Ubuntu
linux package

CVE-2014-0055

Bug #1298117 reported by John Johansen on 2014-03-27

256

This bug affects 1 person

	Status	Importance	Assigned to
linux (Ubuntu)	Invalid	Medium	Unassigned
Precise	Fix Released	Medium	Unassigned
Trusty	Invalid	Medium	Unassigned
Vivid	Invalid	Medium	Unassigned
Wily	Invalid	Medium	Unassigned
Xenial	Invalid	Medium	Unassigned
Yakkety	Invalid	Medium	Unassigned
linux-armadaxp (Ubuntu)	Invalid	Medium	Unassigned
Precise	Fix Released	Medium	Unassigned
Trusty	Invalid	Medium	Unassigned
Vivid	Invalid	Medium	Unassigned
Wily	Invalid	Medium	Unassigned
Xenial	Invalid	Medium	Unassigned
Yakkety	Invalid	Medium	Unassigned
linux-ec2 (Ubuntu)	Invalid	Medium	Unassigned
Precise	Invalid	Medium	Unassigned
Trusty	Invalid	Medium	Unassigned
Vivid	Invalid	Medium	Unassigned
Wily	Invalid	Medium	Unassigned
Xenial	Invalid	Medium	Unassigned
Yakkety	Invalid	Medium	Unassigned
linux-flo (Ubuntu)	New	Medium	Unassigned
Precise	Invalid	Medium	Unassigned
Trusty	Invalid	Medium	Unassigned
Vivid	Won't Fix	Medium	Unassigned
Wily	New	Medium	Unassigned
Xenial	New	Medium	Unassigned
Yakkety	New	Medium	Unassigned
linux-fsl-imx51 (Ubuntu)	Invalid	Medium	Unassigned
Precise	Invalid	Medium	Unassigned
Trusty	Invalid	Medium	Unassigned
Vivid	Invalid	Medium	Unassigned
Wily	Invalid	Medium	Unassigned
Xenial	Invalid	Medium	Unassigned
Yakkety	Invalid	Medium	Unassigned
linux-goldfish (Ubuntu)	New	Medium	Unassigned
Precise	Invalid	Medium	Unassigned
Trusty	Invalid	Medium	Unassigned
Vivid	Won't Fix	Medium	Unassigned
Wily	New	Medium	Unassigned
Xenial	New	Medium	Unassigned
Yakkety	New	Medium	Unassigned
linux-lts-backport-maverick (Ubuntu)	Won't Fix	Undecided	Unassigned
Lucid	Won't Fix	Undecided	Unassigned
Precise	Won't Fix	Undecided	Unassigned
Quantal	Won't Fix	Undecided	Unassigned
Saucy	Won't Fix	Undecided	Unassigned
Trusty	Won't Fix	Undecided	Unassigned
Utopic	Won't Fix	Undecided	Unassigned
Vivid	Won't Fix	Undecided	Unassigned
Wily	Won't Fix	Undecided	Unassigned
Xenial	Won't Fix	Undecided	Unassigned
Yakkety	Won't Fix	Undecided	Unassigned
linux-lts-backport-natty (Ubuntu)	Won't Fix	Undecided	Unassigned
Lucid	Won't Fix	Undecided	Unassigned
Precise	Won't Fix	Undecided	Unassigned
Quantal	Won't Fix	Undecided	Unassigned
Saucy	Won't Fix	Undecided	Unassigned
Trusty	Won't Fix	Undecided	Unassigned
Utopic	Won't Fix	Undecided	Unassigned
Vivid	Won't Fix	Undecided	Unassigned
Wily	Won't Fix	Undecided	Unassigned
Xenial	Won't Fix	Undecided	Unassigned
Yakkety	Won't Fix	Undecided	Unassigned
linux-lts-quantal (Ubuntu)	Invalid	Medium	Unassigned
Precise	Fix Released	Medium	Unassigned
Trusty	Invalid	Medium	Unassigned
Vivid	Invalid	Medium	Unassigned
Wily	Invalid	Medium	Unassigned
Xenial	Invalid	Medium	Unassigned
Yakkety	Invalid	Medium	Unassigned
linux-lts-raring (Ubuntu)	Invalid	Medium	Unassigned
Precise	Fix Released	Medium	Unassigned
Trusty	Invalid	Medium	Unassigned
Vivid	Invalid	Medium	Unassigned
Wily	Invalid	Medium	Unassigned
Xenial	Invalid	Medium	Unassigned
Yakkety	Invalid	Medium	Unassigned
linux-lts-saucy (Ubuntu)	Invalid	Medium	Unassigned
Precise	Fix Released	Medium	Unassigned
Trusty	Invalid	Medium	Unassigned
Vivid	Invalid	Medium	Unassigned
Wily	Invalid	Medium	Unassigned
Xenial	Invalid	Medium	Unassigned
Yakkety	Invalid	Medium	Unassigned
linux-lts-trusty (Ubuntu)	Invalid	Medium	Unassigned
Precise	Invalid	Medium	Unassigned
Trusty	Invalid	Medium	Unassigned
Vivid	Invalid	Medium	Unassigned
Wily	Invalid	Medium	Unassigned
Xenial	Invalid	Medium	Unassigned
Yakkety	Invalid	Medium	Unassigned
linux-lts-utopic (Ubuntu)	Invalid	Medium	Unassigned
Precise	Invalid	Medium	Unassigned
Trusty	Invalid	Medium	Unassigned
Vivid	Invalid	Medium	Unassigned
Wily	Invalid	Medium	Unassigned
Xenial	Invalid	Medium	Unassigned
Yakkety	Invalid	Medium	Unassigned
linux-lts-vivid (Ubuntu)	Invalid	Medium	Unassigned
Precise	Invalid	Medium	Unassigned
Trusty	Fix Committed	Medium	Unassigned
Vivid	Invalid	Medium	Unassigned
Wily	Invalid	Medium	Unassigned
Xenial	Invalid	Medium	Unassigned
Yakkety	Invalid	Medium	Unassigned
linux-lts-wily (Ubuntu)	Invalid	Medium	Unassigned
Precise	Invalid	Medium	Unassigned
Trusty	Invalid	Medium	Unassigned
Vivid	Invalid	Medium	Unassigned
Wily	Invalid	Medium	Unassigned
Xenial	Invalid	Medium	Unassigned
Yakkety	Invalid	Medium	Unassigned
linux-lts-xenial (Ubuntu)	Invalid	Medium	Unassigned
Precise	Invalid	Medium	Unassigned
Trusty	Fix Committed	Medium	Unassigned
Vivid	New	Undecided	Unassigned
Wily	Invalid	Medium	Unassigned
Xenial	Invalid	Medium	Unassigned
Yakkety	Invalid	Medium	Unassigned
linux-mako (Ubuntu)	New	Medium	Unassigned
Precise	Invalid	Medium	Unassigned
Trusty	Invalid	Medium	Unassigned
Vivid	New	Medium	Unassigned
Wily	New	Medium	Unassigned
Xenial	New	Medium	Unassigned
Yakkety	New	Medium	Unassigned
linux-manta (Ubuntu)	Invalid	Medium	Unassigned
Precise	Invalid	Medium	Unassigned
Trusty	Invalid	Medium	Unassigned
Vivid	Won't Fix	Medium	Unassigned
Wily	New	Medium	Unassigned
Xenial	Invalid	Medium	Unassigned
Yakkety	Invalid	Medium	Unassigned
linux-mvl-dove (Ubuntu)	Invalid	Medium	Unassigned
Precise	Invalid	Medium	Unassigned
Trusty	Invalid	Medium	Unassigned
Vivid	Invalid	Medium	Unassigned
Wily	Invalid	Medium	Unassigned
Xenial	Invalid	Medium	Unassigned
Yakkety	Invalid	Medium	Unassigned
linux-raspi2 (Ubuntu)	Fix Committed	Medium	Unassigned
Precise	Invalid	Medium	Unassigned
Trusty	Invalid	Medium	Unassigned
Vivid	Invalid	Medium	Unassigned
Wily	Invalid	Medium	Unassigned
Xenial	Fix Committed	Medium	Unassigned
Yakkety	Fix Committed	Medium	Unassigned
linux-snapdragon (Ubuntu)	Invalid	Medium	Unassigned
Precise	Invalid	Medium	Unassigned
Trusty	Invalid	Medium	Unassigned
Vivid	New	Undecided	Unassigned
Wily	Invalid	Medium	Unassigned
Xenial	Invalid	Medium	Unassigned
Yakkety	Invalid	Medium	Unassigned
linux-ti-omap4 (Ubuntu)	Invalid	Medium	Unassigned
Precise	Fix Released	Medium	Unassigned
Trusty	Invalid	Medium	Unassigned
Vivid	Invalid	Medium	Unassigned
Wily	Invalid	Medium	Unassigned
Xenial	Invalid	Medium	Unassigned
Yakkety	Invalid	Medium	Unassigned

Bug Description

The get_rx_bufs function in drivers/vhost/net.c in the vhost-net subsystem in the Linux kernel package before 2.6.32-431.11.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly handle vhost_get_vq_desc errors, which allows guest OS users to cause a denial of service (host OS crash) via unspecified vectors.

Break-Fix: 8dd014adfea6f173c1ef6378f7e5e7924866c923 a39ee449f96a2cd44ce056d8a0a112211a9b1a1f

See original description

Tags:

CVE References

Revision history for this message

John Johansen (jjohansen) wrote on 2014-03-27:

CVE-2014-0055

tags:	added: kernel-cve-tracking-bug
information type:	Public → Public Security
Changed in linux-armadaxp (Ubuntu Saucy):
status:	New → Invalid
Changed in linux-armadaxp (Ubuntu Lucid):
status:	New → Invalid
Changed in linux-armadaxp (Ubuntu Trusty):
status:	New → Invalid
Changed in linux-ec2 (Ubuntu Precise):
status:	New → Invalid
Changed in linux-ec2 (Ubuntu Saucy):
status:	New → Invalid
Changed in linux-ec2 (Ubuntu Trusty):
status:	New → Invalid
Changed in linux-ec2 (Ubuntu Quantal):
status:	New → Invalid
Changed in linux-lts-quantal (Ubuntu Saucy):
status:	New → Invalid
Changed in linux-lts-quantal (Ubuntu Lucid):
status:	New → Invalid
Changed in linux-lts-quantal (Ubuntu Trusty):
status:	New → Invalid
Changed in linux-lts-quantal (Ubuntu Quantal):
status:	New → Invalid
Changed in linux-mvl-dove (Ubuntu Precise):
status:	New → Invalid
Changed in linux-mvl-dove (Ubuntu Saucy):
status:	New → Invalid
Changed in linux-mvl-dove (Ubuntu Trusty):
status:	New → Invalid
Changed in linux-mvl-dove (Ubuntu Quantal):
status:	New → Invalid
Changed in linux-lts-saucy (Ubuntu Saucy):
status:	New → Invalid
Changed in linux-lts-saucy (Ubuntu Lucid):
status:	New → Invalid
Changed in linux-lts-saucy (Ubuntu Trusty):
status:	New → Invalid
Changed in linux-lts-saucy (Ubuntu Quantal):
status:	New → Invalid
Changed in linux-ti-omap4 (Ubuntu Lucid):
status:	New → Invalid
Changed in linux-ti-omap4 (Ubuntu Trusty):
status:	New → Invalid
Changed in linux-fsl-imx51 (Ubuntu Precise):
status:	New → Invalid
Changed in linux-fsl-imx51 (Ubuntu Saucy):
status:	New → Invalid
Changed in linux-fsl-imx51 (Ubuntu Trusty):
status:	New → Invalid
Changed in linux-fsl-imx51 (Ubuntu Quantal):
status:	New → Invalid
Changed in linux-lts-raring (Ubuntu Saucy):
status:	New → Invalid
Changed in linux-lts-raring (Ubuntu Lucid):
status:	New → Invalid
Changed in linux-lts-raring (Ubuntu Trusty):
status:	New → Invalid
Changed in linux-lts-raring (Ubuntu Quantal):
status:	New → Invalid
description:	updated
Changed in linux-armadaxp (Ubuntu Precise):
importance:	Undecided → Medium
Changed in linux-armadaxp (Ubuntu Saucy):
importance:	Undecided → Medium
Changed in linux-armadaxp (Ubuntu Lucid):
importance:	Undecided → Medium
Changed in linux-armadaxp (Ubuntu Trusty):
importance:	Undecided → Medium
Changed in linux-armadaxp (Ubuntu Quantal):
importance:	Undecided → Medium
Changed in linux-ec2 (Ubuntu Precise):
importance:	Undecided → Medium
Changed in linux-ec2 (Ubuntu Saucy):
importance:	Undecided → Medium
Changed in linux-ec2 (Ubuntu Lucid):
importance:	Undecided → Medium
Changed in linux-ec2 (Ubuntu Trusty):
importance:	Undecided → Medium
Changed in linux-ec2 (Ubuntu Quantal):
importance:	Undecided → Medium
Changed in linux-lts-quantal (Ubuntu Precise):
importance:	Undecided → Medium
Changed in linux-lts-quantal (Ubuntu Saucy):
importance:	Undecided → Medium
Changed in linux-lts-quantal (Ubuntu Lucid):
importance:	Undecided → Medium
Changed in linux-lts-quantal (Ubuntu Trusty):
importance:	Undecided → Medium
Changed in linux-lts-quantal (Ubuntu Quantal):
importance:	Undecided → Medium
Changed in linux-mvl-dove (Ubuntu Precise):
importance:	Undecided → Medium
Changed in linux-mvl-dove (Ubuntu Saucy):
importance:	Undecided → Medium
Changed in linux-mvl-dove (Ubuntu Lucid):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-mvl-dove (Ubuntu Trusty):
importance:	Undecided → Medium
Changed in linux-mvl-dove (Ubuntu Quantal):
importance:	Undecided → Medium
Changed in linux-lts-saucy (Ubuntu Precise):
importance:	Undecided → Medium
Changed in linux-lts-saucy (Ubuntu Saucy):
importance:	Undecided → Medium
Changed in linux-lts-saucy (Ubuntu Lucid):
importance:	Undecided → Medium
Changed in linux-lts-saucy (Ubuntu Trusty):
importance:	Undecided → Medium
Changed in linux-lts-saucy (Ubuntu Quantal):
importance:	Undecided → Medium
Changed in linux (Ubuntu Precise):
importance:	Undecided → Medium
Changed in linux (Ubuntu Saucy):
importance:	Undecided → Medium
Changed in linux (Ubuntu Lucid):
importance:	Undecided → Medium
Changed in linux (Ubuntu Trusty):
importance:	Undecided → Medium
Changed in linux (Ubuntu Quantal):
importance:	Undecided → Medium
Changed in linux-ti-omap4 (Ubuntu Precise):
importance:	Undecided → Medium
Changed in linux-ti-omap4 (Ubuntu Saucy):
importance:	Undecided → Medium
Changed in linux-ti-omap4 (Ubuntu Lucid):
importance:	Undecided → Medium
Changed in linux-ti-omap4 (Ubuntu Trusty):
importance:	Undecided → Medium
Changed in linux-ti-omap4 (Ubuntu Quantal):
importance:	Undecided → Medium
Changed in linux-fsl-imx51 (Ubuntu Precise):
importance:	Undecided → Medium
Changed in linux-fsl-imx51 (Ubuntu Saucy):
importance:	Undecided → Medium

John Johansen (jjohansen) on 2014-03-27

Changed in linux-fsl-imx51 (Ubuntu Lucid):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-fsl-imx51 (Ubuntu Trusty):
importance:	Undecided → Medium
Changed in linux-fsl-imx51 (Ubuntu Quantal):
importance:	Undecided → Medium
Changed in linux-lts-raring (Ubuntu Precise):
importance:	Undecided → Medium
Changed in linux-lts-raring (Ubuntu Saucy):
importance:	Undecided → Medium
Changed in linux-lts-raring (Ubuntu Lucid):
importance:	Undecided → Medium
Changed in linux-lts-raring (Ubuntu Trusty):
importance:	Undecided → Medium
Changed in linux-lts-raring (Ubuntu Quantal):
importance:	Undecided → Medium

John Johansen (jjohansen) on 2014-04-03

Changed in linux (Ubuntu Trusty):
status:	New → Invalid
description:	updated

John Johansen (jjohansen) on 2014-04-09

Changed in linux-armadaxp (Ubuntu Quantal):
status:	New → Fix Committed
Changed in linux-ec2 (Ubuntu Lucid):
status:	New → Invalid
Changed in linux-lts-quantal (Ubuntu Precise):
status:	New → Fix Committed
Changed in linux (Ubuntu Lucid):
status:	New → Invalid
Changed in linux (Ubuntu Quantal):
status:	New → Fix Committed
Changed in linux-ti-omap4 (Ubuntu Saucy):
status:	New → Fix Committed
Changed in linux-ti-omap4 (Ubuntu Quantal):
status:	New → Fix Committed

Jamie Strandboge (jdstrand) on 2014-04-17

Changed in linux-lts-backport-maverick (Ubuntu Lucid):
status:	New → Won't Fix
Changed in linux-lts-backport-natty (Ubuntu Lucid):
status:	New → Won't Fix
Changed in linux-lts-backport-maverick (Ubuntu Precise):
status:	New → Won't Fix
Changed in linux-lts-backport-natty (Ubuntu Precise):
status:	New → Won't Fix
Changed in linux-lts-raring (Ubuntu Precise):
status:	New → Won't Fix
Changed in linux-lts-backport-maverick (Ubuntu Quantal):
status:	New → Won't Fix
Changed in linux-lts-backport-natty (Ubuntu Quantal):
status:	New → Won't Fix
Changed in linux-lts-backport-maverick (Ubuntu Saucy):
status:	New → Won't Fix
Changed in linux-lts-backport-natty (Ubuntu Saucy):
status:	New → Won't Fix
Changed in linux-lts-backport-maverick (Ubuntu Trusty):
status:	New → Won't Fix
Changed in linux-lts-backport-natty (Ubuntu Trusty):
status:	New → Won't Fix
Changed in linux-lts-backport-maverick (Ubuntu):
status:	New → Won't Fix
Changed in linux-lts-backport-natty (Ubuntu):
status:	New → Won't Fix

John Johansen (jjohansen) on 2014-04-25

Changed in linux-lts-saucy (Ubuntu Precise):
status:	New → Fix Committed
Changed in linux (Ubuntu Saucy):
status:	New → Fix Committed

John Johansen (jjohansen) on 2014-05-20

no longer affects:	linux-armadaxp (Ubuntu Quantal)
no longer affects:	linux-ec2 (Ubuntu Quantal)
no longer affects:	linux-lts-saucy (Ubuntu Quantal)
no longer affects:	linux-lts-quantal (Ubuntu Quantal)
no longer affects:	linux-mvl-dove (Ubuntu Quantal)
no longer affects:	linux (Ubuntu Quantal)
no longer affects:	linux-fsl-imx51 (Ubuntu Quantal)
no longer affects:	linux-ti-omap4 (Ubuntu Quantal)
no longer affects:	linux-lts-raring (Ubuntu Quantal)

John Johansen (jjohansen) on 2014-05-21

Changed in linux-armadaxp (Ubuntu Precise):
status:	New → Fix Committed
Changed in linux (Ubuntu Precise):
status:	New → Fix Committed
Changed in linux-ti-omap4 (Ubuntu Precise):
status:	New → Fix Committed

Revision history for this message

Launchpad Janitor (janitor) wrote on 2014-05-26:

Download full text (6.8 KiB)

This bug was fixed in the package linux-lts-quantal - 3.5.0-51.76~precise1

---------------
linux-lts-quantal (3.5.0-51.76~precise1) precise; urgency=low

[ Brad Figg ]

* Revert "rtlwifi: Set the link state"

[ Kamal Mostafa ]

* Release Tracking Bug
- re-used previous tracking bug

linux (3.5.0-51.75) quantal; urgency=low

[ Kamal Mostafa ]

  * Merged back Ubuntu-3.5.0-49.74 security release
  * Revert "n_tty: Fix n_tty_write crash when echoing in raw mode"
    - LP: #1314762
  * Release Tracking Bug
    - LP: #1317333

[ Upstream Kernel Changes ]

  * ipv6: don't set DST_NOCOUNT for remotely added routes
    - LP: #1293726
    - CVE-2014-2309
  * vhost: fix total length when packets are too short
    - LP: #1312984
    - CVE-2014-0077
  * n_tty: Fix n_tty_write crash when echoing in raw mode
    - LP: #1314762
    - CVE-2014-0196
  * floppy: ignore kernel-only members in FDRAWCMD ioctl input
    - LP: #1316729
    - CVE-2014-1737
  * floppy: don't write kernel-only members to FDRAWCMD ioctl output
    - LP: #1316735
    - CVE-2014-1738

linux (3.5.0-50.74) quantal; urgency=low

[ Joseph Salisbury ]

* Release Tracking Bug
- LP: #1313852

[ Upstream Kernel Changes ]

This bug was fixed in the package linux-lts-quantal - 3.5.0-51.76~precise1

---------------
linux-lts-quantal (3.5.0-51.76~precise1) precise; urgency=low

[ Brad Figg ]

* Revert "rtlwifi: Set the link state"

[ Kamal Mostafa ]

* Release Tracking Bug
    - re-used previous tracking bug

linux (3.5.0-51.75) quantal; urgency=low

[ Kamal Mostafa ]

* Merged back Ubuntu-3.5.0-49.74 security release
  * Revert "n_tty: Fix n_tty_write crash when echoing in raw mode"
    - LP: #1314762
  * Release Tracking Bug
    - LP: #1317333

[ Upstream Kernel Changes ]

linux (3.5.0-50.74) quantal; urgency=low

[ Joseph Salisbury ]

* Release Tracking Bug
    - LP: #1313852

[ Upstream Kernel Changes ]

* rds: prevent dereference of a NULL device in rds_iw_laddr_check
    - LP: #1302222
    - CVE-2014-2678
  * vhost: validate vhost_get_vq_desc return value
    - LP: #1298117
    - CVE-2014-0055
  * netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages
    - LP: #1295090
    - CVE-2014-2523
  * ALSA: oxygen: Xonar DG(X): capture from I2S channel 1, not 2
    - LP: #1310783
  * ALSA: oxygen: Xonar DG(X): modify DAC routing
    - LP: #1310783
  * mac80211: fix AP powersave TX vs. wakeup race
    - LP: #1310783
  * iwlwifi: dvm: clear IWL_STA_UCODE_INPROGRESS when assoc fails
    - LP: #1310783
  * ath9k: protect tid->sched check
    - LP: #1310783
  * ath9k: Fix ETSI compliance for AR9462 2.0
    - LP: #1310783
  * genirq: Remove racy waitqueue_active check
    - LP: #1310783
  * sched: Fix double normalization of vruntime
    - LP: #1310783
  * cpuset: fix a race condition in __cpuset_node_allowed_softwall()
    - LP: #1310783
  * firewire: net: fix use after free
    - LP: #1310783
  * mwifiex: do not advertise usb autosuspend support
    - LP: #1310783
  * NFS: Fix a delegation callback race
    - LP: #1310783
  * can: flexcan: fix shutdown: first disable chip, then all interrupts
    - LP: #1310783
  * can: flexcan: flexcan_open(): fix error path if flexcan_chip_start()
    fails
    - LP: #1310783
  * tracing: Do not add event files for modules that fail tracepoints
    - LP: #1310783
  * ocfs2: fix quota file corruption
    - LP: #1310783
  * rapidio/tsi721: fix tasklet termination in dma channel release
    - LP: #1310783
  * ALSA: usb-audio: Add quirk for Logitech Webcam C500
    - LP: #1310783
  * drm/radeon: TTM must be init with cpu-visible VRAM, v2
    - LP: #1310783
  * drm/radeon/atom: select the proper number of lanes in transmitter setup
    - LP: #1310783
  * powerpc: Align p_dyn, p_rela and p_st symbols
    - LP: #1310783
  * libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for Seagate Momentus
    SpinPoint M8 (2BA30001)
    - LP: #1310783
  * usb: Add device quirk for Logitech HD Pro Webcams C920 and C930e
    - LP: #1310783
  * usb: Make DELAY_INIT quirk wait 100ms between Get Configuration
    requests
    - LP: #1310783
  * ARM: 7991/1: sa1100: fix compile problem on Collie
    - LP: #1310783
  * firewire: don't use PREPARE_DELAYED_WORK
    - LP: #1310783
  * x86: Ignore NMIs that come in during early boot
    - LP: #1310783
  * x86: fix compile error due to X86_TRAP_NMI use in asm files
    - LP: #1310783
  * virtio-net: alloc big buffers also when guest can receive UFO
    - LP: #1310783
  * tg3: Don't check undefined error bits in RXBD
    - LP: #1310783
  * net: sctp: fix sctp_sf_do_5_1D_ce to verify if we/peer is AUTH capable
    - LP: #1310783
  * usb: dwc3: add support for Merrifield
    - LP: #1310783
  * mac80211: clear sequence/fragment number in QoS-null frames
    - LP: #1310783
  * mwifiex: copy AP's HT capability info correctly
    - LP: #1310783
  * net: unix socket code abuses csum_partial
    - LP: #1310783
  * ibmveth: Fix endian issues with MAC addresses
    - LP: #1310783
  * [SCSI] isci: fix reset timeout handling
    - LP: #1310783
  * [SCSI] isci: correct erroneous for_each_isci_host macro
    - LP: #1310783
  * [SCSI] qla2xxx: Poll during initialization for ISP25xx and ISP83xx
    - LP: #1310783
  * ocfs2 syncs the wrong range...
    - LP: #1310783
  * fs/proc/base.c: fix GPF in /proc/$PID/map_files
    - LP: #1310783
  * vmxnet3: fix netpoll race condition
    - LP: #1310783
  * [SCSI] storvsc: NULL pointer dereference fix
    - LP: #1310783
  * PCI: Enable INTx in pci_reenable_device() only when MSI/MSI-X not
    enabled
    - LP: #1310783
  * KVM: SVM: fix cr8 intercept window
    - LP: #1310783
  * drm/ttm: don't oops if no invalidate_caches()
    - LP: #1310783
  * vmxnet3: fix building without CONFIG_PCI_MSI
    - LP: #1310783
  * x86/amd/numa: Fix northbridge quirk to assign correct NUMA node
    - LP: #1310783
  * Btrfs: fix data corruption when reading/updating compressed extents
    - LP: #1310783
  * jiffies: Avoid undefined behavior from signed overflow
    - LP: #1310783
  * ALSA: compress: Pass through return value of open ops callback
    - LP: #1310783
  * acpi-cpufreq: set current frequency based on target P-State
    - LP: #1310783
  * hpfs: deadlock and race in directory lseek()
    - LP: #1310783
  * intel_idle: Check cpu_idle_get_driver() for NULL before dereferencing
    it.
    - LP: #1310783
  * ipc/msg: fix race around refcount
    - LP: #1310783
  * Input: synaptics - add manual min/max quirk
    - LP: #1310783
  * Input: synaptics - add manual min/max quirk for ThinkPad X240
    - LP: #1310783
  * x86: fix boot on uniprocessor systems
    - LP: #1310783
  * staging: speakup: Prefix externally-visible symbols
    - LP: #1310783
  * ext4: atomically set inode->i_flags in ext4_set_inode_flags()
    - LP: #1310783
  * deb-pkg: Fix cross-building linux-headers package
    - LP: #1310783
  * x86: bpf_jit: support negative offsets
    - LP: #1310783
  * p54: clamp properly instead of just truncating
    - LP: #1310783
  * ALSA: hda/realtek - Avoid invalid COEFs for ALC271X
    - LP: #1310783
  * of: Fix address decoding on Bimini and js2x machines
    - LP: #1310783
  * of: fix PCI bus match for PCIe slots
    - LP: #1310783
  * libata: disable LPM for some WD SATA-I devices
    - LP: #1310783
  * mmc: sdhci: fix lockdep error in tuning routine
    - LP: #1310783
  * usb: ehci: add freescale imx28 special write register method
    - LP: #1310783
  * USB: pl2303: fix data corruption on termios updates
    - LP: #1310783
  * Linux 3.5.7.33
    - LP: #1310783
  * net: ipv4: current group_info should be put after using.
    - CVE-2014-2851
 -- Kamal Mostafa <kamal@canonical.com>   Fri, 16 May 2014 09:12:33 -0700

