This bug was fixed in the package linux - 4.13.0-46.51 --------------- linux (4.13.0-46.51) artful; urgency=medium
* linux: 4.13.0-46.51 -proposed tracker (LP: #1776333) * register on binfmt_misc may overflow and crash the system (LP: #1775856) - fs/binfmt_misc.c: do not allow offset overflow * CVE-2018-11508 - compat: fix 4-byte infoleak via uninitialized struct field * rfi-flush: Switch to new linear fallback flush (LP: #1744173) - SAUCE: rfi-flush: Factor out init_fallback_flush() - SAUCE: rfi-flush: Move rfi_flush_fallback_area to end of paca - powerpc/64s: Improve RFI L1-D cache flush fallback - powerpc/rfi-flush: Make it possible to call setup_rfi_flush() again - powerpc/rfi-flush: Differentiate enabled and patched flush types - powerpc/rfi-flush: Call setup_rfi_flush() after LPM migration * Fix enabling bridge MMIO windows (LP: #1771344) - powerpc/eeh: Fix enabling bridge MMIO windows * CVE-2018-1130 - dccp: check sk for closed state in dccp_sendmsg() * CVE-2018-7757 - scsi: libsas: fix memory leak in sas_smp_get_phy_events() * cpum_sf: ensure sample freq is non-zero (LP: #1772593) - s390/cpum_sf: ensure sample frequency of perf event attributes is non-zero * wlp3s0: failed to remove key (1, ff:ff:ff:ff:ff:ff) from hardware (-22) (LP: #1720930) - iwlwifi: mvm: fix "failed to remove key" message * CVE-2018-6927 - futex: Prevent overflow by strengthen input validation * After update to 4.13-43 Intel Graphics are Laggy (LP: #1773520) - SAUCE: Revert "drm/i915/edp: Allow alternate fixed mode for eDP if available." * ELANPAD ELAN0612 does not work, patch available (LP: #1773509) - SAUCE: Input: elan_i2c - add ELAN0612 to the ACPI table * kernel backtrace when receiving large UDP packages (LP: #1772031) - iov_iter: fix page_copy_sane for compound pages * FS-Cache: Assertion failed: FS-Cache: 6 == 5 is false (LP: #1774336) - SAUCE: CacheFiles: fix a read_waiter/read_copier race * CVE-2018-5803 - sctp: verify size of a new chunk in _sctp_make_chunk() * enable mic-mute hotkey and led on Lenovo M820z and M920z (LP: #1774306) - ALSA: hda/realtek - Enable mic-mute hotkey for several Lenovo AIOs * CVE-2018-7755 - SAUCE: floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl * CVE-2018-5750 - ACPI: sbshc: remove raw pointer from printk() message -- Khalid Elmously <khalid.elmou...@canonical.com> Mon, 11 Jun 2018 23:25:30 +0000 ** Changed in: linux (Ubuntu Artful) Status: Fix Committed => Fix Released ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-1130 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-11508 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-5750 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-5803 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-6927 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-7755 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-7757 ** Changed in: linux (Ubuntu Trusty) Status: Fix Committed => Fix Released ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-12154 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-12193 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-15265 ** CVE added: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-3665 -- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux in Ubuntu. https://bugs.launchpad.net/bugs/1775856 Title: register on binfmt_misc may overflow and crash the system Status in linux package in Ubuntu: Incomplete Status in linux source package in Precise: Incomplete Status in linux source package in Trusty: Fix Released Status in linux source package in Xenial: Fix Released Status in linux source package in Artful: Fix Released Status in linux source package in Bionic: Fix Released Status in linux source package in Cosmic: Incomplete Bug description: [Impact] When registering a new binfmt_misc handler, it is possible to overflow the offset to get a negative value, which might crash the system, or possibly leak kernel data. Here is a crash log when 2500000000 was used as an offset: BUG: unable to handle kernel paging request at ffff989cfd6edca0 IP: load_misc_binary+0x22b/0x470 [binfmt_misc] PGD 1ef3e067 P4D 1ef3e067 PUD 0 Oops: 0000 [#1] SMP NOPTI Modules linked in: binfmt_misc kvm_intel ppdev kvm irqbypass joydev input_leds serio_raw mac_hid parport_pc qemu_fw_cfg parpy CPU: 0 PID: 2499 Comm: bash Not tainted 4.15.0-22-generic #24-Ubuntu Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-1 04/01/2014 RIP: 0010:load_misc_binary+0x22b/0x470 [binfmt_misc] Call Trace: search_binary_handler+0x97/0x1d0 do_execveat_common.isra.34+0x667/0x810 SyS_execve+0x31/0x40 do_syscall_64+0x73/0x130 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 Use kstrtoint instead of simple_strtoul. It will work as the code already set the delimiter byte to '\0' and we only do it when the field is not empty. [Test Case] Tested with offsets -1, 2500000000, UINT_MAX and INT_MAX. Also tested with examples documented at Documentation/admin-guide/binfmt-misc.rst and other registrations from packages on Ubuntu. [Regression] Fail to register valid types. This was tested with a bionic kernel with the patch. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1775856/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp