lp:~kmously/ubuntu/+source/linux/+git/trusty

Author: Dan Carpenter
Author Date: 2018-07-09 21:39:01 UTC

cdrom: information leak in cdrom_ioctl_media_changed()

CVE-2018-10940

This cast is wrong. "cdi->capacity" is an int and "arg" is an unsigned
long. The way the check is written now, if one of the high 32 bits is
set then we could read outside the info->slots[] array.

This bug is pretty old and it predates git.

Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: stable@vger.kernel.org
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
(cherry-picked from 9de4ee40547fd315d4a0ed1dd15a2fa3559ad707)
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>
Acked-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

Author: Khaled El Mously
Author Date: 2018-05-10 04:29:22 UTC

UBUNTU: Ubuntu-aws-4.4.0-1020.20

Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

Author: Khaled El Mously
Author Date: 2018-04-15 03:55:00 UTC

UBUNTU: Ubuntu-lts-4.4.0-121.145~14.04.1

Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

Author: Khaled El Mously
Author Date: 2018-03-16 18:55:49 UTC

UBUNTU: Ubuntu-aws-4.4.0-1015.15

Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

Author: Khaled El Mously
Author Date: 2018-03-15 06:41:47 UTC

UBUNTU: Ubuntu-lts-4.4.0-117.141~14.04.1

Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

Author: Srinivas Dasari
Author Date: 2018-02-02 04:37:37 UTC

cfg80211: Define nla_policy for NL80211_ATTR_LOCAL_MESH_POWER_MODE

CVE-2017-11089

Buffer overread may happen as nl80211_set_station() reads 4 bytes
from the attribute NL80211_ATTR_LOCAL_MESH_POWER_MODE without
validating the size of data received when userspace sends less
than 4 bytes of data with NL80211_ATTR_LOCAL_MESH_POWER_MODE.
Define nla_policy for NL80211_ATTR_LOCAL_MESH_POWER_MODE to avoid
the buffer overread.

Fixes: 3b1c5a5307f ("{cfg,nl}80211: mesh power mode primitives and userspace access")
Cc: stable@vger.kernel.org
Signed-off-by: Srinivas Dasari <dasaris@qti.qualcomm.com>
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
(cherry picked from commit 8feb69c7bd89513be80eb19198d48f154b254021)
Signed-off-by: Po-Hsu Lin <po-hsu.lin@canonical.com>
Acked-by: Colin Ian King <colin.king@canonical.com>
Acked-by: Kleber Souza <kleber.souza@canonical.com>
Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

Author: Khaled El Mously
Author Date: 2017-11-27 20:49:39 UTC

UBUNTU: Ubuntu-3.13.0-136.185

Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>

Author: Khaled El Mously
Author Date: 2017-11-23 08:13:29 UTC

UBUNTU: Ubuntu-lts-4.4.0-102.125~14.04.1

Signed-off-by: Khalid Elmously <khalid.elmously@canonical.com>