** Changed in: linux-lts-xenial (Ubuntu Precise)
Status: New => Invalid
** Changed in: linux-lts-xenial (Ubuntu Precise)
Importance: Undecided => High
** Changed in: linux-lts-xenial (Ubuntu Wily)
Status: New => Invalid
** Changed in: linux-lts-xenial (Ubuntu Wily)
Importance: Undecided => High
** Changed in: linux-lts-xenial (Ubuntu Xenial)
Status: New => Invalid
** Changed in: linux-lts-xenial (Ubuntu Xenial)
Importance: Undecided => High
** Changed in: linux-lts-xenial (Ubuntu Trusty)
Status: New => Fix Committed
** Changed in: linux-lts-xenial (Ubuntu Trusty)
Importance: Undecided => High
--
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux-armadaxp in Ubuntu.
https://bugs.launchpad.net/bugs/1316729
Title:
CVE-2014-1737
Status in linux package in Ubuntu:
Invalid
Status in linux-armadaxp package in Ubuntu:
Invalid
Status in linux-ec2 package in Ubuntu:
Invalid
Status in linux-flo package in Ubuntu:
Invalid
Status in linux-fsl-imx51 package in Ubuntu:
Invalid
Status in linux-goldfish package in Ubuntu:
Invalid
Status in linux-lts-backport-maverick package in Ubuntu:
Invalid
Status in linux-lts-backport-natty package in Ubuntu:
Invalid
Status in linux-lts-quantal package in Ubuntu:
Invalid
Status in linux-lts-raring package in Ubuntu:
Invalid
Status in linux-lts-saucy package in Ubuntu:
Invalid
Status in linux-lts-trusty package in Ubuntu:
Invalid
Status in linux-lts-utopic package in Ubuntu:
Invalid
Status in linux-lts-vivid package in Ubuntu:
Invalid
Status in linux-lts-wily package in Ubuntu:
Invalid
Status in linux-lts-xenial package in Ubuntu:
Invalid
Status in linux-mako package in Ubuntu:
Invalid
Status in linux-manta package in Ubuntu:
Invalid
Status in linux-mvl-dove package in Ubuntu:
Invalid
Status in linux-raspi2 package in Ubuntu:
Fix Committed
Status in linux-ti-omap4 package in Ubuntu:
Invalid
Status in linux-lts-backport-maverick source package in Lucid:
Won't Fix
Status in linux-lts-backport-natty source package in Lucid:
Won't Fix
Status in linux source package in Precise:
Fix Released
Status in linux-armadaxp source package in Precise:
Fix Released
Status in linux-ec2 source package in Precise:
Invalid
Status in linux-flo source package in Precise:
Invalid
Status in linux-fsl-imx51 source package in Precise:
Invalid
Status in linux-goldfish source package in Precise:
Invalid
Status in linux-lts-backport-maverick source package in Precise:
Won't Fix
Status in linux-lts-backport-natty source package in Precise:
Won't Fix
Status in linux-lts-quantal source package in Precise:
Fix Released
Status in linux-lts-raring source package in Precise:
Fix Released
Status in linux-lts-saucy source package in Precise:
Fix Released
Status in linux-lts-trusty source package in Precise:
Fix Released
Status in linux-lts-utopic source package in Precise:
Invalid
Status in linux-lts-vivid source package in Precise:
Invalid
Status in linux-lts-wily source package in Precise:
Invalid
Status in linux-lts-xenial source package in Precise:
Invalid
Status in linux-mako source package in Precise:
Invalid
Status in linux-manta source package in Precise:
Invalid
Status in linux-mvl-dove source package in Precise:
Invalid
Status in linux-raspi2 source package in Precise:
Invalid
Status in linux-ti-omap4 source package in Precise:
Fix Released
Status in linux-lts-backport-maverick source package in Quantal:
Won't Fix
Status in linux-lts-backport-natty source package in Quantal:
Won't Fix
Status in linux-lts-backport-maverick source package in Saucy:
Won't Fix
Status in linux-lts-backport-natty source package in Saucy:
Won't Fix
Status in linux source package in Trusty:
Fix Released
Status in linux-armadaxp source package in Trusty:
Invalid
Status in linux-ec2 source package in Trusty:
Invalid
Status in linux-flo source package in Trusty:
Invalid
Status in linux-fsl-imx51 source package in Trusty:
Invalid
Status in linux-goldfish source package in Trusty:
Invalid
Status in linux-lts-backport-maverick source package in Trusty:
Won't Fix
Status in linux-lts-backport-natty source package in Trusty:
Won't Fix
Status in linux-lts-quantal source package in Trusty:
Invalid
Status in linux-lts-raring source package in Trusty:
Invalid
Status in linux-lts-saucy source package in Trusty:
Invalid
Status in linux-lts-trusty source package in Trusty:
Invalid
Status in linux-lts-utopic source package in Trusty:
Invalid
Status in linux-lts-vivid source package in Trusty:
Fix Committed
Status in linux-lts-wily source package in Trusty:
Invalid
Status in linux-lts-xenial source package in Trusty:
Fix Committed
Status in linux-mako source package in Trusty:
Invalid
Status in linux-manta source package in Trusty:
Invalid
Status in linux-mvl-dove source package in Trusty:
Invalid
Status in linux-raspi2 source package in Trusty:
Invalid
Status in linux-ti-omap4 source package in Trusty:
Invalid
Status in linux-lts-backport-maverick source package in Utopic:
Won't Fix
Status in linux-lts-backport-natty source package in Utopic:
Won't Fix
Status in linux source package in Vivid:
Invalid
Status in linux-armadaxp source package in Vivid:
Invalid
Status in linux-ec2 source package in Vivid:
Invalid
Status in linux-flo source package in Vivid:
Invalid
Status in linux-fsl-imx51 source package in Vivid:
Invalid
