Ubuntu
linux package

NFSv4 mount point does not allow binary files to run when permissions are set only to execute

Bug #833300 reported by Leonardo Borda on 2011-08-24

This bug affects 1 person

	Status	Importance	Assigned to
Linux	Fix Released	Medium	auto-bugzilla.linux-nfs.org #204
linux (Ubuntu)	Fix Released	Medium	Chris J Arges
Lucid	Fix Released	Undecided	Chris J Arges
Maverick	Invalid	Undecided	Unassigned
Natty	Fix Released	Undecided	Chris J Arges
Oneiric	Fix Released	Undecided	Unassigned
Precise	Fix Released	Medium	Chris J Arges

Bug Description

Affected releases:
- Lucid, Natty when running NFSv4

One cannot run binary files when permissions are set to ---x--x--x on systems running NFSv4.

Expected behaviour:
- Allow binaries to run by just having --x (execute) permissions. This works when the mount point is created using NFSv3. According to the literature if it is a binary it makes an exec() call to the kernel therefore you don't need to have (read) permissions on the file.

PS: Scripts run as expected when they have the following r-x permissions. Since scripts have to pass by an interpreter ( perl, bash ) they do need to have (read and exec) permissions.

Steps to reproduce

1. Install nfs
2. configure /etc/export
/data/nfs *(rw,fsid=0,sync,no_subtree_check)
3. Mount using nfsv4
sudo mount -t nfs4 -o proto=tcp,port=2049 localhost:/ /mnt

4. cd /mnt
ls -la a.out script.sh
---x--x--x 1 ubuntu ubuntu 8461 2011-08-24 17:59 a.out
---x--x--x 1 ubuntu ubuntu 27 2011-08-24 17:58 script.sh
5. running binary and script
ubuntu@ip-10-194-34-180:/mnt$ ./a.out
-bash: ./a.out: Permission denied
ubuntu@ip-10-194-34-180:/mnt$ ./script.sh
-bash: ./script.sh: Permission denied

ubuntu@ip-10-194-34-180:/mnt$ mount -v
/dev/sda1 on / type ext3 (rw)
proc on /proc type proc (rw,noexec,nosuid,nodev)
none on /sys type sysfs (rw,noexec,nosuid,nodev)
none on /sys/kernel/debug type debugfs (rw)
none on /sys/kernel/security type securityfs (rw)
none on /dev type devtmpfs (rw,mode=0755)
none on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=0620)
none on /dev/shm type tmpfs (rw,nosuid,nodev)
none on /var/run type tmpfs (rw,nosuid,mode=0755)
none on /var/lock type tmpfs (rw,noexec,nosuid,nodev)
none on /lib/init/rw type tmpfs (rw,nosuid,mode=0755)
nfsd on /proc/fs/nfsd type nfsd (rw)
rpc_pipefs on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)
localhost:/ on /mnt type nfs4 (rw,proto=tcp,port=2049,clientaddr=127.0.0.1,addr=127.0.0.1)

==
When running nfsv3
1. sudo mount -t nfs -o vers=3 localhost:/data/nfs /mnt

2. testing again
ubuntu@ip-10-194-34-180:/mnt$ ./a.out
Hello Ubuntu!
ubuntu@ip-10-194-34-180:/mnt$ ./script.sh
/bin/bash: ./script.sh: Permission denied
ubuntu@ip-10-194-34-180:/mnt$

ubuntu@ip-10-194-34-180:~$ mount -v
/dev/sda1 on / type ext3 (rw)
proc on /proc type proc (rw,noexec,nosuid,nodev)
none on /sys type sysfs (rw,noexec,nosuid,nodev)
none on /sys/kernel/debug type debugfs (rw)
none on /sys/kernel/security type securityfs (rw)
none on /dev type devtmpfs (rw,mode=0755)
none on /dev/pts type devpts (rw,noexec,nosuid,gid=5,mode=0620)
none on /dev/shm type tmpfs (rw,nosuid,nodev)
none on /var/run type tmpfs (rw,nosuid,mode=0755)
none on /var/lock type tmpfs (rw,noexec,nosuid,nodev)
none on /lib/init/rw type tmpfs (rw,nosuid,mode=0755)
nfsd on /proc/fs/nfsd type nfsd (rw)
rpc_pipefs on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw)
localhost:/data/nfs on /mnt type nfs (rw,vers=3,addr=127.0.0.1)
---
AlsaVersion: Advanced Linux Sound Architecture Driver Version 1.0.23.
AplayDevices: Error: [Errno 2] No such file or directory
Architecture: amd64
ArecordDevices: Error: [Errno 2] No such file or directory
AudioDevicesInUse: Error: command ['fuser', '-v', '/dev/snd/by-path', '/dev/snd/controlC0', '/dev/snd/pcmC0D0c', '/dev/snd/pcmC0D0p', '/dev/snd/pcmC0D1p', '/dev/snd/midiC0D0', '/dev/snd/seq', '/dev/snd/timer'] failed with exit code 1:
CRDA: Error: [Errno 2] No such file or directory
Card0.Amixer.info: Error: [Errno 2] No such file or directory
Card0.Amixer.values: Error: [Errno 2] No such file or directory
CurrentDmesg:
[ 3.585529] NFSD: Using /var/lib/nfs/v4recovery as the NFSv4 state recovery directory
[ 3.585840] NFSD: starting 90-second grace period
[ 13.220124] eth0: no IPv6 routers present
DistroRelease: Ubuntu 11.04
HibernationDevice: RESUME=UUID=de537731-98cc-4485-a83e-21a766dd1354
IwConfig:
lo no wireless extensions.

eth0 no wireless extensions.
Lsusb: Bus 001 Device 001: ID 1d6b:0001 Linux Foundation 1.1 root hub
MachineType: Bochs Bochs
Package: linux (not installed)
ProcEnviron:
LANGUAGE=en_US:
LANG=en_US
SHELL=/bin/bash
ProcKernelCmdLine: BOOT_IMAGE=/vmlinuz-2.6.38-10-server root=/dev/mapper/hostname-root ro quiet
ProcVersionSignature: Ubuntu 2.6.38-10.46-server 2.6.38.7
RelatedPackageVersions:
linux-restricted-modules-2.6.38-10-server N/A
linux-backports-modules-2.6.38-10-server N/A
linux-firmware 1.52
RfKill:

Tags: natty
Uname: Linux 2.6.38-10-server x86_64
UpgradeStatus: No upgrade log present (probably fresh install)
UserGroups: adm admin cdrom dialout lpadmin plugdev sambashare
dmi.bios.date: 01/01/2007
dmi.bios.vendor: Bochs
dmi.bios.version: Bochs
dmi.chassis.type: 1
dmi.chassis.vendor: Bochs
dmi.modalias: dmi:bvnBochs:bvrBochs:bd01/01/2007:svnBochs:pnBochs:pvr:cvnBochs:ct1:cvr:
dmi.product.name: Bochs
dmi.sys.vendor: Bochs

See original description

Tags:

Related branches

lp:ubuntu/lucid-proposed/linux-lts-backport-natty

lp:ubuntu/lucid-proposed/linux-ec2

lp:ubuntu/maverick-proposed/linux-mvl-dove

CVE References

Revision history for this message

Leonardo Borda (lborda) wrote on 2011-08-24:

I've opened an upstream bug as well.

https://bugzilla.linux-nfs.org/show_bug.cgi?id=201

Leonardo

affects:

nfs-utils (Ubuntu) → linux (Ubuntu)

Revision history for this message

Brad Figg (brad-figg) wrote on 2011-08-24: Missing required logs.

This bug is missing log files that will aid in diagnosing the problem. From a terminal window please run:

apport-collect 833300

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status:	New → Incomplete

Revision history for this message

Leonardo Borda (lborda) wrote on 2011-09-07: AcpiTables.txt

AcpiTables.txt Edit (37.2 KiB, text/plain)

apport information

tags:	added: apport-collected natty
description:	updated

Revision history for this message

Leonardo Borda (lborda) wrote on 2011-09-07: AlsaDevices.txt

AlsaDevices.txt Edit (463 bytes, text/plain)

apport information

Revision history for this message

Leonardo Borda (lborda) wrote on 2011-09-07: BootDmesg.txt

BootDmesg.txt Edit (24.0 KiB, text/plain)

apport information

Revision history for this message

Leonardo Borda (lborda) wrote on 2011-09-07: Lspci.txt

Lspci.txt Edit (4.7 KiB, text/plain)

apport information

Revision history for this message

Leonardo Borda (lborda) wrote on 2011-09-07: PciMultimedia.txt

PciMultimedia.txt Edit (508 bytes, text/plain)

apport information

Revision history for this message

Leonardo Borda (lborda) wrote on 2011-09-07: ProcCpuinfo.txt

ProcCpuinfo.txt Edit (1004 bytes, text/plain)

apport information

Revision history for this message

Leonardo Borda (lborda) wrote on 2011-09-07: ProcCpuinfo_.txt

ProcCpuinfo_.txt Edit (1004 bytes, text/plain)

apport information

Revision history for this message

Leonardo Borda (lborda) wrote on 2011-09-07: ProcInterrupts.txt

#10

ProcInterrupts.txt Edit (1.5 KiB, text/plain)

apport information

Revision history for this message

Leonardo Borda (lborda) wrote on 2011-09-07: ProcModules.txt

#11

ProcModules.txt Edit (1.2 KiB, text/plain)

apport information

Revision history for this message

Leonardo Borda (lborda) wrote on 2011-09-07: UdevDb.txt

#12

UdevDb.txt Edit (58.5 KiB, text/plain)

apport information

Revision history for this message

Leonardo Borda (lborda) wrote on 2011-09-07: UdevLog.txt

#13

UdevLog.txt Edit (146.7 KiB, text/plain)

apport information

Revision history for this message

Leonardo Borda (lborda) wrote on 2011-09-07: WifiSyslog.txt

#14

WifiSyslog.txt Edit (76.3 KiB, text/plain)

apport information

Revision history for this message

Torsten Spindler (tspindler) wrote on 2011-09-13:

#15

There seems to be an upstream patch available in http://marc.info/?l=linux-nfs&m=131428919915674&w=2

Tim Gardner (timg-tpi) on 2011-09-13

Changed in linux (Ubuntu):
assignee:	nobody → Canonical Kernel Team (canonical-kernel-team)
status:	Incomplete → Triaged

Revision history for this message

Torsten Spindler (tspindler) wrote on 2011-09-14:

#16

I reproduced this problem per your setup on Ubuntu 10.04 LTS server and client. There nfs4 would not work (e.g. permission denied), but nfs3 works. However, on Oneiric as server neither nor works:

spindler@spitfire:~$ sudo mount -t nfs -o vers=3 meteor:/home/spindler/export /mnt-meteor
spindler@spitfire:~$ /mnt-meteor/hello
bash: /mnt-meteor/hello: Permission denied
spindler@spitfire:~$ mount -v | grep mnt-meteor
meteor:/home/spindler/export on /mnt-meteor type nfs (rw,vers=3,addr=192.168.1.122)

Revision history for this message

Torsten Spindler (tspindler) wrote on 2011-09-14:

#17

nfs4-execute-only.patch Edit (1.5 KiB, text/plain)

I've patched a Lucid kernel with the patch from your upstream bugreport:
https://bugzilla.linux-nfs.org/show_bug.cgi?id=201
and attached it here. While the execution of a binary works now, the execution of shell scripts and even the inspection of the script does work as well:

spindler@spitfire:~$ ls -al /mnt/hello.sh
---x--x--x 1 4294967294 4294967294 33 2011-09-14 08:53 /mnt/hello.sh
spindler@spitfire:~$ /mnt/hello.sh
Hello Leonardo
spindler@spitfire:~$ cat /mnt/hello.sh
#!/bin/sh

echo "Hello Leonardo"
spindler@spitfire:~$ mount -v | grep mnt
spitfire:/ on /mnt type nfs4 (rw,proto=tcp,port=2049,clientaddr=127.0.1.1,addr=127.0.1.1)

