This bug was fixed in the package linux-snapdragon - 4.4.0-1022.25 --------------- linux-snapdragon (4.4.0-1022.25) xenial; urgency=low
[ Seth Forshee ] * Release Tracking Bug - LP: #1605716 [ Ubuntu: 4.4.0-33.52 ] * Release Tracking Bug - LP: #1605709 * [regression] NFS client: access problems after updating to kernel 4.4.0-31-generic (LP: #1603719) - SAUCE: (namespace) Bypass sget() capability check for nfs linux-snapdragon (4.4.0-1021.24) xenial; urgency=low [ Seth Forshee ] * Release Tracking Bug - LP: #1604458 * Drop superseded namespace mount patches (LP: #1604830) - UBUNTU: SAUCE: fs: Ensure the mounter of a filesystem is privileged towards its inodes - UBUNTU: SAUCE: quota: Treat superblock owner as privilged - UBUNTU: SAUCE: kernfs: Always set super block owner to init_user_ns - UBUNTU: SAUCE: proc: Always set super block owner to init_user_ns * UBUNTU: [Config] updateconfigs after 4.4.0-32.51 rebase (LP: #1603483) [ Kamal Mostafa ] * [Debian] embed derivative target name in release tag (LP: #1599924) [ Ubuntu: 4.4.0-32.51 ] * Release Tracking Bug - LP: #1604443 * thinkpad yoga 260 wacom touchscreen not working (LP: #1603975) - HID: wacom: break out parsing of device and registering of input - HID: wacom: Initialize hid_data.inputmode to -1 - HID: wacom: Support switching from vendor-defined device mode on G9 and G11 * changelog: add CVEs as first class citizens (LP: #1604344) - use CVE numbers in changelog * [Xenial] Include Huawei PCIe SSD hio kernel driver (LP: #1603483) - SAUCE: import Huawei ES3000_V2 (2.1.0.23) - SAUCE: hio: bio_endio() no longer takes errors arg - SAUCE: hio: blk_queue make_request_fn now returns a blk_qc_t - SAUCE: hio: use alloc_cpumask_var to avoid -Wframe-larger-than - SAUCE: hio: fix mask maybe-uninitialized warning - [config] enable CONFIG_HIO (Huawei ES3000_V2 PCIe SSD driver) - SAUCE: hio: Makefile and Kconfig * CVE-2016-5243 (LP: #1589036) - tipc: fix an infoleak in tipc_nl_compat_link_dump - tipc: fix nl compat regression for link statistics * CVE-2016-4470 - KEYS: potential uninitialized variable * integer overflow in xt_alloc_table_info (LP: #1555353) - netfilter: x_tables: check for size overflow * CVE-2016-3135: - Revert "UBUNTU: SAUCE: (noup) netfilter: x_tables: check for size overflow" * CVE-2016-4440 (LP: #1584192) - kvm:vmx: more complete state update on APICv on/off * the system hangs in the dma driver when reboot or shutdown on a baytrail-m laptop (LP: #1602579) - dmaengine: dw: platform: power on device on shutdown - ACPI / LPSS: override power state for LPSS DMA device * Add proper palm detection support for MS Precision Touchpad (LP: #1593124) - Revert "HID: multitouch: enable palm rejection if device implements confidence usage" - HID: multitouch: enable palm rejection for Windows Precision Touchpad * Add support for Intel 8265 Bluetooth ([8087:0A2B]) (LP: #1599068) - Bluetooth: Add support for Intel Bluetooth device 8265 [8087:0a2b] * CVE-2016-4794 (LP: #1581871) - percpu: fix synchronization between chunk->map_extend_work and chunk destruction - percpu: fix synchronization between synchronous map extension and chunk destruction * Xenial update to v4.4.15 stable release (LP: #1601952) - net_sched: fix pfifo_head_drop behavior vs backlog - net: Don't forget pr_fmt on net_dbg_ratelimited for CONFIG_DYNAMIC_DEBUG - sit: correct IP protocol used in ipip6_err - esp: Fix ESN generation under UDP encapsulation - netem: fix a use after free - ipmr/ip6mr: Initialize the last assert time of mfc entries. - Bridge: Fix ipv6 mc snooping if bridge has no ipv6 address - sock_diag: do not broadcast raw socket destruction - bpf, perf: delay release of BPF