Merge ~kees/ubuntu-cve-tracker:linux-cves into ubuntu-cve-tracker:master

[Kees Cook]

Cleaning up some kernel break/fix entries from the distant past and very recent.

[Thadeu Lima de Souza Cascardo (cascardo)]

On Tue, Sep 14, 2021 at 04:15:47PM -0000, Kees Cook wrote:
> Kees Cook has proposed merging ~kees/ubuntu-cve-tracker:linux-cves into ubuntu-cve-tracker:master.
>
> Commit message:
> Cleaning up some kernel break/fix entries from the distant past and very recent.
>
> Requested reviews:
> Ubuntu Security Team (ubuntu-security)
>
> For more details, see:
> https://code.launchpad.net/~kees/ubuntu-cve-tracker/+git/ubuntu-cve-tracker/+merge/408583

Hi, Kees.

Thanks a lot for your work on this. Here is my take on some of these.

> --
> Your team Ubuntu Security Team is requested to review the proposed merge of ~kees/ubuntu-cve-tracker:linux-cves into ubuntu-cve-tracker:master.

> diff --git a/active/CVE-2021-27365 b/active/CVE-2021-27365
> index dd06602..1e7aef6 100644
> --- a/active/CVE-2021-27365
> +++ b/active/CVE-2021-27365
> @@ -33,8 +33,8 @@ CVSS:
> nvd: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
>
> Patches_linux:
> - break-fix: - f9dbdf97a5bd92b1a49cee3d591b55b11fd7a6d5
> - break-fix: - ec98ea7070e94cc25a422ec97d1421e28d97b7ee
> + break-fix: 23d6fefbb3f6b1cc29794427588b470ed06ff64e f9dbdf97a5bd92b1a49cee3d591b55b11fd7a6d5

This doesn't make sense. 23d6fefbb3f6 ("scsi: iscsi: Fix in-kernel conn
failure handling") comes after f9dbdf97a5bd ("scsi: iscsi: Verify lengths
on passthrough PDUs"). This looks more like 0896b7523026 ("[SCSI]
open-iscsi/linux-iscsi-5 Initiator: Transport class update for iSCSI)",
from 2005.

> + break-fix: a54a52caad4bd6166cb7fa64e4e93031fa2fda5d ec98ea7070e94cc25a422ec97d1421e28d97b7ee

a54a52caad4b ("[SCSI] iscsi: fixup set/get param functions") is so old that
I wouldn't bother adding it. We only support trusty and newer anyway.
However, we do add 1da177 as a break commit sometimes. I think the most use
of it is stating "the break commit is known". Because anything earlier than
v3.13 will give us the same triage results.

> upstream_linux: released (5.12~rc2)
> precise/esm_linux: ignored (was needs-triage ESM criteria)
> trusty_linux: ignored (out of standard support)
> diff --git a/active/CVE-2021-29154 b/active/CVE-2021-29154
> index ee3abb3..2559949 100644
> --- a/active/CVE-2021-29154
> +++ b/active/CVE-2021-29154
> @@ -29,7 +29,7 @@ CVSS:
> nvd: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
>
> Patches_linux:
> - break-fix: - e4d4d456436bfb2fe412ee2cd489f7658449b098
> + break-fix: 0a14842f5a3c0e88a1e59fac5c3025db39721f74 e4d4d456436bfb2fe412ee2cd489f7658449b098

OK, this is the commit that introduces BPF JIT. Finding a break commit here
would help us determine whether trusty is vulnerable. We know this can be
exploited with eBPF, but no idea if cBPF could be used here. And, then,
would the initial JIT implementation be vulnerable, or would it require
some later commit? I still would rather leave the break commit as "-",
stating that we still need to investigate this.

The remaining changes are retired CVEs. Do you know or expect that any of
the changes would result in a different set of currently supported kernels
being vulnerable when we thought they were not? Otherwise, would this be
consumed for kernels other than Ubuntu ones that would make it worth to
review and merge?

Thanks a lot.
Cas...

[Steve Beattie (sbeattie)]

Hey Kees,

Cascardo has already commented on the CVEs in the active directory. Most
of the retired CVE changes look fine, the only two that are a problem
are:

> --- a/retired/CVE-2016-1575
> +++ b/retired/CVE-2016-1575
> @@ -39,8 +39,8 @@ CVSS:
> nvd: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
>
> Patches_linux:
> - break-fix: - 1175b6b8d96331676f1d436b089b965807f23b4a
> - break-fix: - local-2016-1575-2
> + break-fix: e9be9d5e76e34872f0c37d72e25bc27fe9e2c54c 1175b6b8d96331676f1d436b089b965807f23b4a
> + break-fix: local-2016-1575-2-break local-2016-1575-2
> upstream_linux: needed
> precise_linux: ignored (reached end-of-life)
> precise/esm_linux: not-affected (no user-namespace mounts)
> diff --git a/retired/CVE-2016-1576 b/retired/CVE-2016-1576
> index a87ae91..0e7bed8 100644
> --- a/retired/CVE-2016-1576
> +++ b/retired/CVE-2016-1576
> @@ -40,8 +40,8 @@ CVSS:
> nvd: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
>
> Patches_linux:
> - break-fix: - local-2016-1576-1
> - break-fix: - local-2016-1576-2
> + break-fix: e9be9d5e76e34872f0c37d72e25bc27fe9e2c54c local-2016-1576-1|e9f57ebcba563e0cd532926cab83c92bb4d79360
> + break-fix: local-2016-1576-2-break local-2016-1576-2
> upstream_linux: needed
> Priority_linux_precise: low
> Priority_linux_precise/esm: low
> diff --git a/retired/CVE-2017-7184 b/retired/CVE-2017-7184
> index 167f349..7dff1d9 100644

Neither added breaks entries, local-2016-1575-2-break or
local-2016-1576-2-break, are defined in active/10autotriage.linux. I
*think* all commits here should have an alternation
between e9be9d5e76e34872f0c37d72e25bc27fe9e2c54c or a
locally defined identifier for the git commit that pulled
back overlayfs into trusty's kernel, which I believe is
https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/trusty/commit/?id=4d83812e9f64ea7a5be1d8c220e9534684ad74bd

I'll try and fix it up tomorrow.

Thanks for trying to get the records straight!

--
Steve Beattie
<email address hidden>

[Kees Cook (kees)]

> On Tue, Sep 14, 2021 at 04:15:47PM -0000, Kees Cook wrote:
> > Kees Cook has proposed merging ~kees/ubuntu-cve-tracker:linux-cves into ubuntu-cve-tracker:master.
>
> Hi, Kees.
>
> Thanks a lot for your work on this. Here is my take on some of these.

Hi! Thanks for the review. :)

> > diff --git a/active/CVE-2021-27365 b/active/CVE-2021-27365
> > index dd06602..1e7aef6 100644
> > --- a/active/CVE-2021-27365
> > +++ b/active/CVE-2021-27365
> > @@ -33,8 +33,8 @@ CVSS:
> > nvd: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
> >
> > Patches_linux:
> > - break-fix: - f9dbdf97a5bd92b1a49cee3d591b55b11fd7a6d5
> > - break-fix: - ec98ea7070e94cc25a422ec97d1421e28d97b7ee
> > + break-fix: 23d6fefbb3f6b1cc29794427588b470ed06ff64e
> f9dbdf97a5bd92b1a49cee3d591b55b11fd7a6d5
>
> This doesn't make sense. 23d6fefbb3f6 ("scsi: iscsi: Fix in-kernel conn
> failure handling") comes after f9dbdf97a5bd ("scsi: iscsi: Verify lengths
> on passthrough PDUs"). This looks more like 0896b7523026 ("[SCSI]
> open-iscsi/linux-iscsi-5 Initiator: Transport class update for iSCSI)",
> from 2005.

Whoops! Yes, this is a mispaste it seems. I agree, 0896b7523026 is best here.

>
> > + break-fix: a54a52caad4bd6166cb7fa64e4e93031fa2fda5d
> ec98ea7070e94cc25a422ec97d1421e28d97b7ee
>
> a54a52caad4b ("[SCSI] iscsi: fixup set/get param functions") is so old that
> I wouldn't bother adding it. We only support trusty and newer anyway.
> However, we do add 1da177 as a break commit sometimes. I think the most use
> of it is stating "the break commit is known". Because anything earlier than
> v3.13 will give us the same triage results.

I regularly do historical CVE flaw lifetime analysis (see the lifetime graph, slide 5, at https://outflux.net/slides/2019/lss/kspp.pdf), so it's worth it to me to have these as correctly triaged as possible. (i.e. it doesn't hurt to have it recorded.)

> > diff --git a/active/CVE-2021-29154 b/active/CVE-2021-29154
> > index ee3abb3..2559949 100644
> > --- a/active/CVE-2021-29154
> > +++ b/active/CVE-2021-29154
> > @@ -29,7 +29,7 @@ CVSS:
> > nvd: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
> >
> > Patches_linux:
> > - break-fix: - e4d4d456436bfb2fe412ee2cd489f7658449b098
> > + break-fix: 0a14842f5a3c0e88a1e59fac5c3025db39721f74
> e4d4d456436bfb2fe412ee2cd489f7658449b098
>
> OK, this is the commit that introduces BPF JIT. Finding a break commit here
> would help us determine whether trusty is vulnerable. We know this can be
> exploited with eBPF, but no idea if cBPF could be used here. And, then,
> would the initial JIT implementation be vulnerable, or would it require
> some later commit? I still would rather leave the break commit as "-",
> stating that we still need to investigate this.

This is correct, though. It was specifically the x86_64 JIT that was broken (and that's what the fix fixes). This correctly maps to the next line, which is for i386:

> break-fix: 03f5781be2c7b7e728d724ac70ba10799cc710d7 26f55a59dc65ff77cd1c4b37991e26497fc68049

See the note at the end of e4d4d456436bfb2fe412ee2cd489f7658449b098, which discusses the split of fixes between x86_64 and i386.

Regardless, as "-" effectively means "beginning of GIT history", the in...

[Kees Cook (kees)]

> Hey Kees,
>
> Cascardo has already commented on the CVEs in the active directory. Most
> of the retired CVE changes look fine, the only two that are a problem
> are:
>
> > --- a/retired/CVE-2016-1575
> > +++ b/retired/CVE-2016-1575
> > @@ -39,8 +39,8 @@ CVSS:
> > nvd: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
> >
> > Patches_linux:
> > - break-fix: - 1175b6b8d96331676f1d436b089b965807f23b4a
> > - break-fix: - local-2016-1575-2
> > + break-fix: e9be9d5e76e34872f0c37d72e25bc27fe9e2c54c
> 1175b6b8d96331676f1d436b089b965807f23b4a
> > + break-fix: local-2016-1575-2-break local-2016-1575-2
> > upstream_linux: needed
> > precise_linux: ignored (reached end-of-life)
> > precise/esm_linux: not-affected (no user-namespace mounts)
> > diff --git a/retired/CVE-2016-1576 b/retired/CVE-2016-1576
> > index a87ae91..0e7bed8 100644
> > --- a/retired/CVE-2016-1576
> > +++ b/retired/CVE-2016-1576
> > @@ -40,8 +40,8 @@ CVSS:
> > nvd: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
> >
> > Patches_linux:
> > - break-fix: - local-2016-1576-1
> > - break-fix: - local-2016-1576-2
> > + break-fix: e9be9d5e76e34872f0c37d72e25bc27fe9e2c54c
> local-2016-1576-1|e9f57ebcba563e0cd532926cab83c92bb4d79360
> > + break-fix: local-2016-1576-2-break local-2016-1576-2
> > upstream_linux: needed
> > Priority_linux_precise: low
> > Priority_linux_precise/esm: low
> > diff --git a/retired/CVE-2017-7184 b/retired/CVE-2017-7184
> > index 167f349..7dff1d9 100644
>
> Neither added breaks entries, local-2016-1575-2-break or
> local-2016-1576-2-break, are defined in active/10autotriage.linux. I
> *think* all commits here should have an alternation
> between e9be9d5e76e34872f0c37d72e25bc27fe9e2c54c or a
> locally defined identifier for the git commit that pulled
> back overlayfs into trusty's kernel, which I believe is
> https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/trusty/comm
> it/?id=4d83812e9f64ea7a5be1d8c220e9534684ad74bd
>
> I'll try and fix it up tomorrow.
>
> Thanks for trying to get the records straight!

Ah-ha! Thanks for the reference -- I wasn't sure where the "local-*" stuff lived, and I wasn't sure it wasn't just a magic value. :) Thanks for finding the backport sha -- that's seems a much better reference. Let me fix that now...

[Kees Cook (kees)]

Ok, a393fe5f1d52 updated with both review comment threads. Thanks!

