CVE-2012-2137

[John Johansen]

Buffer overflow in virt/kvm/irq_comm.c in the KVM subsystem in the Linux kernel before 3.2.24 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to Message Signaled Interrupts (MSI), irq routing entries, and an incorrect check by the setup_routing_entry function before invoking the kvm_set_irq function.

Break-Fix: 46e624b95c36d729bdf24010fff11d16f6fe94fa f2ebd422f71cda9c791f76f85d2ca102ae34a1ed

[John Johansen (jjohansen)]

CVE-2012-2137

[Ike Panhc (ikepanhc)]

Patch 46e624b95c36d729bdf24010fff11d16f6fe94fa f2ebd422f71cda9c791f76f85d2ca102ae34a1ed already in upstream 3.5

[Adam Conrad (adconrad)]

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-lts-backport-oneiric - 3.0.0-26.43~lucid1

---------------
linux-lts-backport-oneiric (3.0.0-26.43~lucid1) lucid-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1056607

  [ Dave Airlie ]

  * SAUCE: drm/vmwgfx: add MODULE_DEVICE_TABLE so vmwgfx loads at boot
    - LP: #1039157

  [ Stefan Bader ]

  * Revert "SAUCE: fix pv-ops for legacy Xen"
    - LP: #1044550

  [ Upstream Kernel Changes ]

  * KVM: Fix buffer overflow in kvm_set_irq()
    - LP: #1016298
    - CVE-2012-2137
  * VFS : mount lock scalability for internal mounts
    - LP: #990365
    - CVE-2012-2127
  * procfs: fix a vfsmount longterm reference leak
    - LP: #990365
    - CVE-2012-2127
  * eCryptfs: Copy up attributes of the lower target inode after rename
    - LP: #561129
  * eCryptfs: Write out all dirty pages just before releasing the lower
    file
    - LP: #1047261
  * eCryptfs: Call lower ->flush() from ecryptfs_flush()
    - LP: #1047261
  * USB: vt6656: remove __devinit* from the struct usb_device_id table
    - LP: #1052005
  * USB: emi62: remove __devinit* from the struct usb_device_id table
    - LP: #1052005
  * ALSA: hda - fix Copyright debug message
    - LP: #1052005
  * ARM: 7487/1: mm: avoid setting nG bit for user mappings that aren't
    present
    - LP: #1052005
  * ARM: 7488/1: mm: use 5 bits for swapfile type encoding
    - LP: #1052005
  * ARM: 7489/1: errata: fix workaround for erratum #720789 on UP systems
    - LP: #1052005
  * ARM: S3C24XX: Fix s3c2410_dma_enqueue parameters
    - LP: #1052005
  * ARM: imx: select CPU_FREQ_TABLE when needed
    - LP: #1052005
  * ASoC: wm9712: Fix microphone source selection
    - LP: #1052005
  * vfs: missed source of ->f_pos races
    - LP: #1052005
  * vfs: canonicalize create mode in build_open_flags()
    - LP: #1052005
  * alpha: Don't export SOCK_NONBLOCK to user space.
    - LP: #1052005
  * USB: winbond: remove __devinit* from the struct usb_device_id table
    - LP: #1052005
  * mm: hugetlbfs: correctly populate shared pmd
    - LP: #1052005
  * NFSv3: Ensure that do_proc_get_root() reports errors correctly
    - LP: #1052005
  * NFSv4.1: Remove a bogus BUG_ON() in nfs4_layoutreturn_done
    - LP: #1052005
  * NFS: Alias the nfs module to nfs4
    - LP: #1052005
  * audit: don't free_chunk() after fsnotify_add_mark()
    - LP: #1052005
  * audit: fix refcounting in audit-tree
    - LP: #1052005
  * svcrpc: fix BUG() in svc_tcp_clear_pages
    - LP: #1052005
  * svcrpc: fix svc_xprt_enqueue/svc_recv busy-looping
    - LP: #1052005
  * svcrpc: sends on closed socket should stop immediately
    - LP: #1052005
  * cciss: fix incorrect scsi status reporting
    - LP: #1052005
  * ACPI: export symbol acpi_get_table_with_size
    - LP: #1052005
  * ath9k: fix decrypt_error initialization in ath_rx_tasklet()
    - LP: #1052005
  * PCI: EHCI: Fix crash during hibernation on ASUS computers
    - LP: #1052005
  * block: replace __getblk_slow misfix by grow_dev_page fix
    - LP: #1052005
  * USB: spca506: remove __devinit* from the struct usb_device_id table
    - LP: #1052005
  * USB: p54usb: remove __devinit* from the struct usb_device_id ta...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ec2 - 2.6.32-349.55

---------------
linux-ec2 (2.6.32-349.55) lucid-proposed; urgency=low

  [ Stefan Bader ]

  * Revert "SAUCE: EC2: Backport changes to limit GSO segments"
    - LP: #1037456
    - CVE-2012-3412
  * Rebased to Ubuntu-2.6.32-44.98
  * Release Tracking Bug
    - LP: #1056081

  [ Ubuntu: 2.6.32-44.98 ]

  * SAUCE: drm/vmwgfx: add MODULE_DEVICE_TABLE so vmwgfx loads at boot
    - LP: #1039157
  * Revert "sfc: Fix maximum number of TSO segments and minimum TX queue
    size"
    - LP: #1037456
    - CVE-2012-3412
  * Revert "sfc: Replace some literal constants with
    EFX_PAGE_SIZE/EFX_BUF_SIZE"
    - LP: #1037456
    - CVE-2012-3412
  * Revert "tcp: Apply device TSO segment limit earlier"
    - LP: #1037456
    - CVE-2012-3412
  * Revert "tcp: do not scale TSO segment size with reordering degree"
    - LP: #1037456
    - CVE-2012-3412
  * Revert "net: Allow driver to limit number of GSO segments per skb"
    - LP: #1037456
    - CVE-2012-3412
  * cred: copy_process() should clear child->replacement_session_keyring
    - LP: #1023535
    - CVE-2012-2745
  * KVM: Change irq routing table to use gsi indexed array
    - LP: #1016298
    - CVE-2012-2137
  * KVM: Fix buffer overflow in kvm_set_irq()
    - LP: #1016298
    - CVE-2012-2137
  * xen: just completely disable XSAVE
    - LP: #1044550
  * xen: Allow PV-OPS kernel to detect whether XSAVE is supported
    - LP: #1044550
  * sfc: Fix maximum number of TSO segments and minimum TX queue size
    - LP: #1037456
    - CVE-2012-3412
 -- Stefan Bader <email address hidden> Fri, 28 Sep 2012 15:24:48 +0200

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 3.0.0-26.43

---------------
linux (3.0.0-26.43) oneiric-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1055532

  [ Dave Airlie ]

  * SAUCE: drm/vmwgfx: add MODULE_DEVICE_TABLE so vmwgfx loads at boot
    - LP: #1039157

  [ Stefan Bader ]

  * Revert "SAUCE: fix pv-ops for legacy Xen"
    - LP: #1044550

  [ Upstream Kernel Changes ]

  * KVM: Fix buffer overflow in kvm_set_irq()
    - LP: #1016298
    - CVE-2012-2137
  * VFS : mount lock scalability for internal mounts
    - LP: #990365
    - CVE-2012-2127
  * procfs: fix a vfsmount longterm reference leak
    - LP: #990365
    - CVE-2012-2127
  * eCryptfs: Copy up attributes of the lower target inode after rename
    - LP: #561129
  * eCryptfs: Write out all dirty pages just before releasing the lower
    file
    - LP: #1047261
  * eCryptfs: Call lower ->flush() from ecryptfs_flush()
    - LP: #1047261
  * USB: vt6656: remove __devinit* from the struct usb_device_id table
    - LP: #1052005
  * USB: emi62: remove __devinit* from the struct usb_device_id table
    - LP: #1052005
  * ALSA: hda - fix Copyright debug message
    - LP: #1052005
  * ARM: 7487/1: mm: avoid setting nG bit for user mappings that aren't
    present
    - LP: #1052005
  * ARM: 7488/1: mm: use 5 bits for swapfile type encoding
    - LP: #1052005
  * ARM: 7489/1: errata: fix workaround for erratum #720789 on UP systems
    - LP: #1052005
  * ARM: S3C24XX: Fix s3c2410_dma_enqueue parameters
    - LP: #1052005
  * ARM: imx: select CPU_FREQ_TABLE when needed
    - LP: #1052005
  * ASoC: wm9712: Fix microphone source selection
    - LP: #1052005
  * vfs: missed source of ->f_pos races
    - LP: #1052005
  * vfs: canonicalize create mode in build_open_flags()
    - LP: #1052005
  * alpha: Don't export SOCK_NONBLOCK to user space.
    - LP: #1052005
  * USB: winbond: remove __devinit* from the struct usb_device_id table
    - LP: #1052005
  * mm: hugetlbfs: correctly populate shared pmd
    - LP: #1052005
  * NFSv3: Ensure that do_proc_get_root() reports errors correctly
    - LP: #1052005
  * NFSv4.1: Remove a bogus BUG_ON() in nfs4_layoutreturn_done
    - LP: #1052005
  * NFS: Alias the nfs module to nfs4
    - LP: #1052005
  * audit: don't free_chunk() after fsnotify_add_mark()
    - LP: #1052005
  * audit: fix refcounting in audit-tree
    - LP: #1052005
  * svcrpc: fix BUG() in svc_tcp_clear_pages
    - LP: #1052005
  * svcrpc: fix svc_xprt_enqueue/svc_recv busy-looping
    - LP: #1052005
  * svcrpc: sends on closed socket should stop immediately
    - LP: #1052005
  * cciss: fix incorrect scsi status reporting
    - LP: #1052005
  * ACPI: export symbol acpi_get_table_with_size
    - LP: #1052005
  * ath9k: fix decrypt_error initialization in ath_rx_tasklet()
    - LP: #1052005
  * PCI: EHCI: Fix crash during hibernation on ASUS computers
    - LP: #1052005
  * block: replace __getblk_slow misfix by grow_dev_page fix
    - LP: #1052005
  * USB: spca506: remove __devinit* from the struct usb_device_id table
    - LP: #1052005
  * USB: p54usb: remove __devinit* from the struct usb_device_id table
    - LP: #1052005
  * USB: rtl8187: remove __devi...

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux - 2.6.32-44.98

---------------
linux (2.6.32-44.98) lucid-proposed; urgency=low

  [Luis Henriques]

  * Release Tracking Bug
    - LP: #1055438

  [ Dave Airlie ]

  * SAUCE: drm/vmwgfx: add MODULE_DEVICE_TABLE so vmwgfx loads at boot
    - LP: #1039157

  [ Upstream Kernel Changes ]

  * Revert "sfc: Fix maximum number of TSO segments and minimum TX queue
    size"
    - LP: #1037456
    - CVE-2012-3412
  * Revert "sfc: Replace some literal constants with
    EFX_PAGE_SIZE/EFX_BUF_SIZE"
    - LP: #1037456
    - CVE-2012-3412
  * Revert "tcp: Apply device TSO segment limit earlier"
    - LP: #1037456
    - CVE-2012-3412
  * Revert "tcp: do not scale TSO segment size with reordering degree"
    - LP: #1037456
    - CVE-2012-3412
  * Revert "net: Allow driver to limit number of GSO segments per skb"
    - LP: #1037456
    - CVE-2012-3412
  * cred: copy_process() should clear child->replacement_session_keyring
    - LP: #1023535
    - CVE-2012-2745
  * KVM: Change irq routing table to use gsi indexed array
    - LP: #1016298
    - CVE-2012-2137
  * KVM: Fix buffer overflow in kvm_set_irq()
    - LP: #1016298
    - CVE-2012-2137
  * xen: just completely disable XSAVE
    - LP: #1044550
  * xen: Allow PV-OPS kernel to detect whether XSAVE is supported
    - LP: #1044550
  * sfc: Fix maximum number of TSO segments and minimum TX queue size
    - LP: #1037456
    - CVE-2012-3412
 -- Tim Gardner <email address hidden> Thu, 06 Sep 2012 11:20:13 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-ti-omap4 - 3.0.0-1216.29

---------------
linux-ti-omap4 (3.0.0-1216.29) oneiric-proposed; urgency=low

  * Release Tracking Bug
    - LP: #1056605

  [ Paolo Pisati ]

  * rebased on Ubuntu-3.0.0-26.43

  [ Ubuntu: 3.0.0-26.43 ]

  * Release Tracking Bug
    - LP: #1055532
  * SAUCE: drm/vmwgfx: add MODULE_DEVICE_TABLE so vmwgfx loads at boot
    - LP: #1039157
  * Revert "SAUCE: fix pv-ops for legacy Xen"
    - LP: #1044550
  * KVM: Fix buffer overflow in kvm_set_irq()
    - LP: #1016298
    - CVE-2012-2137
  * VFS : mount lock scalability for internal mounts
    - LP: #990365
    - CVE-2012-2127
  * procfs: fix a vfsmount longterm reference leak
    - LP: #990365
    - CVE-2012-2127
  * eCryptfs: Copy up attributes of the lower target inode after rename
    - LP: #561129
  * eCryptfs: Write out all dirty pages just before releasing the lower
    file
    - LP: #1047261
  * eCryptfs: Call lower ->flush() from ecryptfs_flush()
    - LP: #1047261
  * USB: vt6656: remove __devinit* from the struct usb_device_id table
    - LP: #1052005
  * USB: emi62: remove __devinit* from the struct usb_device_id table
    - LP: #1052005
  * ALSA: hda - fix Copyright debug message
    - LP: #1052005
  * ARM: 7487/1: mm: avoid setting nG bit for user mappings that aren't
    present
    - LP: #1052005
  * ARM: 7488/1: mm: use 5 bits for swapfile type encoding
    - LP: #1052005
  * ARM: 7489/1: errata: fix workaround for erratum #720789 on UP systems
    - LP: #1052005
  * ARM: S3C24XX: Fix s3c2410_dma_enqueue parameters
    - LP: #1052005
  * ARM: imx: select CPU_FREQ_TABLE when needed
    - LP: #1052005
  * ASoC: wm9712: Fix microphone source selection
    - LP: #1052005
  * vfs: missed source of ->f_pos races
    - LP: #1052005
  * vfs: canonicalize create mode in build_open_flags()
    - LP: #1052005
  * alpha: Don't export SOCK_NONBLOCK to user space.
    - LP: #1052005
  * USB: winbond: remove __devinit* from the struct usb_device_id table
    - LP: #1052005
  * mm: hugetlbfs: correctly populate shared pmd
    - LP: #1052005
  * NFSv3: Ensure that do_proc_get_root() reports errors correctly
    - LP: #1052005
  * NFSv4.1: Remove a bogus BUG_ON() in nfs4_layoutreturn_done
    - LP: #1052005
  * NFS: Alias the nfs module to nfs4
    - LP: #1052005
  * audit: don't free_chunk() after fsnotify_add_mark()
    - LP: #1052005
  * audit: fix refcounting in audit-tree
    - LP: #1052005
  * svcrpc: fix BUG() in svc_tcp_clear_pages
    - LP: #1052005
  * svcrpc: fix svc_xprt_enqueue/svc_recv busy-looping
    - LP: #1052005
  * svcrpc: sends on closed socket should stop immediately
    - LP: #1052005
  * cciss: fix incorrect scsi status reporting
    - LP: #1052005
  * ACPI: export symbol acpi_get_table_with_size
    - LP: #1052005
  * ath9k: fix decrypt_error initialization in ath_rx_tasklet()
    - LP: #1052005
  * PCI: EHCI: Fix crash during hibernation on ASUS computers
    - LP: #1052005
  * block: replace __getblk_slow misfix by grow_dev_page fix
    - LP: #1052005
  * USB: spca506: remove __devinit* from the struct usb_device_id table
    - LP: #1052005
  * USB: p54usb: remove __devinit* from the struct usb_device_id ...

[Jamie Strandboge (jdstrand)]

Thank you for reporting this bug to Ubuntu. lucid has reached EOL
(End of Life) and is no longer supported. As a result, this bug
against lucid is being marked "Won't Fix". Please see
https://wiki.ubuntu.com/Releases for currently supported Ubuntu
releases.

Please feel free to report any other bugs you may find.

[Andy Whitcroft (apw)]

This bug was nominated against a series that is no longer supported, ie vivid. The bug task representing the vivid nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.