prog after grace period - neigh: Explicitly declare RCU-bh read side critical section in neigh_xmit() - net: macb: fix default configuration for GMAC on AT91 - net: alx: Work around the DMA RX overflow issue - bpf: try harder on clones when writing into skb - AX.25: Close socket connection on session completion - crypto: ux500 - memmove the right size - crypto: user - re-add size check for CRYPTO_MSG_GETALG - USB: uas: Fix slave queue_depth not being set - usb: quirks: Fix sorting - usb: quirks: Add no-lpm quirk for Acer C120 LED Projector - usb: musb: only restore devctl when session was set in backup - usb: musb: Stop bulk endpoint while queue is rotated - usb: musb: Ensure rx reinit occurs for shared_fifo endpoints - usb: musb: host: correct cppi dma channel for isoch transfer - usb: xhci-plat: properly handle probe deferral for devm_clk_get() - USB: xhci: Add broken streams quirk for Frescologic device id 1009 - xhci: Fix handling timeouted commands on hosts in weird states. - USB: mos7720: delete parport - usb: gadget: fix spinlock dead lock in gadgetfs - usb: host: ehci-tegra: Grab the correct UTMI pads reset - usb: dwc3: exynos: Fix deferred probing storm. - Linux 4.4.15 * qeth: delete napi struct when removing a qeth device (LP: #1601831) - qeth: delete napi struct when removing a qeth device * Adjust KBL PCI-ID's (LP: #1600124) - drm/i915: Add more Kabylake PCI IDs. - drm/i915: Removing PCI IDs that are no longer listed as Kabylake. * [i915_bpo] Rebase driver to v4.7-rc6 + gen9 workarounds + KBP PCH support (LP: #1599109) - drm/kms_helper: Add a common place to call init and exit functions. - drm: Add helper for DP++ adaptors - GPU-DRM: Delete unnecessary checks before drm_property_unreference_blob() - drm: introduce pipe color correction properties - drm: fix blob pointer check - drm: atomic helper: do not unreference error pointer - drm: fix lut value extraction function - drm/dsi: Add a helper to get bits per pixel of MIPI DSI pixel format - SAUCE: drm: Introduce drm_malloc_gfp() - SAUCE: i915_bpo: Rebase to v4.7-rc6 - SAUCE: i915_bpo: Add backported workarounds for gen9 - SAUCE: i915_bpo: Revert "drm/i915: Get panel_type from OpRegion panel details" - SAUCE: i915_bpo: Introduce Kabypoint PCH for Kabylake H/DT. * Baytrail-I got black screen with HDMI output (LP: #1599379) - drm/i915: Only ignore eDP ports that are connected - drm/i915: Check VBT for port presence in addition to the strap on VLV/CHV * [Hyper-V] storvsc messages for CD-ROM medium not present tray closed (LP: #1590655) - SAUCE: (no-up) scsi: storvsc: Filter out storvsc messages CD-ROM medium not present * Hotplug device addition issue - missing patches on Xenial kernel (LP: #1599250) - Revert "UBUNTU: SAUCE: powerpc/eeh: Validate arch in eeh_add_device_early()" - Revert "powerpc/eeh: Fix crash in eeh_add_device_early() on Cell" - powerpc/iommu: Remove the dependency on EEH struct in DDW mechanism - powerpc/pseries: Fix PCI config address for DDW * kernel: signal return with invalid floating-point control (LP: #1597971) - s390: fix test_fp_ctl inline assembly contraints * [Toshiba P50W-B00F] Touchscreen no longer working (LP: #1498667) - SAUCE: (no-up) usb: quirks: Add no-lpm quirk for Elan Microelectronics Touchpad * [yakkety] d-i does not support (ehci_msm) Qualcomm On-Chip EHCI Host Controller (LP: #1599347) - d-i: Add ehci_msm to usb-modules * [Bug] Legacy audio couldn't work after S3 resume on Kabylake (LP: #1596871) - ALSA: hda - Skip ELD notification during PM process - ALSA: hda - hdmi add wmb barrier for audio component - ALSA: hda - hdmi defer to register acomp eld notifier * sync spl 0.6.5.6-0ubuntu4 changes