[Steve Beattie (sbeattie)]

Thanks, I touched up the breaks entries and merged your fixes in https://git.launchpad.net/ubuntu-cve-tracker/commit/?id=449c32e2fd6a9cfe5179e5be0a8e9d5cc9fe7792

review: Approve

diff --git a/active/CVE-2021-27365 b/active/CVE-2021-27365
index b1adc58..3b30b1c 100644
--- a/active/CVE-2021-27365
+++ b/active/CVE-2021-27365
@@ -33,8 +33,8 @@ CVSS:
  nvd: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 
 Patches_linux:
- break-fix: - f9dbdf97a5bd92b1a49cee3d591b55b11fd7a6d5
- break-fix: - ec98ea7070e94cc25a422ec97d1421e28d97b7ee
+ break-fix: 0896b752302662909b52895bd7f601136001069d f9dbdf97a5bd92b1a49cee3d591b55b11fd7a6d5
+ break-fix: a54a52caad4bd6166cb7fa64e4e93031fa2fda5d ec98ea7070e94cc25a422ec97d1421e28d97b7ee
 upstream_linux: released (5.12~rc2)
 precise/esm_linux: ignored (was needs-triage ESM criteria)
 trusty_linux: ignored (out of standard support)
diff --git a/active/CVE-2021-29154 b/active/CVE-2021-29154
index 7c5910c..45156b9 100644
--- a/active/CVE-2021-29154
+++ b/active/CVE-2021-29154
@@ -29,7 +29,7 @@ CVSS:
  nvd: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 
 Patches_linux:
- break-fix: - e4d4d456436bfb2fe412ee2cd489f7658449b098
+ break-fix: 0a14842f5a3c0e88a1e59fac5c3025db39721f74 e4d4d456436bfb2fe412ee2cd489f7658449b098
  break-fix: 03f5781be2c7b7e728d724ac70ba10799cc710d7 26f55a59dc65ff77cd1c4b37991e26497fc68049
 upstream_linux: released (5.12~rc7)
 precise/esm_linux: ignored (end of ESM support, was needs-triage)
diff --git a/retired/CVE-2011-4594 b/retired/CVE-2011-4594
index b889018..cdbb29c 100644
--- a/retired/CVE-2011-4594
+++ b/retired/CVE-2011-4594
@@ -26,7 +26,6 @@ CVSS:
 
 Patches_linux:
  break-fix: c71d8ebe7a4496fb7231151cb70a6baa0cb56f9a bc909d9ddbf7778371e36a651d6e4194b1cc7d4c
- break-fix: 5b47b8038f183b44d2d8ff1c7d11a5c1be706b34 bc909d9ddbf7778371e36a651d6e4194b1cc7d4c
 upstream_linux: released (3.1~rc5)
 hardy_linux: not-affected
 lucid_linux: not-affected
diff --git a/retired/CVE-2014-3610 b/retired/CVE-2014-3610
index 52e1c0c..e3902fd 100644
--- a/retired/CVE-2014-3610
+++ b/retired/CVE-2014-3610
@@ -56,7 +56,7 @@ CVSS:
  nvd: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
 
 Patches_linux:
- break-fix: - 854e8bb1aa06c578c2c9145fa6bfe3680ef63b23
+ break-fix: 6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7 854e8bb1aa06c578c2c9145fa6bfe3680ef63b23
 upstream_linux: released (3.18~rc2)
 lucid_linux: released (2.6.32-71.138)
 precise_linux: released (3.2.0-72.107)
diff --git a/retired/CVE-2014-3611 b/retired/CVE-2014-3611
index 9593266..a0baa66 100644
--- a/retired/CVE-2014-3611
+++ b/retired/CVE-2014-3611
@@ -49,7 +49,7 @@ CVSS:
  nvd: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
 
 Patches_linux:
- break-fix: - 2febc839133280d5a5e8e1179c94ea674489dae2
+ break-fix: 6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7 2febc839133280d5a5e8e1179c94ea674489dae2
 upstream_linux: released (3.18~rc2)
 lucid_linux: released (2.6.32-71.138)
 precise_linux: released (3.2.0-72.107)
diff --git a/retired/CVE-2014-3645 b/retired/CVE-2014-3645
index 9a8e0cc..196feb6 100644
--- a/retired/CVE-2014-3645
+++ b/retired/CVE-2014-3645
@@ -30,7 +30,7 @@ Assigned-to:
 CVSS: 
 
 Patches_linux:
- break-fix: - bfd0a56b90005f8c8a004baf407ad90045c2b11e
+ break-fix: 6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7 bfd0a56b90005f8c8a004baf407ad90045c2b11e
 upstream_linux: released (3.12~rc1)
 lucid_linux: ignored (reached end-of-life)
 precise_linux: released (3.2.0-72.107)
diff --git a/retired/CVE-2014-3646 b/retired/CVE-2014-3646
index 18417af..a616847 100644
--- a/retired/CVE-2014-3646
+++ b/retired/CVE-2014-3646
@@ -47,7 +47,7 @@ CVSS:
  nvd: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
 
 Patches_linux:
- break-fix: - a642fc305053cc1c6e47e4f4df327895747ab485
+ break-fix: 6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7 a642fc305053cc1c6e47e4f4df327895747ab485
 upstream_linux: released (3.18~rc2)
 lucid_linux: ignored (reached end-of-life)
 precise_linux: released (3.2.0-72.107)
diff --git a/retired/CVE-2014-3647 b/retired/CVE-2014-3647
index 607f12a..f6aa58c 100644
--- a/retired/CVE-2014-3647
+++ b/retired/CVE-2014-3647
@@ -46,8 +46,8 @@ CVSS:
  nvd: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
 
 Patches_linux:
- break-fix: - 234f3ce485d54017f15cf5e0699cff4100121601
- break-fix: - d1442d85cc30ea75f7d399474ca738e0bc96f715
+ break-fix: 6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7 234f3ce485d54017f15cf5e0699cff4100121601
+ break-fix: 6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7 d1442d85cc30ea75f7d399474ca738e0bc96f715
 upstream_linux: released (3.18~rc2)
 lucid_linux: ignored (reached end-of-life)
 precise_linux: released (3.2.0-72.107)
diff --git a/retired/CVE-2014-4943 b/retired/CVE-2014-4943
index c028d2e..841d099 100644
--- a/retired/CVE-2014-4943
+++ b/retired/CVE-2014-4943
@@ -34,7 +34,7 @@ Assigned-to:
 CVSS: 
 
 Patches_linux:
- break-fix: - 3cf521f7dc87c031617fd47e4b7aa2593c2f3daf
+ break-fix: 3557baabf28088f49bdf72a048fd33ab62e205b1 3cf521f7dc87c031617fd47e4b7aa2593c2f3daf
 upstream_linux: released (3.16~rc6)
 lucid_linux: released (2.6.32-64.128)
 precise_linux: released (3.2.0-67.101)
diff --git a/retired/CVE-2014-7826 b/retired/CVE-2014-7826
index cb088e3..d5d53e5 100644
--- a/retired/CVE-2014-7826
+++ b/retired/CVE-2014-7826
@@ -34,7 +34,7 @@ CVSS:
  nvd: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 
 Patches_linux:
- break-fix: - 086ba77a6db00ed858ff07451bedee197df868c9
+ break-fix: bed1ffca022cc876fb83161d26670e9b5d3cf36b 086ba77a6db00ed858ff07451bedee197df868c9
 upstream_linux: released (3.18~rc3)
 lucid_linux: not-affected (depends on CONFIG_FTRACE_SYSCALLS)
 precise_linux: released (3.2.0-73.108)
diff --git a/retired/CVE-2014-8134 b/retired/CVE-2014-8134
index f5c21f1..faf3faa 100644
--- a/retired/CVE-2014-8134
+++ b/retired/CVE-2014-8134
@@ -37,7 +37,7 @@ CVSS:
  nvd: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
 
 Patches_linux:
- break-fix: - 29fa6825463c97e5157284db80107d1bfac5d77b
+ break-fix: 6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7 29fa6825463c97e5157284db80107d1bfac5d77b
 upstream_linux: released (3.19~rc1)
 lucid_linux: released (2.6.32-70.137)
 precise_linux: released (3.2.0-74.109)
diff --git a/retired/CVE-2015-0239 b/retired/CVE-2015-0239
index 0cd0947..0170d39 100644
--- a/retired/CVE-2015-0239
+++ b/retired/CVE-2015-0239
@@ -34,7 +34,7 @@ Assigned-to:
 CVSS: 
 
 Patches_linux:
- break-fix: - f3747379accba8e95d70cec0eae0582c8c182050
+ break-fix: 6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7 f3747379accba8e95d70cec0eae0582c8c182050
 upstream_linux: released (3.19~rc6)
 lucid_linux: ignored (reached end-of-life)
 precise_linux: released (3.2.0-77.112)
diff --git a/retired/CVE-2015-5307 b/retired/CVE-2015-5307
index a1ff897..c307ccd 100644
--- a/retired/CVE-2015-5307
+++ b/retired/CVE-2015-5307
@@ -39,7 +39,7 @@ Assigned-to:
 CVSS: 
 
 Patches_linux:
- break-fix: - 54a20552e1eae07aa240fa370a0293e006b5faed
+ break-fix: 6aa8b732ca01c3d7a54e93f4d701b8aabbe60fb7 54a20552e1eae07aa240fa370a0293e006b5faed
 upstream_linux: released (4.4~rc1)
 precise_linux: released (3.2.0-94.134)
 precise/esm_linux: released (3.2.0-94.134)
diff --git a/retired/CVE-2016-1575 b/retired/CVE-2016-1575
index ea35449..e5e0219 100644
--- a/retired/CVE-2016-1575
+++ b/retired/CVE-2016-1575
@@ -39,8 +39,8 @@ CVSS:
  nvd: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 
 Patches_linux:
- break-fix: - 1175b6b8d96331676f1d436b089b965807f23b4a
- break-fix: - local-2016-1575-2
+ break-fix: 4d83812e9f64ea7a5be1d8c220e9534684ad74bd|e9be9d5e76e34872f0c37d72e25bc27fe9e2c54c 1175b6b8d96331676f1d436b089b965807f23b4a
+ break-fix: 4d83812e9f64ea7a5be1d8c220e9534684ad74bd local-2016-1575-2
 upstream_linux: needed
 precise_linux: ignored (reached end-of-life)
 precise/esm_linux: not-affected (no user-namespace mounts)
diff --git a/retired/CVE-2016-1576 b/retired/CVE-2016-1576
index a87ae91..612a4f7 100644
--- a/retired/CVE-2016-1576
+++ b/retired/CVE-2016-1576
@@ -40,8 +40,8 @@ CVSS:
  nvd: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 
 Patches_linux:
- break-fix: - local-2016-1576-1
- break-fix: - local-2016-1576-2
+ break-fix: 4d83812e9f64ea7a5be1d8c220e9534684ad74bd|e9be9d5e76e34872f0c37d72e25bc27fe9e2c54c local-2016-1576-1|e9f57ebcba563e0cd532926cab83c92bb4d79360
+ break-fix: 4d83812e9f64ea7a5be1d8c220e9534684ad74bd local-2016-1576-2
 upstream_linux: needed
 Priority_linux_precise: low
 Priority_linux_precise/esm: low
diff --git a/retired/CVE-2017-7184 b/retired/CVE-2017-7184
index 167f349..7dff1d9 100644
--- a/retired/CVE-2017-7184
+++ b/retired/CVE-2017-7184
@@ -42,8 +42,8 @@ CVSS:
  nvd: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
 
 Patches_linux:
- break-fix: - 677e806da4d916052585301785d847c3b3e6186a
- break-fix: - f843ee6dd019bcece3e74e76ad9df0155655d0df
+ break-fix: d51d081d65048a7a6f9956a7809c3bb504f3b95d 677e806da4d916052585301785d847c3b3e6186a
+ break-fix: d51d081d65048a7a6f9956a7809c3bb504f3b95d f843ee6dd019bcece3e74e76ad9df0155655d0df
 upstream_linux: released (4.11~rc5)
 precise_linux: released (3.2.0-125.168)
 precise/esm_linux: released (3.2.0-125.168)
diff --git a/retired/CVE-2019-14895 b/retired/CVE-2019-14895
index 7cc738a..9a32611 100644
--- a/retired/CVE-2019-14895
+++ b/retired/CVE-2019-14895
@@ -34,7 +34,7 @@ CVSS:
  nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
 
 Patches_linux:
- break-fix: - local-2019-14895-fix
+ break-fix: - local-2019-14895-fix|3d94a4a8373bf5f45cf5f939e88b8354dbf2311b
 upstream_linux: needed
 precise/esm_linux: ignored (was needs-triage ESM criteria)
 trusty_linux: ignored (out of standard support)
diff --git a/retired/CVE-2019-14901 b/retired/CVE-2019-14901
index 55b2aa0..b56ec9d 100644
--- a/retired/CVE-2019-14901
+++ b/retired/CVE-2019-14901
@@ -36,7 +36,7 @@ CVSS:
  nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
 
 Patches_linux:
- break-fix: - local-2019-14901-fix
+ break-fix: - local-2019-14901-fix|1e58252e334dc3f3756f424a157d1b7484464c40
 upstream_linux: needed
 precise/esm_linux: ignored (was needs-triage ESM criteria)
 trusty_linux: ignored (out of standard support)