Status in linux-goldfish source package in Vivid:
Invalid
Status in linux-lts-backport-maverick source package in Vivid:
Invalid
Status in linux-lts-backport-natty source package in Vivid:
Invalid
Status in linux-lts-quantal source package in Vivid:
Invalid
Status in linux-lts-raring source package in Vivid:
Invalid
Status in linux-lts-saucy source package in Vivid:
Invalid
Status in linux-lts-trusty source package in Vivid:
Invalid
Status in linux-lts-utopic source package in Vivid:
Invalid
Status in linux-lts-vivid source package in Vivid:
Invalid
Status in linux-lts-wily source package in Vivid:
Invalid
Status in linux-lts-xenial source package in Vivid:
New
Status in linux-mako source package in Vivid:
Invalid
Status in linux-manta source package in Vivid:
Invalid
Status in linux-mvl-dove source package in Vivid:
Invalid
Status in linux-raspi2 source package in Vivid:
Invalid
Status in linux-ti-omap4 source package in Vivid:
Invalid
Status in linux source package in Wily:
Invalid
Status in linux-armadaxp source package in Wily:
Invalid
Status in linux-ec2 source package in Wily:
Invalid
Status in linux-flo source package in Wily:
Invalid
Status in linux-fsl-imx51 source package in Wily:
Invalid
Status in linux-goldfish source package in Wily:
Invalid
Status in linux-lts-backport-maverick source package in Wily:
Invalid
Status in linux-lts-backport-natty source package in Wily:
Invalid
Status in linux-lts-quantal source package in Wily:
Invalid
Status in linux-lts-raring source package in Wily:
Invalid
Status in linux-lts-saucy source package in Wily:
Invalid
Status in linux-lts-trusty source package in Wily:
Invalid
Status in linux-lts-utopic source package in Wily:
Invalid
Status in linux-lts-vivid source package in Wily:
Invalid
Status in linux-lts-wily source package in Wily:
Invalid
Status in linux-lts-xenial source package in Wily:
Invalid
Status in linux-mako source package in Wily:
Invalid
Status in linux-manta source package in Wily:
Invalid
Status in linux-mvl-dove source package in Wily:
Invalid
Status in linux-raspi2 source package in Wily:
Invalid
Status in linux-ti-omap4 source package in Wily:
Invalid
Status in linux source package in Xenial:
Invalid
Status in linux-armadaxp source package in Xenial:
Invalid
Status in linux-ec2 source package in Xenial:
Invalid
Status in linux-flo source package in Xenial:
Invalid
Status in linux-fsl-imx51 source package in Xenial:
Invalid
Status in linux-goldfish source package in Xenial:
Invalid
Status in linux-lts-backport-maverick source package in Xenial:
Invalid
Status in linux-lts-backport-natty source package in Xenial:
Invalid
Status in linux-lts-quantal source package in Xenial:
Invalid
Status in linux-lts-raring source package in Xenial:
Invalid
Status in linux-lts-saucy source package in Xenial:
Invalid
Status in linux-lts-trusty source package in Xenial:
Invalid
Status in linux-lts-utopic source package in Xenial:
Invalid
Status in linux-lts-vivid source package in Xenial:
Invalid
Status in linux-lts-wily source package in Xenial:
Invalid
Status in linux-lts-xenial source package in Xenial:
Invalid
Status in linux-mako source package in Xenial:
Invalid
Status in linux-manta source package in Xenial:
Invalid
Status in linux-mvl-dove source package in Xenial:
Invalid
Status in linux-raspi2 source package in Xenial:
Fix Committed
Status in linux-ti-omap4 source package in Xenial:
Invalid
Bug description:
The raw_cmd_copyin function in drivers/block/floppy.c in the Linux
kernel through 3.14.3 does not properly handle error conditions during
processing of an FDRAWCMD ioctl call, which allows local users to
trigger kfree operations and gain privileges by leveraging write
access to a /dev/fd device. First, raw_cmd_ioctl calls raw_cmd_copyin.
This function kmallocs space for a floppy_raw_cmd structure and stores
the resulting allocation in the "rcmd" pointer argument. It then
attempts to copy_from_user the structure from userspace. If this
fails, an early EFAULT return is taken. The problem is that even if
the early return is taken, the pointer to the non-/partially-
initialized floppy_raw_cmd structure has already been returned via the
"rcmd" pointer. Back out in raw_cmd_ioctl, it attempts to raw_cmd_free
this pointer. raw_cmd_free attempts to free any DMA pages allocated
for the raw command, kfrees the raw command structure itself, and
follows the linked list, if any, of further raw commands (a user can
specify the FD_RAW_MORE flag to signal that there are more raw
commands to follow in a single FDRAWCMD ioctl). So, a malicious user
can send a FDRAWCMD ioctl with a raw command argument structure that
has some bytes inaccessible (ie. off the end of an allocated page).
The copy_from_user will fail but raw_cmd_free will attempt to process
the floppy_raw_cmd as if it had been fully initialized by the rest of
raw_cmd_copyin. The user can control the arguments passed to
fd_dma_mem_free and kfree (by making use of the linked-list feature
and specifying the target address as a next-in-list structure).
Break-Fix: - ef87dbe7614341c2e7bfe8d32fcb7028cc97442c
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1316729/+subscriptions
--
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help : https://help.launchpad.net/ListHelp