Revision history for this message

Torsten Spindler (tspindler) wrote on 2011-09-14:

#18

Same problem with modified Oneiric kernel as server:

spindler@spitfire:/mnt-meteor$ ls -al
total 24
drwxrwxr-x 2 spindler spindler 4096 2011-09-14 10:16 .
drwxr-xr-x 23 root root 4096 2011-09-14 08:49 ..
---x--x--x 1 spindler spindler 7139 2011-09-14 10:16 hello
-rw-rw-r-- 1 spindler spindler 99 2011-09-13 14:35 hello.c
---x--x--x 1 spindler spindler 33 2011-09-13 14:36 hello.sh
spindler@spitfire:/mnt-meteor$ ./hello
Hello Leonardo
spindler@spitfire:/mnt-meteor$ ./hello.sh
Hello Leonardo
spindler@spitfire:/mnt-meteor$ mount -v | grep meteor
meteor:/ on /mnt-meteor type nfs4 (rw,proto=tcp,port=2049,clientaddr=192.168.1.141,addr=192.168.1.122)
spindler@spitfire:/mnt-meteor$

Revision history for this message

Leonardo Borda (lborda) wrote on 2011-09-21:

#19

Hello Torsten,

Same problem here.
The patch solves the binary file but now it also allows scripts to run
which is a security issue. I am reopening this bug with upstream. See the info below.

ubuntu@ubuntu:~$ sudo umount /mnt/
ubuntu@ubuntu:~$ sudo mount -t nfs4 -o proto=tcp,port=2049 ubuntu:/ /mnt
ubuntu@ubuntu:~$ uname -a
Linux ubuntu 2.6.32-34-generic #77~lp833300 SMP Wed Sep 14 11:10:49 CEST 2011
i686 i686 i386 GNU/Linux
ubuntu@ubuntu:~$ cd /mnt/
ubuntu@ubuntu:/mnt$ ls -la
total 24
drwxrwxrwx 2 4294967294 4294967294 4096 2011-09-21 16:25 .
drwxr-xr-x 22 root root 4096 2011-09-21 16:18 ..
-rw-r--r-- 1 4294967294 4294967294 72 2011-09-21 16:25 a.c
---x--x--x 1 4294967294 4294967294 7127 2011-09-21 16:25 a.out
---x--x--x 1 4294967294 4294967294 23 2011-09-21 16:20 b.sh
ubuntu@ubuntu:/mnt$ ./a.out
Hello C programming
ubuntu@ubuntu:/mnt$ ./b.sh
hello
ubuntu@ubuntu:/mnt$

Thank you in advance!

Leonardo

Revision history for this message

Leonardo Borda (lborda) wrote on 2011-10-19:

#20

Hi Guys,

I got an answer from upstream and they actually filled another bug since it seems to be related to the client itself.

https://bugzilla.linux-nfs.org/show_bug.cgi?id=204

They will provide a patch so I can test it.

Leonardo

Joseph Salisbury (jsalisbury) on 2011-10-19

Changed in linux (Ubuntu):
importance:	Undecided → Medium

Ubuntu Foundations Team Bug Bot (crichton) on 2011-10-19

tags:

added: patch

Revision history for this message

Leonardo Borda (lborda) wrote on 2011-11-08:

#21

This is a note to let you know that developers have just added the patch titled

nfsd4: permit read opens of executable-only files

to the 3.0-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
nfsd4-permit-read-opens-of-executable-only-files.patch
and it can be found in the queue-3.0 subdirectory.

commit a043226bc140a2c1dde162246d68a67e5043e6b2 upstream.

Chris J Arges (arges) on 2011-11-16

Changed in linux (Ubuntu):
assignee:	Canonical Kernel Team (canonical-kernel-team) → Chris J Arges (christopherarges)

Revision history for this message

Chris J Arges (arges) wrote on 2011-11-18:

#22

I can reproduce this failure on natty/oneiric just fine.

I then applied the upstream patch (a043226bc140a2c1dde162246d68a67e5043e6b2), that was identified in the public bug and upstream bug.

After doing this I installed the tools on my laptop:
apt-get install nfs-common nfs-kernel-server

Then I setup of /etc/exports as described in the bug to a directory on my laptop (ext4).
/path/to/dir *(rw,sync,fsid=0,no_subtree_check)

I then had to insert the module and restart the server:
sudo modprobe nfs
sudo service nfs-kernel-server restart

I mounted the directory:
sudo mount -t nfs4 -o proto=tcp,port=2049 localhost:/ /mnt

I created a similar c program and compiled. I put this into the shared folder.
I could run it with normal permissions.
I then did 'chmod 111 ./a.out' and then I could not run the program (Permission denied) if I was doing it via the /mnt directory.

arges@arges-virtual-machine:/mnt$ ls -la
total 24
drwxr-xr-x 2 4294967294 4294967294 4096 2011-11-17 10:12 .
drwxr-xr-x 22 root root 4096 2011-11-17 09:57 ..
---x--x--x 1 4294967294 4294967294 8425 2011-11-17 10:12 a.out
-rw-r--r-- 1 4294967294 4294967294 73 2011-11-17 10:12 hello.c
arges@arges-virtual-machine:/mnt$ ./a.out
-bash: ./a.out: Permission denied
arges@arges-virtual-machine:/mnt$ mount -v
/dev/vda1 on / type ext4 (rw,errors=remount-ro,commit=0)
<snip>
nfsd on /proc/fs/nfsd type nfsd (rw)
localhost:/ on /mnt type nfs (rw,vers=4,addr=127.0.0.1,clientaddr=127.0.0.1)

I could run it if I wasn't running it over the nfsv4 share (sanity check):

arges@arges-virtual-machine:/mnt$ cd ~/Test/
arges@arges-virtual-machine:~/Test$ ls -la
total 24
drwxr-xr-x 2 arges arges 4096 2011-11-17 10:12 .
drwxr-xr-x 22 arges arges 4096 2011-11-17 10:10 ..
---x--x--x 1 arges arges 8425 2011-11-17 10:12 a.out
-rw-r--r-- 1 arges arges 73 2011-11-17 10:12 hello.c
arges@arges-virtual-machine:~/Test$ ./a.out
hello binary

Revision history for this message

Leonardo Borda (lborda) wrote on 2011-11-30:

#23

Hi Chris,

Thanks for taking a look at this issue. So it looks like the upstream fix does not solve the issue. Could you please report this to upstream?

Leonardo

Revision history for this message

Leonardo Borda (lborda) wrote on 2011-11-30:

#24

Hi Chris,

Thanks for taking a look at this issue. So it looks like the upstream patch does not solve the issue.
Could please write your findings on the thread below:
http://comments.gmane.org/gmane.linux.nfs/43028

Leonardo

Revision history for this message

Chris J Arges (arges) wrote on 2011-12-07:

#25

@lborda,
I've responded that this does not solve the issue:
http://comments.gmane.org/gmane.linux.nfs/43028

Chris J Arges (arges) on 2011-12-12

Changed in linux (Ubuntu):
status:	Triaged → In Progress

Revision history for this message

Chris J Arges (arges) wrote on 2011-12-13:

#26

Using the above test setup, and trying various clients I see a mismatch:

Using a newer nfs client (nfs-common 1:1.2.2-4), I can read a file with 111 permissions, but cannot execute it.
With an older nfs client (nfs-common 1:1.2.0-4), I can read and execute a file with 111 permissions.

Revision history for this message

Chris J Arges (arges) wrote on 2011-12-13:

#27

Contacted upstream nfsv4 maintainer about this. This may be an nfs-common / nfsv4 client issue.

