Break-Fix: - 3e63a93b987685f02421e18b2aa452d20553a88b
Break-Fix: - 1cc684ab75123efe7ff446eb821d44375ba8fa30

[Tim Gardner (timg-tpi)]

kmod: make __request_module() killable
kmod: introduce call_modprobe() helper
usermodehelper: ____call_usermodehelper() doesn't need do_exit()
usermodehelper: kill umh_wait, renumber UMH_* constants
usermodehelper: implement UMH_KILLABLE
usermodehelper: introduce umh_complete(sub_info)
usermodehelper: use UMH_WAIT_PROC consistently

[Tim Gardner (timg-tpi)]

Also added to Precise "UBUNTU: SAUCE: fsam7400: use UMH_WAIT_PROC consistently"

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.2.0-21.34

---------------
linux (3.2.0-21.34) precise; urgency=low

  [ AceLan Kao ]

  * SAUCE: (drop after 3.4) asus-wmi: add scalar board brightness adj.
    support
    - LP: #961879
  * SAUCE: (drop after 3.4) asus-wmi: store backlight power status for AIO
    machine
    - LP: #961880

  [ Andy Whitcroft ]

  * [Config]: enable CONFIG_DRM_LOAD_EDID_FIRMWARE

  [ John Johansen ]

  * SAUCE: AppArmor: Add the ability to mediate mount
  * SAUCE: AppArmor: Add profile introspection file to interface
  * SAUCE: AppArmor: basic networking rules
  * SAUCE: Update aufs for build failure caused by apparmor backport
  * SAUCE: AppArmor: Fix change_onexec when called from a confined task
    - LP: #963756

  [ Leann Ogasawara ]

  * Revert "SAUCE: (drop after 3.3) platform/x86: Add driver for Apple gmux
    device"
  * Rebase to v3.2.13
  * d-i: Fix iwl3945 driver name typo in nic-modules
  * d-i: Add missing iwl* drivers to nic-modules
    - LP: #965116
  * d-i: Remove obsolete bcm43xx* drivers from nic-modules
  * d-i: Add brcm*mac drivers to nic-modules

  [ Seth Forshee ]

  * SAUCE: (drop after 3.3) apple_bl: Add register/unregister functions
  * SAUCE: (drop after 3.3) platform/x86: Add driver for Apple gmux device

  [ Tim Gardner ]

  * Add isci to debian scsi-modules udeb
    - LP: #963306
  * SAUCE: fsam7400: use UMH_WAIT_PROC consistently
    - LP: #963685
  * SAUCE: disable_nx should not be in __cpuinitdata section for X86_32
    - LP: #968233

  [ Upstream Kernel Changes ]

  * Bluetooth: Adding USB device 13d3:3375 as an Atheros AR3012.
    - LP: #916319
  * x86: Report cpb and eff_freq_ro flags correctly
    - LP: #960461
  * x86/amd: Add missing feature flag for fam15h models 10h-1fh processors
    - LP: #960461
  * KVM: Move cpuid code to new file
    - LP: #960466
  * KVM: expose latest Intel cpu new features (BMI1/BMI2/FMA/AVX2) to guest
    - LP: #960466
  * apparmor: add missing rcu_dereference()
  * apparmor: fix module parameter handling
  * btrfs, nfs, apparmor: don't pull mnt_namespace.h for no reason...
  * switch security_path_chmod() to umode_t
  * switch securityfs_create_file() to umode_t
  * switch ->path_mkdir() to umode_t
  * switch ->path_mknod() to umode_t
  * capabilities: remove the task from capable LSM hook entirely
  * switch security_path_chmod() to struct path *
  * AppArmor: refactor securityfs to use structures
  * AppArmor: add initial "features" directory to securityfs
  * AppArmor: add "file" details to securityfs
  * AppArmor: export known rlimit names/value mappings in securityfs
  * AppArmor: Add mising end of structure test to caps unpacking
  * AppArmor: Fix dropping of allowed operations that are force audited
  * AppArmor: Fix underflow in xindex calculation
  * AppArmor: fix mapping of META_READ to audit and quiet flags
  * AppArmor: Fix the error case for chroot relative path name lookup
  * AppArmor: Fix error returned when a path lookup is disconnected
  * AppArmor: Fix oops in policy unpack auditing
  * AppArmor: Add const qualifiers to generated string tables
  * AppArmor: Retrieve the dentry_path for error reporting when path lookup
    fails
...

[Luis Henriques (henrix)]

This bug is awaiting verification that the kernel for Lucid in -proposed solves the problem (2.6.32-41.88). Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-lucid' to 'verification-done-lucid'.

If verification is not done by one week from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Tim Gardner (timg-tpi)]

Tagging as verification-done-lucid. The failure of this patch would be catastrophic and readily noticed.

[Tim Gardner (timg-tpi)]

Tagging as verification-done-oneiric. The failure of this patch would be catastrophic and readily noticed.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 2.6.32-41.88

---------------
linux (2.6.32-41.88) lucid-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #966443

  [ Andy Whitcroft ]

  * [Config] restore build-% shortcut

  [ Tim Gardner ]

  * SAUCE: ubuntu drivers: use UMH_WAIT_PROC consistently
    - LP: #963685

  [ Upstream Kernel Changes ]

  * Revert "Revert "USB: xhci - fix unsafe macro definitions""
    - LP: #948139
  * Revert "Revert "USB: xhci - fix math in xhci_get_endpoint_interval()""
    - LP: #948139
  * Revert "Revert "xhci: Fix full speed bInterval encoding.""
    - LP: #948139
  * bsg: fix sysfs link remove warning
    - LP: #946928
  * hwmon: (f75375s) Fix bit shifting in f75375_write16
    - LP: #948139
  * lib: proportion: lower PROP_MAX_SHIFT to 32 on 64-bit kernel
    - LP: #948139
  * relay: prevent integer overflow in relay_open()
    - LP: #948139
  * mac80211: timeout a single frame in the rx reorder buffer
    - LP: #948139
  * kernel.h: fix wrong usage of __ratelimit()
    - LP: #948139
  * printk_ratelimited(): fix uninitialized spinlock
    - LP: #948139
  * hwmon: (f75375s) Fix automatic pwm mode setting for F75373 & F75375
    - LP: #948139
  * crypto: sha512 - Use binary and instead of modulus
    - LP: #948139
  * crypto: sha512 - Avoid stack bloat on i386
    - LP: #948139
  * crypto: sha512 - use standard ror64()
    - LP: #948139
  * SCSI: 3w-9xxx fix bug in sgl loading
    - LP: #948139
  * ARM: 7321/1: cache-v7: Disable preemption when reading CCSIDR
    - LP: #948139
  * ARM: 7325/1: fix v7 boot with lockdep enabled
    - LP: #948139
  * USB: Added Kamstrup VID/PIDs to cp210x serial driver.
    - LP: #948139
  * USB: Fix handoff when BIOS disables host PCI device.
    - LP: #948139
  * xhci: Fix encoding for HS bulk/control NAK rate.
    - LP: #948139
  * hdpvr: fix race conditon during start of streaming
    - LP: #948139
  * cdrom: use copy_to_user() without the underscores
    - LP: #948139
  * autofs: work around unhappy compat problem on x86-64
    - LP: #948139
  * Fix autofs compile without CONFIG_COMPAT
    - LP: #948139
  * compat: fix compile breakage on s390
    - LP: #948139
  * PM: Print a warning if firmware is requested when tasks are frozen
    - LP: #948139
  * firmware loader: allow builtin firmware load even if usermodehelper is
    disabled
    - LP: #948139
  * PM / Sleep: Fix freezer failures due to racy
    usermodehelper_is_disabled()
    - LP: #948139
  * PM / Sleep: Fix read_unlock_usermodehelper() call.
    - LP: #948139
  * Linux 2.6.32.58
    - LP: #948139
  * regset: Prevent null pointer reference on readonly regsets
    - LP: #949905
    - CVE-2012-1097
  * regset: Return -EFAULT, not -EIO, on host-side memory fault
    - LP: #949905
    - CVE-2012-1097
  * KVM: Remove ability to assign a device without iommu support
    - LP: #897812
    - CVE-2011-4347
  * eCryptfs: Copy up lower inode attrs after setting lower xattr
  * eCryptfs: Improve statfs reporting
    - LP: #885744
  * drm/i915: no lvds quirk for AOpen MP45
    - LP: #955078
  * drm/radeon/kms: fix MSI re-arm on rv370+
    - LP: #955078
  * Linux 2.6.32.58+drm33.24
    - LP: #955078
  ...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.0.0-19.33

---------------
linux (3.0.0-19.33) oneiric-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #985736

  [ Luis Henriques ]

  * SAUCE: ite-cir: postpone ISR registration
    - LP: #984387

linux (3.0.0-19.32) oneiric-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #974368

  [ Brad Figg ]

  * SAUCE (no-up) Provide a param for allowing the BIOS to handle changing
    the brightness on AC/battery status changes.
    - LP: #949311
  * SAUCE (no-up) Quirk for enabling backlight hotkeys on Samsung N150P
    - LP: #875893

  [ Daniel Vetter ]

  * SAUCE: (drop after 3.5) drm/i915: reinstate GM45 TV detection fix
    - LP: #638939

  [ Herton Ronaldo Krzesinski ]

  * SAUCE: (no-up) Reinstate missing hunk from nx emulation
    - LP: #972821

  [ Tim Gardner ]

  * SAUCE: ubuntu drivers: use UMH_WAIT_PROC consistently
    - LP: #963685
  * SAUCE: disable_nx should not be in __cpuinitdata section for X86_32
    - LP: #968233
  * SAUCE: (no-up) remove __initdata from vesafb_fix
    - LP: #969309

  [ Upstream Kernel Changes ]

  * usermodehelper: use UMH_WAIT_PROC consistently
    - LP: #963685
  * usermodehelper: introduce umh_complete(sub_info)
    - LP: #963685
  * usermodehelper: implement UMH_KILLABLE
    - LP: #963685
  * usermodehelper: kill umh_wait, renumber UMH_* constants
    - LP: #963685
  * usermodehelper: ____call_usermodehelper() doesn't need do_exit()
    - LP: #963685
  * kmod: introduce call_modprobe() helper
    - LP: #963685
  * kmod: make __request_module() killable
    - LP: #963685
  * x86, tsc: Fix SMI induced variation in quick_pit_calibrate()
    - LP: #965586
  * ata_piix: Add Toshiba Satellite Pro A120 to the quirks list due to
    broken suspend functionality.
    - LP: #886850
  * ACPICA: Fix regression in FADT revision checks
    - LP: #883441
  * ASPM: Fix pcie devices with non-pcie children
    - LP: #961482
  * USB: option: Add MediaTek MT6276M modem&app interfaces
    - LP: #971808
  * USB: option driver: adding support for Telit CC864-SINGLE, CC864-DUAL
    and DE910-DUAL modems
    - LP: #971808
  * USB: option: make interface blacklist work again
    - LP: #971808
  * USB: option: add ZTE MF820D
    - LP: #971808
  * USB: ftdi_sio: fix problem when the manufacture is a NULL string
    - LP: #971808
  * USB: ftdi_sio: add support for BeagleBone rev A5+
    - LP: #971808
  * USB: Microchip VID mislabeled as Hornby VID in ftdi_sio.
    - LP: #971808
  * USB: ftdi_sio: new PID: Distortec JTAG-lock-pick
    - LP: #971808
  * USB: ftdi_sio: add support for FT-X series devices
    - LP: #971808
  * USB: ftdi_sio: new PID: LUMEL PD12
    - LP: #971808
  * powerpc/usb: fix bug of kernel hang when initializing usb
    - LP: #971808
  * usb: musb: Reselect index reg in interrupt context
    - LP: #971808
  * usb: gadgetfs: return number of bytes on ep0 read request
    - LP: #971808
  * USB: gadget: Make g_hid device class conform to spec.
    - LP: #971808
  * futex: Cover all PI opcodes with cmpxchg enabled check
    - LP: #971808
  * sysfs: Fix memory leak in sysfs_sd_setsecdata().
    - LP: #971808
  * tty: ...

[Herton R. Krzesinski (herton)]

This bug is awaiting verification that the kernel for Natty in -proposed solves the problem (2.6.38-15.59). Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-natty' to 'verification-done-natty'.

If verification is not done by one week from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Tim Gardner (timg-tpi)]

Tagging as verification-done-natty. The failure of this patch would be catastrophic and readily noticed.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 2.6.38-15.59

---------------
linux (2.6.38-15.59) natty-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #987281

  [ Brad Figg ]

  * SAUCE (no-up) Provide a param for allowing the BIOS to handle changing
    the brightness on AC/battery status changes.
    - LP: #949311

  [ Tim Gardner ]

  * SAUCE: ubuntu drivers: use UMH_WAIT_PROC consistently
    - LP: #963685
  * SAUCE: disable_nx should not be in __cpuinitdata section for X86_32
    - LP: #968233
  * SAUCE: (no-up) remove __initdata from vesafb_fix
    - LP: #969309

  [ Upstream Kernel Changes ]

  * usermodehelper: use UMH_WAIT_PROC consistently
    - LP: #963685
  * usermodehelper: introduce umh_complete(sub_info)
    - LP: #963685
  * usermodehelper: implement UMH_KILLABLE
    - LP: #963685
  * usermodehelper: kill umh_wait, renumber UMH_* constants
    - LP: #963685
  * usermodehelper: ____call_usermodehelper() doesn't need do_exit()
    - LP: #963685
  * kmod: introduce call_modprobe() helper
    - LP: #963685
  * kmod: make __request_module() killable
    - LP: #963685
  * drm/i915: Fixes distorted external screen image on HP 2730p
    - LP: #796030
  * ext4: fix undefined behavior in ext4_fill_flex_info()
    - LP: #984757
    - CVE-2012-2100
  * jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer
    - LP: #929781
    - CVE-2011-4086
  * cifs: fix dentry refcount leak when opening a FIFO on lookup
    - LP: #947997
    - CVE-2012-1090
 -- Luis Henriques <email address hidden> Mon, 23 Apr 2012 14:02:53 +0100

[Ante Karamatić (ivoks)]

How about adding this one too?

http://git.drbd.org/gitweb.cgi?p=drbd-8.3.git;a=commitdiff;h=e6cbc43

[Tetsuo Handa (9-launchpad-i-love-sakura-ne-jp)]

> How about adding this one too?
Already applied.

# grep call_usermodehelper ubuntu-11.04/linux-2.6.38-15.59/drivers/block/drbd/drbd_nl.c ubuntu-11.10/linux-3.0.0-19.33/drivers/block/drbd/drbd_nl.c ubuntu-12.04/linux-3.2.0-24.37/drivers/block/drbd/drbd_nl.c
ubuntu-11.04/linux-2.6.38-15.59/drivers/block/drbd/drbd_nl.c: ret = call_usermodehelper(usermode_helper, argv, envp, UMH_WAIT_PROC);
ubuntu-11.10/linux-3.0.0-19.33/drivers/block/drbd/drbd_nl.c: ret = call_usermodehelper(usermode_helper, argv, envp, UMH_WAIT_PROC);
ubuntu-12.04/linux-3.2.0-24.37/drivers/block/drbd/drbd_nl.c: ret = call_usermodehelper(usermode_helper, argv, envp, UMH_WAIT_PROC);

[Ante Karamatić (ivoks)]

Right, thanks. It's 10.04 that still has this issue - drbd in 10.04 will be tracked in bug 1000355.

[CSRedRat (csredrat)]

If i'm change "Affect me" always have message "Timeout error, please try again in a few minutes".

[Christopher M. Penalver (penalvch)]

EoL as per https://wiki.ubuntu.com/Kernel/LTSEnablementStack .

[Andy Whitcroft (apw)]

This bug was nominated against a series that is no longer supported, ie vivid. The bug task representing the vivid nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.