into Xenial kernel source (LP: #1599257) - SAUCE: (noup) Update spl to 0.6.5.6-0ubuntu4 * Config: missing AMD Seattle platform support (LP: #1597574) - [Config] Enable the AMD Seattle platform * Network installer fails to detect network on AMD Overdrive (ARM64) (LP: #1597573) - [Config] Add amd-xgbe to nic-modules udeb * exercising ptys causes a kernel oops (LP: #1586418) - devpts: fix null pointer dereference on failed memory allocation * Regression (constant vibration of device) in xpad driver in Ubuntu 16.04 (LP: #1574102) - Input: xpad - move pending clear to the correct location * thunderx nics fail to establish link (LP: #1597867) - net: thunderx: Fix link status reporting * Xenial update to v4.4.14 stable release (LP: #1596575) - scsi_lib: correctly retry failed zero length REQ_TYPE_FS commands - scsi: Add QEMU CD-ROM to VPD Inquiry Blacklist - netlink: Fix dump skb leak/double free - tipc: fix nametable publication field in nl compat - switchdev: pass pointer to fib_info instead of copy - tuntap: correctly wake up process during uninit - udp: prevent skbs lingering in tunnel socket queues - uapi glibc compat: fix compilation when !__USE_MISC in glibc - sfc: on MC reset, clear PIO buffer linkage in TXQs - team: don't call netdev_change_features under team->lock - vxlan: Accept user specified MTU value when create new vxlan link - tcp: record TLP and ER timer stats in v6 stats - bridge: Don't insert unnecessary local fdb entry on changing mac address - l2tp: fix configuration passed to setup_udp_tunnel_sock() - ipv6: Skip XFRM lookup if dst_entry in socket cache is valid - vxlan: Relax MTU constraints - geneve: Relax MTU constraints - vxlan, gre, geneve: Set a large MTU on ovs-created tunnel devices - KVM: x86: fix OOPS after invalid KVM_SET_DEBUGREGS - KVM: irqfd: fix NULL pointer dereference in kvm_irq_map_gsi - ALSA: hda - Add PCI ID for Kabylake - ALSA: hda - Fix headset mic detection problem for Dell machine - ALSA: hda/realtek - ALC256 speaker noise issue - ALSA: hda/realtek - Add support for new codecs ALC700/ALC701/ALC703 - ALSA: hda/realtek: Add T560 docking unit fixup - ARM: fix PTRACE_SETVFPREGS on SMP systems - gpio: bcm-kona: fix bcm_kona_gpio_reset() warnings - s390/bpf: fix recache skb->data/hlen for skb_vlan_push/pop - s390/bpf: reduce maximum program size to 64 KB - irqchip/gic-v3: Fix ICC_SGI1R_EL1.INTID decoding mask - crypto: public_key: select CRYPTO_AKCIPHER - crypto: ccp - Fix AES XTS error for request sizes above 4096 - arm64: Provide "model name" in /proc/cpuinfo for PER_LINUX32 tasks - arm64: mm: always take dirty state from new pte in ptep_set_access_flags - powerpc/pseries/eeh: Handle RTAS delay requests in configure_bridge - powerpc: Fix definition of SIAR and SDAR registers - powerpc: Use privileged SPR number for MMCR2 - powerpc/pseries: Add POWER8NVL support to ibm,client-architecture-support call - pinctrl: mediatek: fix dual-edge code defect - parisc: Fix pagefault crash in unaligned __get_user() call - memcg: add RCU locking around css_for_each_descendant_pre() in memcg_offline_kmem() - wext: Fix 32 bit iwpriv compatibility issue with 64 bit Kernel - x86/entry/traps: Don't force in_interrupt() to return true in IST handlers - fix d_walk()/non-delayed __d_free() race - sparc: Fix system call tracing register handling. - sparc64: Fix bootup regressions on some Kconfig combinations. - sparc64: Fix numa node distance initialization - sparc64: Fix sparc64_set_context stack handling. - sparc/PCI: Fix for panic while enabling SR-IOV - sparc64: Reduce TLB flushes during hugepte changes - sparc64: Take ctx_alloc_lock properly in hugetlb_setup(). - sparc: Harden