Revision history for this message

Chris J Arges (arges) wrote on 2011-12-15:

#28

0001-nfsd4-permit-read-opens-of-executable-only-files-natty.patch Edit (3.1 KiB, text/plain)

Attached is the backport of a043226bc140a2c1dde162246d68a67e5043e6b2 for natty.

Revision history for this message

Chris J Arges (arges) wrote on 2011-12-15:

#29

0001-nfsd4-permit-read-opens-of-executable-only-files-lucid.patch Edit (3.0 KiB, text/plain)

Attached is the backport of a043226bc140a2c1dde162246d68a67e5043e6b2 for lucid.

Revision history for this message

Chris J Arges (arges) wrote on 2011-12-15:

#30

SRU request sent to kernel mailing list.

Brad Figg (brad-figg) on 2011-12-15

Changed in linux (Ubuntu):
status:	In Progress → Fix Committed

Tim Gardner (timg-tpi) on 2011-12-16

Changed in linux (Ubuntu Natty):
status:	New → Fix Committed
Changed in linux (Ubuntu Lucid):
status:	New → Fix Committed

Revision history for this message

Tim Gardner (timg-tpi) wrote on 2011-12-16:

#31

rtg@lochsa:~/ubuntu/ubuntu-oneiric$ git describe --contains 0b9653a06ba3e845386dc9f86d2d3fdebf7bb9db
Ubuntu-3.0.0-14.23~170

Changed in linux (Ubuntu Oneiric):
status:	New → Fix Released
Changed in linux (Ubuntu Precise):
status:	Fix Committed → Fix Released

Revision history for this message

Herton R. Krzesinski (herton) wrote on 2012-01-04:

#32

This bug is awaiting verification that the kernel for Natty in -proposed solves the problem (2.6.38-13.54). Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-natty' to 'verification-done-natty'.

If verification is not done by one week from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags:

added: verification-needed-natty

Revision history for this message

Herton R. Krzesinski (herton) wrote on 2012-01-05:

#33

This bug is also awaiting verification that the kernel for Lucid in -proposed solves the problem (2.6.32-38.83). If the problem is solved, change the tag 'verification-needed-lucid' to 'verification-done-lucid'.

tags:

added: verification-needed-lucid

Chris J Arges (arges) on 2012-01-05

tags:

added: verification-done-lucid
removed: verification-needed-lucid

Revision history for this message

Chris J Arges (arges) wrote on 2012-01-05:

#34

@herton
Cannot verify natty. It does not work with the latest nfs-common, and with the older nfs-common as identified in the bug.

Changed in linux (Ubuntu Lucid):
assignee:	nobody → Chris J Arges (christopherarges)
tags:	added: verification-failed-natty removed: verification-needed-natty

Revision history for this message

Chris J Arges (arges) wrote on 2012-01-06:

#35

using a VM with natty -proposed running a server. and a VM with lucid -proposed running the client. The client can mount the directory and execute a binary with 111 permissions.

Changed in linux (Ubuntu Natty):
assignee:	nobody → Chris J Arges (christopherarges)
tags:	added: verification-done-natty removed: verification-failed-natty

Revision history for this message

Leonardo Borda (lborda) wrote on 2012-01-06:

#36

@Chris and @herton!!

Thank you for your work!!!

Leonardo

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-01-24:

#37

Download full text (4.4 KiB)

This bug was fixed in the package linux - 2.6.32-38.83

---------------
linux (2.6.32-38.83) lucid-proposed; urgency=low

[Herton R. Krzesinski]

* Release Tracking Bug
- LP: #911405

[ Upstream Kernel Changes ]

  * Revert "clockevents: Set noop handler in clockevents_exchange_device()"
    - LP: #911392
  * Linux 2.6.32.52
    - LP: #911392

linux (2.6.32-38.82) lucid-proposed; urgency=low

[Herton R. Krzesinski]

* Release Tracking Bug
- LP: #910906

[ Tetsuo Handa ]

* SAUCE: netns: Add quota for number of NET_NS instances.

[ Tim Gardner ]

* [Config] CONFIG_NET_NS=y
- LP: #790863

[ Upstream Kernel Changes ]

This bug was fixed in the package linux - 2.6.32-38.83

---------------
linux (2.6.32-38.83) lucid-proposed; urgency=low

[Herton R. Krzesinski]

* Release Tracking Bug
    - LP: #911405

[ Upstream Kernel Changes ]

* Revert "clockevents: Set noop handler in clockevents_exchange_device()"
    - LP: #911392
  * Linux 2.6.32.52
    - LP: #911392

linux (2.6.32-38.82) lucid-proposed; urgency=low

[Herton R. Krzesinski]

* Release Tracking Bug
    - LP: #910906

[ Tetsuo Handa ]

* SAUCE: netns: Add quota for number of NET_NS instances.

[ Tim Gardner ]

* [Config] CONFIG_NET_NS=y
    - LP: #790863

[ Upstream Kernel Changes ]

* Revert "core: Fix memory leak/corruption on VLAN GRO_DROP,
    CVE-2011-1576"
  * hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops, CVE-2011-2203
    - LP: #899466
    - CVE-2011-2203
  * net: ipv4: relax AF_INET check in bind()
    - LP: #900396
  * KEYS: Fix a NULL pointer deref in the user-defined key type,
    CVE-2011-4110
    - LP: #894369
    - CVE-2011-4110
  * i2c-algo-bit: Generate correct i2c address sequence for 10-bit target
    - LP: #902317
  * eCryptfs: Extend array bounds for all filename chars
    - LP: #902317
  * PCI hotplug: shpchp: don't blindly claim non-AMD 0x7450 device IDs
    - LP: #902317
  * ARM: 7161/1: errata: no automatic store buffer drain
    - LP: #902317
  * ALSA: lx6464es - fix device communication via command bus
    - LP: #902317
  * SUNRPC: Ensure we return EAGAIN in xs_nospace if congestion is cleared
    - LP: #902317
  * timekeeping: add arch_offset hook to ktime_get functions
    - LP: #902317
  * p54spi: Add missing spin_lock_init
    - LP: #902317
  * p54spi: Fix workqueue deadlock
    - LP: #902317
  * nl80211: fix MAC address validation
    - LP: #902317
  * gro: reset vlan_tci on reuse
    - LP: #902317
  * staging: usbip: bugfix for deadlock
    - LP: #902317
  * staging: comedi: fix oops for USB DAQ devices.
    - LP: #902317
  * Staging: comedi: fix signal handling in read and write
    - LP: #902317
  * USB: whci-hcd: fix endian conversion in qset_clear()
    - LP: #902317
  * usb: ftdi_sio: add PID for Propox ISPcable III
    - LP: #902317
  * usb: option: add SIMCom SIM5218
    - LP: #902317
  * USB: usb-storage: unusual_devs entry for Kingston DT 101 G2
    - LP: #902317
  * SCSI: scsi_lib: fix potential NULL dereference
    - LP: #902317
  * SCSI: Silencing 'killing requests for dead queue'
    - LP: #902317
  * cifs: fix cifs stable patch cifs-fix-oplock-break-handling-try-2.patch
    - LP: #902317
  * sched, x86: Avoid unnecessary overflow in sched_clock
    - LP: #902317
  * x86/mpparse: Account for bus types other than ISA and PCI
    - LP: #902317
  * oprofile, x86: Fix crash when unloading module (nmi timer mode)
    - LP: #902317
  * genirq: Fix race condition when stopping the irq thread
    - LP: #902317
  * tick-broadcast: Stop active broadcast device when replacing it
    - LP: #902317
  * clockevents: Set noop handler in clockevents_exchange_device()
    - LP: #902317
  * Linux 2.6.32.50
    - LP: #902317
  * nfsd4: permit read opens of executable-only files
    - LP: #833300
  * ipv6: Allow inet6_dump_addr() to handle more than 64 addresses
    - LP: #863394
  * ALSA: sis7019 - give slow codecs more time to reset
    - LP: #907774
  * ALSA: hda/realtek - Fix Oops in alc_mux_select()
    - LP: #907774
  * ARM: davinci: dm646x evm: wrong register used in
    setup_vpif_input_channel_mode
    - LP: #907774
  * oprofile: Free potentially owned tasks in case of errors
    - LP: #907774
  * oprofile: Fix locking dependency in sync_start()
    - LP: #907774
  * percpu: fix chunk range calculation
    - LP: #907774
  * xfrm: Fix key lengths for rfc3686(ctr(aes))
    - LP: #907774
  * linux/log2.h: Fix rounddown_pow_of_two(1)
    - LP: #907774
  * jbd/jbd2: validate sb->s_first in journal_get_superblock()
    - LP: #907774
  * hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops
    - LP: #907774
  * export __get_user_pages_fast() function
    - LP: #907774
  * oprofile, x86: Fix nmi-unsafe callgraph support
    - LP: #907774
  * oprofile, x86: Fix crash when unloading module (timer mode)
    - LP: #907774
  * ext4: avoid hangs in ext4_da_should_update_i_disksize()
    - LP: #907774
  * USB: cdc-acm: add IDs for Motorola H24 HSPA USB module.
    - LP: #907774
  * Linux 2.6.32.51
    - LP: #907774
 -- Herton Ronaldo Krzesinski <herton.krzesinski@canonical.com>   Tue, 03 Jan 2012 16:51:53 -0200

Changed in linux (Ubuntu Lucid):
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2012-01-24:

#38

This bug was fixed in the package linux - 2.6.38-13.54

---------------
linux (2.6.38-13.54) natty-proposed; urgency=low

[Herton R. Krzesinski]

* Release Tracking Bug
- LP: #911195

[ Alex Bligh ]

* (config) Change Xen paravirt drivers to be built-in
- LP: #886521

[ Paolo Pisati ]

* [Config] DEFAULT_MMAP_MIN_ADDR=32k on arm
- LP: #903346

[ Seth Forshee ]

* SAUCE: dell-wmi: Demote unknown WMI event message to pr_debug
- LP: #581312

[ Upstream Kernel Changes ]

  * VFS: Fix vfsmount overput on simultaneous automount
    - LP: #769927
  * TPM: Zero buffer after copying to userspace, CVE-2011-1162
    - LP: #899463
    - CVE-2011-1162
  * hfs: fix hfs_find_init() sb->ext_tree NULL ptr oops, CVE-2011-2203
    - LP: #899466
    - CVE-2011-2203
  * KEYS: Fix a NULL pointer deref in the user-defined key type,
    CVE-2011-4110
    - LP: #894369
    - CVE-2011-4110
  * nfsd4: permit read opens of executable-only files
    - LP: #833300
  * Support for Terratec G1
    - LP: #821061
-- Herton Ronaldo Krzesinski <email address hidden> Tue, 03 Jan 2012 10:03:15 -0200

Changed in linux (Ubuntu Natty):
status:	Fix Committed → Fix Released

Bug Watch Updater (bug-watch-updater) on 2012-11-21

Changed in linux:
importance:	Unknown → Medium
status:	Unknown → Confirmed

Revision history for this message

Julian Wiedmann (jwiedmann) wrote on 2013-08-18:

#39

This release has reached end-of-life [0].

[0] https://wiki.ubuntu.com/Releases

Changed in linux (Ubuntu Maverick):
status:	New → Invalid

Bug Watch Updater (bug-watch-updater) on 2014-01-30

Changed in linux:
status:	Confirmed → Fix Released

Report a bug

This report contains Public information

Everyone can see this information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Patches

Add patch

Remote bug watches

auto-bugzilla.linux-nfs.org #201
[CLOSED FIXED] Edit
auto-bugzilla.linux-nfs.org #204
[CLOSED FIXED] Edit

Bug watches keep track of this bug in other bug trackers.

Ubuntulinux package

NFSv4 mount point does not allow binary files to run when permissions are set only to execute

Bug Description

Related branches

CVE References

Other bug subscribers

Patches

Bug attachments

Remote bug watches

Ubuntu
linux package