Changed in linux-lts-quantal (Ubuntu Precise):
status:	Fix Committed → Fix Released

John Johansen (jjohansen) on 2014-05-28

Changed in linux-lts-saucy (Ubuntu Precise):
status:	Fix Committed → Fix Released
Changed in linux (Ubuntu Saucy):
status:	Fix Committed → Fix Released
Changed in linux-lts-raring (Ubuntu Precise):
status:	Won't Fix → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2014-06-03:

Download full text (6.7 KiB)

This bug was fixed in the package linux-ti-omap4 - 3.5.0-242.58

---------------
linux-ti-omap4 (3.5.0-242.58) quantal; urgency=low

* Release Tracking Bug
- LP: #1317330

[ Paolo Pisati ]

* rebased on Ubuntu-3.5.0-51.75

[ Ubuntu: 3.5.0-51.75 ]

  * Merged back Ubuntu-3.5.0-49.74 security release
  * Revert "n_tty: Fix n_tty_write crash when echoing in raw mode"
    - LP: #1314762
  * Release Tracking Bug
    - LP: #1317227
  * ipv6: don't set DST_NOCOUNT for remotely added routes
    - LP: #1293726
    - CVE-2014-2309
  * vhost: fix total length when packets are too short
    - LP: #1312984
    - CVE-2014-0077
  * n_tty: Fix n_tty_write crash when echoing in raw mode
    - LP: #1314762
    - CVE-2014-0196
  * floppy: ignore kernel-only members in FDRAWCMD ioctl input
    - LP: #1316729
    - CVE-2014-1737
  * floppy: don't write kernel-only members to FDRAWCMD ioctl output
    - LP: #1316735
    - CVE-2014-1738

[ Ubuntu: 3.5.0-50.74 ]

This bug was fixed in the package linux-ti-omap4 - 3.5.0-242.58

---------------
linux-ti-omap4 (3.5.0-242.58) quantal; urgency=low

* Release Tracking Bug
    - LP: #1317330

[ Paolo Pisati ]

* rebased on Ubuntu-3.5.0-51.75

[ Ubuntu: 3.5.0-51.75 ]

[ Ubuntu: 3.5.0-50.74 ]

* Release Tracking Bug
    - LP: #1313852
  * rds: prevent dereference of a NULL device in rds_iw_laddr_check
    - LP: #1302222
    - CVE-2014-2678
  * vhost: validate vhost_get_vq_desc return value
    - LP: #1298117
    - CVE-2014-0055
  * netfilter: nf_conntrack_dccp: fix skb_header_pointer API usages
    - LP: #1295090
    - CVE-2014-2523
  * ALSA: oxygen: Xonar DG(X): capture from I2S channel 1, not 2
    - LP: #1310783
  * ALSA: oxygen: Xonar DG(X): modify DAC routing
    - LP: #1310783
  * mac80211: fix AP powersave TX vs. wakeup race
    - LP: #1310783
  * iwlwifi: dvm: clear IWL_STA_UCODE_INPROGRESS when assoc fails
    - LP: #1310783
  * ath9k: protect tid->sched check
    - LP: #1310783
  * ath9k: Fix ETSI compliance for AR9462 2.0
    - LP: #1310783
  * genirq: Remove racy waitqueue_active check
    - LP: #1310783
  * sched: Fix double normalization of vruntime
    - LP: #1310783
  * cpuset: fix a race condition in __cpuset_node_allowed_softwall()
    - LP: #1310783
  * firewire: net: fix use after free
    - LP: #1310783
  * mwifiex: do not advertise usb autosuspend support
    - LP: #1310783
  * NFS: Fix a delegation callback race
    - LP: #1310783
  * can: flexcan: fix shutdown: first disable chip, then all interrupts
    - LP: #1310783
  * can: flexcan: flexcan_open(): fix error path if flexcan_chip_start()
    fails
    - LP: #1310783
  * tracing: Do not add event files for modules that fail tracepoints
    - LP: #1310783
  * ocfs2: fix quota file corruption
    - LP: #1310783
  * rapidio/tsi721: fix tasklet termination in dma channel release
    - LP: #1310783
  * ALSA: usb-audio: Add quirk for Logitech Webcam C500
    - LP: #1310783
  * drm/radeon: TTM must be init with cpu-visible VRAM, v2
    - LP: #1310783
  * drm/radeon/atom: select the proper number of lanes in transmitter setup
    - LP: #1310783
  * powerpc: Align p_dyn, p_rela and p_st symbols
    - LP: #1310783
  * libata: add ATA_HORKAGE_BROKEN_FPDMA_AA quirk for Seagate Momentus
    SpinPoint M8 (2BA30001)
    - LP: #1310783
  * usb: Add device quirk for Logitech HD Pro Webcams C920 and C930e
    - LP: #1310783
  * usb: Make DELAY_INIT quirk wait 100ms between Get Configuration
    requests
    - LP: #1310783
  * ARM: 7991/1: sa1100: fix compile problem on Collie
    - LP: #1310783
  * firewire: don't use PREPARE_DELAYED_WORK
    - LP: #1310783
  * x86: Ignore NMIs that come in during early boot
    - LP: #1310783
  * x86: fix compile error due to X86_TRAP_NMI use in asm files
    - LP: #1310783
  * virtio-net: alloc big buffers also when guest can receive UFO
    - LP: #1310783
  * tg3: Don't check undefined error bits in RXBD
    - LP: #1310783
  * net: sctp: fix sctp_sf_do_5_1D_ce to verify if we/peer is AUTH capable
    - LP: #1310783
  * usb: dwc3: add support for Merrifield
    - LP: #1310783
  * mac80211: clear sequence/fragment number in QoS-null frames
    - LP: #1310783
  * mwifiex: copy AP's HT capability info correctly
    - LP: #1310783
  * net: unix socket code abuses csum_partial
    - LP: #1310783
  * ibmveth: Fix endian issues with MAC addresses
    - LP: #1310783
  * [SCSI] isci: fix reset timeout handling
    - LP: #1310783
  * [SCSI] isci: correct erroneous for_each_isci_host macro
    - LP: #1310783
  * [SCSI] qla2xxx: Poll during initialization for ISP25xx and ISP83xx
    - LP: #1310783
  * ocfs2 syncs the wrong range...
    - LP: #1310783
  * fs/proc/base.c: fix GPF in /proc/$PID/map_files
    - LP: #1310783
  * vmxnet3: fix netpoll race condition
    - LP: #1310783
  * [SCSI] storvsc: NULL pointer dereference fix
    - LP: #1310783
  * PCI: Enable INTx in pci_reenable_device() only when MSI/MSI-X not
    enabled
    - LP: #1310783
  * KVM: SVM: fix cr8 intercept window
    - LP: #1310783
  * drm/ttm: don't oops if no invalidate_caches()
    - LP: #1310783
  * vmxnet3: fix building without CONFIG_PCI_MSI
    - LP: #1310783
  * x86/amd/numa: Fix northbridge quirk to assign correct NUMA node
    - LP: #1310783
  * Btrfs: fix data corruption when reading/updating compressed extents
    - LP: #1310783
  * jiffies: Avoid undefined behavior from signed overflow
    - LP: #1310783
  * ALSA: compress: Pass through return value of open ops callback
    - LP: #1310783
  * acpi-cpufreq: set current frequency based on target P-State
    - LP: #1310783
  * hpfs: deadlock and race in directory lseek()
    - LP: #1310783
  * intel_idle: Check cpu_idle_get_driver() for NULL before dereferencing
    it.
    - LP: #1310783
  * ipc/msg: fix race around refcount
    - LP: #1310783
  * Input: synaptics - add manual min/max quirk
    - LP: #1310783
  * Input: synaptics - add manual min/max quirk for ThinkPad X240
    - LP: #1310783
  * x86: fix boot on uniprocessor systems
    - LP: #1310783
  * staging: speakup: Prefix externally-visible symbols
    - LP: #1310783
  * ext4: atomically set inode->i_flags in ext4_set_inode_flags()
    - LP: #1310783
  * deb-pkg: Fix cross-building linux-headers package
    - LP: #1310783
  * x86: bpf_jit: support negative offsets
    - LP: #1310783
  * p54: clamp properly instead of just truncating
    - LP: #1310783
  * ALSA: hda/realtek - Avoid invalid COEFs for ALC271X
    - LP: #1310783
  * of: Fix address decoding on Bimini and js2x machines
    - LP: #1310783
  * of: fix PCI bus match for PCIe slots
    - LP: #1310783
  * libata: disable LPM for some WD SATA-I devices
    - LP: #1310783
  * mmc: sdhci: fix lockdep error in tuning routine
    - LP: #1310783
  * usb: ehci: add freescale imx28 special write register method
    - LP: #1310783
  * USB: pl2303: fix data corruption on termios updates
    - LP: #1310783
  * Linux 3.5.7.33
    - LP: #1310783
  * net: ipv4: current group_info should be put after using.
    - CVE-2014-2851

[ Ubuntu: 3.5.0-49.74 ]

* n_tty: Fix n_tty_write crash when echoing in raw mode
 -- Paolo Pisati <paolo.pisati@canonical.com>   Fri, 09 May 2014 16:00:35 +0200

Changed in linux-ti-omap4 (Ubuntu Saucy):
status:	Fix Committed → Fix Released

John Johansen (jjohansen) on 2014-06-06

Changed in linux-armadaxp (Ubuntu Precise):
status:	Fix Committed → Fix Released
Changed in linux (Ubuntu Precise):
status:	Fix Committed → Fix Released
Changed in linux-ti-omap4 (Ubuntu Precise):
status:	Fix Committed → Fix Released

John Johansen (jjohansen) on 2014-07-23

no longer affects:	linux-armadaxp (Ubuntu Saucy)
no longer affects:	linux-ec2 (Ubuntu Saucy)
no longer affects:	linux-lts-saucy (Ubuntu Saucy)
no longer affects:	linux-lts-quantal (Ubuntu Saucy)
no longer affects:	linux-mvl-dove (Ubuntu Saucy)
no longer affects:	linux (Ubuntu Saucy)
no longer affects:	linux-fsl-imx51 (Ubuntu Saucy)
no longer affects:	linux-ti-omap4 (Ubuntu Saucy)
no longer affects:	linux-lts-raring (Ubuntu Saucy)

John Johansen (jjohansen) on 2014-12-06

Changed in linux-lts-trusty (Ubuntu Precise):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-lts-trusty (Ubuntu Trusty):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-lts-trusty (Ubuntu Lucid):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-lts-trusty (Ubuntu Vivid):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-lts-trusty (Ubuntu Utopic):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-lts-utopic (Ubuntu Precise):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-lts-utopic (Ubuntu Trusty):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-lts-utopic (Ubuntu Lucid):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-lts-utopic (Ubuntu Vivid):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-lts-utopic (Ubuntu Utopic):
status:	New → Invalid
importance:	Undecided → Medium

John Johansen (jjohansen) on 2015-01-28

Changed in linux-flo (Ubuntu Precise):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-flo (Ubuntu Trusty):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-flo (Ubuntu Lucid):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-flo (Ubuntu Vivid):
importance:	Undecided → Medium
Changed in linux-flo (Ubuntu Utopic):
importance:	Undecided → Medium
Changed in linux-goldfish (Ubuntu Precise):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-goldfish (Ubuntu Trusty):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-goldfish (Ubuntu Lucid):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-goldfish (Ubuntu Vivid):
importance:	Undecided → Medium
Changed in linux-goldfish (Ubuntu Utopic):
importance:	Undecided → Medium
Changed in linux-mako (Ubuntu Precise):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-mako (Ubuntu Trusty):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-mako (Ubuntu Lucid):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-mako (Ubuntu Vivid):
importance:	Undecided → Medium
Changed in linux-mako (Ubuntu Utopic):
importance:	Undecided → Medium
Changed in linux-manta (Ubuntu Precise):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-manta (Ubuntu Trusty):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-manta (Ubuntu Lucid):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-manta (Ubuntu Vivid):
importance:	Undecided → Medium
Changed in linux-manta (Ubuntu Utopic):
importance:	Undecided → Medium

John Johansen (jjohansen) on 2015-05-04

no longer affects:	linux-lts-trusty (Ubuntu Lucid)
no longer affects:	linux-armadaxp (Ubuntu Lucid)
no longer affects:	linux-ec2 (Ubuntu Lucid)
no longer affects:	linux-goldfish (Ubuntu Lucid)
no longer affects:	linux-lts-saucy (Ubuntu Lucid)
no longer affects:	linux-lts-quantal (Ubuntu Lucid)
no longer affects:	linux-mvl-dove (Ubuntu Lucid)
no longer affects:	linux-ti-omap4 (Ubuntu Lucid)
no longer affects:	linux (Ubuntu Lucid)
no longer affects:	linux-mako (Ubuntu Lucid)
no longer affects:	linux-fsl-imx51 (Ubuntu Lucid)
no longer affects:	linux-lts-utopic (Ubuntu Lucid)
no longer affects:	linux-flo (Ubuntu Lucid)
no longer affects:	linux-lts-raring (Ubuntu Lucid)
no longer affects:	linux-manta (Ubuntu Lucid)

John Johansen (jjohansen) on 2015-05-08

Changed in linux-lts-vivid (Ubuntu Precise):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-lts-vivid (Ubuntu Vivid):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-lts-vivid (Ubuntu Wily):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-lts-vivid (Ubuntu Utopic):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-lts-vivid (Ubuntu Trusty):
status:	New → Fix Committed
importance:	Undecided → Medium

John Johansen (jjohansen) on 2015-07-28

no longer affects:	linux-lts-trusty (Ubuntu Utopic)
no longer affects:	linux-armadaxp (Ubuntu Utopic)
no longer affects:	linux-ec2 (Ubuntu Utopic)
no longer affects:	linux-goldfish (Ubuntu Utopic)
no longer affects:	linux-lts-saucy (Ubuntu Utopic)
no longer affects:	linux-lts-quantal (Ubuntu Utopic)
no longer affects:	linux-mvl-dove (Ubuntu Utopic)
no longer affects:	linux-ti-omap4 (Ubuntu Utopic)
no longer affects:	linux-lts-vivid (Ubuntu Utopic)
no longer affects:	linux (Ubuntu Utopic)
no longer affects:	linux-mako (Ubuntu Utopic)
no longer affects:	linux-fsl-imx51 (Ubuntu Utopic)
no longer affects:	linux-lts-utopic (Ubuntu Utopic)
no longer affects:	linux-flo (Ubuntu Utopic)
no longer affects:	linux-lts-raring (Ubuntu Utopic)
no longer affects:	linux-manta (Ubuntu Utopic)

Steve Beattie (sbeattie) on 2015-11-10

Changed in linux-lts-wily (Ubuntu Precise):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-lts-wily (Ubuntu Wily):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-lts-wily (Ubuntu Xenial):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-lts-wily (Ubuntu Trusty):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-lts-wily (Ubuntu Vivid):
status:	New → Invalid
importance:	Undecided → Medium

Steve Beattie (sbeattie) on 2015-11-16

Changed in linux-raspi2 (Ubuntu Precise):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-raspi2 (Ubuntu Wily):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-raspi2 (Ubuntu Xenial):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-raspi2 (Ubuntu Trusty):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-raspi2 (Ubuntu Vivid):
status:	New → Invalid
importance:	Undecided → Medium

Steve Beattie (sbeattie) on 2015-12-03

Changed in linux-raspi2 (Ubuntu Xenial):
status:	Invalid → Fix Committed

Steve Beattie (sbeattie) on 2016-02-10

Changed in linux-lts-xenial (Ubuntu Precise):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-lts-xenial (Ubuntu Wily):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-lts-xenial (Ubuntu Xenial):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-lts-xenial (Ubuntu Trusty):
status:	New → Fix Committed
importance:	Undecided → Medium

Steve Beattie (sbeattie) on 2016-04-18

Changed in linux-manta (Ubuntu Xenial):
status:	New → Invalid

Steve Beattie (sbeattie) on 2016-05-05

Changed in linux-snapdragon (Ubuntu Precise):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-snapdragon (Ubuntu Wily):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-snapdragon (Ubuntu Xenial):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-snapdragon (Ubuntu Yakkety):
status:	New → Invalid
importance:	Undecided → Medium
Changed in linux-snapdragon (Ubuntu Trusty):
status:	New → Invalid
importance:	Undecided → Medium

Revision history for this message

Andy Whitcroft (apw) wrote on 2017-10-17: Closing unsupported series nomination.

This bug was nominated against a series that is no longer supported, ie vivid. The bug task representing the vivid nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux-flo (Ubuntu Vivid):
status:	New → Won't Fix

Andy Whitcroft (apw) on 2017-10-17

Changed in linux-goldfish (Ubuntu Vivid):
status:	New → Won't Fix

Andy Whitcroft (apw) on 2017-10-17

Changed in linux-manta (Ubuntu Vivid):
status:	New → Won't Fix

Report a bug

This report contains Public Security information

Everyone can see this security related information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntulinux package

CVE-2014-0055

Bug Description

CVE References

Other bug subscribers

Remote bug watches

Ubuntu
linux package