signal return frame checks. - sparc64: Fix return from trap window fill crashes. - MIPS: Fix 64k page support for 32 bit kernels. - crypto: qat - fix adf_ctl_drv.c:undefined reference to adf_init_pf_wq - drm/core: Do not preserve framebuffer on rmfb, v4. - Linux 4.4.14 * [Hyper-V] Rebase Hyper-V to 4.6 kernel (LP: #1583357) - hv_netvsc: rework link status change handling - hv_netvsc: Resize some of the variables in hv_netvsc_packet - hv_netvsc: Rearrange the hv_negtvsc_packet to be space efficient - hv_netvsc: Eliminate the channel field in hv_netvsc_packet structure - hv_netvsc: Eliminate rndis_msg pointer from hv_netvsc_packet structure - hv_netvsc: Eliminatte the data field from struct hv_netvsc_packet - hv_netvsc: Eliminate send_completion from struct hv_netvsc_packet - hv_netvsc: Eliminate send_completion_ctx from struct hv_netvsc_packet - hv_netvsc: Don't ask for additional head room in the skb - hv_netvsc: move subchannel existence check to netvsc_select_queue() - hv_netvsc: remove locking in netvsc_send() - hv_netvsc: Eliminate page_buf from struct hv_netvsc_packet - hv_netvsc: Eliminate send_completion_tid from struct hv_netvsc_packet - hv_netvsc: Eliminate is_data_pkt from struct hv_netvsc_packet - hv_netvsc: Eliminate completion_func from struct hv_netvsc_packet - hv_netvsc: Eliminate xmit_more from struct hv_netvsc_packet - hv_netvsc: Eliminate status from struct hv_netvsc_packet - hv_netvsc: Eliminate vlan_tci from struct hv_netvsc_packet - storvsc: add logging for error/warning messages - hv_netvsc: Fix race condition on Multi-Send Data field - kvm/x86: split ioapic-handled and EOI exit bitmaps - kvm/x86: per-vcpu apicv deactivation support - kvm/x86: Hyper-V synthetic interrupt controller - kvm/x86: Hyper-V kvm exit - kvm/x86: Rearrange func's declarations inside Hyper-V header - kvm/x86: Added Hyper-V vcpu_to_hv_vcpu()/hv_vcpu_to_vcpu() helpers - kvm/x86: Hyper-V internal helper to read MSR HV_X64_MSR_TIME_REF_COUNT - kvm/x86: Hyper-V SynIC message slot pending clearing at SINT ack - kvm/x86: Hyper-V SynIC timers - storvsc: Fix a bug in the layout of the hv_fc_wwn_packet - storvsc: Properly support Fibre Channel devices - storvsc: Refactor the code in storvsc_channel_init() - storvsc: Tighten up the interrupt path - storvsc: Fix typo in MODULE_PARM_DESC - Revert "hv_netvsc: use skb_get_hash() instead of a homegrown implementation" - hv_netvsc: use skb_get_hash() instead of a homegrown implementation - hv_netvsc: Fix book keeping of skb during batching process - storvsc: Install the storvsc specific timeout handler for FC devices - storvsc: Use the specified target ID in device lookup - Revert "Drivers: hv: vmbus: Cleanup vmbus_set_event()" - Drivers: hv: vmbus: Cleanup vmbus_set_event() - Revert "Drivers: hv: vmbus: Eliminate the spin lock on the read path" - Drivers: hv: vmbus: Eliminate the spin lock on the read path - Revert "hv_netvsc: cleanup netdev feature flags for netvsc" - hv_netvsc: cleanup netdev feature flags for netvsc - hv_netvsc: Restore needed_headroom request - kvm/x86: Rename Hyper-V long spin wait hypercall - hv_netvsc: add software transmit timestamp support - hv_netvsc: add ethtool support for set and get of settings - hv_netvsc: Fix accessing freed memory in netvsc_change_mtu() - hv_netvsc: Fix the array sizes to be max supported channels - hv_netvsc: Fix the order of num_sc_offered decrement - x86/hyperv: Avoid reporting bogus NMI status for Gen2 instances - Drivers: hv: vmbus: Fix signaling logic in hv_need_to_signal_on_read() - Drivers: hv: kvp: fix IP Failover [ Ubuntu: 4.4.0-31.50 ] * Release Tracking Bug - LP: #1602449 * nouveau: boot hangs at blank screen with unsupported graphics cards (LP: #1602340) - SAUCE: drm: check for supported chipset before booting fbdev off the hw -- Seth Forshee <seth.fors...@canonical.com> Fri, 22 Jul 2016 16:52:25 -0500 -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux-armadaxp in Ubuntu. https://bugs.launchpad.net/bugs/1555353 Title: CVE-2016-3135 Status in linux package in Ubuntu: Fix Released Status in linux-armadaxp package in Ubuntu: Invalid Status in linux-flo package in Ubuntu: New Status in linux-goldfish package in Ubuntu: New Status in linux-lts-quantal package in Ubuntu: Invalid Status in linux-lts-raring package in Ubuntu: Invalid Status in linux-lts-saucy package in Ubuntu: Invalid Status in linux-lts-trusty package in Ubuntu: Invalid Status in linux-lts-utopic package in Ubuntu: Invalid Status in linux-lts-vivid package in Ubuntu: Invalid Status in linux-lts-wily package in Ubuntu: Invalid Status in linux-lts-xenial package in Ubuntu: Invalid Status in linux-mako package in Ubuntu: New Status in linux-manta package in Ubuntu: Invalid Status in linux-raspi2 package in Ubuntu: Fix Released Status in linux-snapdragon package in Ubuntu: Fix Released Status in linux-ti-omap4 package in Ubuntu: Invalid Status in linux source package in Precise: Invalid Status in linux-armadaxp source package in Precise: Invalid Status in linux-flo source package in Precise: Invalid Status in linux-goldfish source package in Precise: Invalid Status in linux-lts-quantal source package in Precise: Invalid Status in linux-lts-raring source package in Precise: Invalid Status in linux-lts-saucy source package in Precise: Invalid Status in linux-lts-trusty source package in Precise: Invalid Status in linux-lts-utopic source package in Precise: Invalid Status in linux-lts-vivid source package in Precise: Invalid Status in linux-lts-wily source package in Precise: Invalid Status in linux-lts-xenial source package in Precise: Invalid Status in linux-mako source package in Precise: Invalid Status in linux-manta source package in Precise: Invalid Status in linux-raspi2 source package in Precise: Invalid Status in linux-snapdragon source package in Precise: Invalid Status in linux-ti-omap4 source package in Precise: Invalid Status in linux source package in Trusty: Invalid Status in linux-armadaxp source package in Trusty: Invalid Status in linux-flo source package in Trusty: Invalid Status in linux-goldfish source package in Trusty: Invalid Status in linux-lts-quantal source package in Trusty: Invalid Status in linux-lts-raring source package in Trusty: Invalid Status in linux-lts-saucy source package in Trusty: Invalid Status in linux-lts-trusty source package in Trusty: Invalid Status in linux-lts-utopic source package in Trusty: Invalid Status in linux-lts-vivid source package in Trusty: Invalid Status in linux-lts-wily source package in Trusty: Fix Released Status in linux-lts-xenial source package in Trusty: Fix Released Status in linux-mako source package in Trusty: Invalid Status in linux-manta source package in Trusty: Invalid Status in linux-raspi2 source package in Trusty: Invalid Status in linux-snapdragon source package in Trusty: Invalid Status in linux-ti-omap4 source package in Trusty: Invalid Status in linux source package in Wily: Fix Released Status in linux-armadaxp source package in Wily: Invalid Status in linux-flo source package in Wily: New Status in linux-goldfish source package in Wily: New Status in linux-lts-quantal source package in Wily: Invalid Status in linux-lts-raring source package in Wily: Invalid Status in linux-lts-saucy source package in Wily: Invalid Status in linux-lts-trusty source package in Wily: Invalid Status in linux-lts-utopic source package in Wily: Invalid Status in linux-lts-vivid source package in Wily: Invalid Status in linux-lts-wily source package in Wily: Invalid Status in linux-lts-xenial source package in Wily: Invalid Status in linux-mako source package in Wily: New Status in linux-manta source package in Wily: New Status in linux-raspi2 source package in Wily: Fix Released Status in linux-snapdragon source package in Wily: Invalid Status in linux-ti-omap4 source package in Wily: Invalid Status in linux source package in Xenial: Fix Released Status in linux-armadaxp source package in Xenial: Invalid Status in linux-flo source package in Xenial: New Status in linux-goldfish source package in Xenial: New Status in linux-lts-quantal source package in Xenial: Invalid Status in linux-lts-raring source package in Xenial: Invalid Status in linux-lts-saucy source package in Xenial: Invalid Status in linux-lts-trusty source package in Xenial: Invalid Status in linux-lts-utopic source package in Xenial: Invalid Status in linux-lts-vivid source package in Xenial: Invalid Status in linux-lts-wily source package in Xenial: Invalid Status in linux-lts-xenial source package in Xenial: Invalid Status in linux-mako source package in Xenial: New Status in linux-manta source package in Xenial: Invalid Status in linux-raspi2 source package in Xenial: New Status in linux-snapdragon source package in Xenial: Fix Committed Status in linux-ti-omap4 source package in Xenial: Invalid Status in linux source package in Yakkety: Fix Released Status in linux-armadaxp source package in Yakkety: Invalid Status in linux-flo source package in Yakkety: New Status in linux-goldfish source package in Yakkety: New Status in linux-lts-quantal source package in Yakkety: Invalid Status in linux-lts-raring source package in Yakkety: Invalid Status in linux-lts-saucy source package in Yakkety: Invalid Status in linux-lts-trusty source package in Yakkety: Invalid Status in linux-lts-utopic source package in Yakkety: Invalid Status in linux-lts-vivid source package in Yakkety: Invalid Status in linux-lts-wily source package in Yakkety: Invalid Status in linux-lts-xenial source package in Yakkety: Invalid Status in linux-mako source package in Yakkety: New Status in linux-manta source package in Yakkety: Invalid Status in linux-raspi2 source package in Yakkety: Fix Released Status in linux-snapdragon source package in Yakkety: Fix Released Status in linux-ti-omap4 source package in Yakkety: Invalid Bug description: [Impact] [From https://code.google.com/p/google-security-research/issues/detail?id=758 ] A recent refactoring cof this codepath (https://github.com/torvalds/linux/commit/2e4e6a17af35be359cc8f1c924f8f198fbd478cc) introduced an integer overflow in xt_alloc_table_info, which on 32-bit systems can lead to small structure allocation and a copy_from_user based heap corruption. More specifically, the overflow may have been introduced in https://github.com/torvalds/linux/commit/711bdde6a884354ddae8da2fcb495b2a9364cc90 ; specifically the bit: + size_t sz = sizeof(*info) + size; (where size is an unsigned int passed from userspace). This issue should only affect 32bit platforms (xt_table_info.size is an unsigned int). [Fix] Upstream proposed fix: http://marc.info/?l=netfilter-devel&m=145757136822750&w=2 [Test Case] Download v4 code from: https://code.google.com/p/google-security-research/issues/detail?id=758 gcc *v4.c -o v4 ./v4 Your machine should _not_ crash. This only affects 32-bit kernels To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1555353/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp