Ubuntu
linux-goldfish package

CVE-2014-3647

Bug #1384545 reported by John Johansen on 2014-10-23

256

This bug affects 1 person

	Status	Importance	Assigned to
linux (Ubuntu)	Fix Released	High	Unassigned
Precise	Fix Released	High	Unassigned
Trusty	Fix Released	High	Unassigned
Vivid	Fix Released	High	Unassigned
Wily	Fix Released	High	Unassigned
Xenial	Fix Released	High	Unassigned
Yakkety	Fix Released	High	Unassigned
linux-armadaxp (Ubuntu)	Invalid	High	Unassigned
Precise	Fix Released	High	Unassigned
Trusty	Invalid	High	Unassigned
Vivid	Invalid	High	Unassigned
Wily	Invalid	High	Unassigned
Xenial	Invalid	High	Unassigned
Yakkety	Invalid	High	Unassigned
linux-ec2 (Ubuntu)	Invalid	High	Unassigned
Precise	Invalid	High	Unassigned
Trusty	Invalid	High	Unassigned
Vivid	Invalid	High	Unassigned
Wily	Invalid	High	Unassigned
Xenial	Invalid	High	Unassigned
Yakkety	Invalid	High	Unassigned
linux-flo (Ubuntu)	New	High	Unassigned
Precise	Invalid	High	Unassigned
Trusty	Invalid	High	Unassigned
Vivid	Won't Fix	High	Unassigned
Wily	New	High	Unassigned
Xenial	New	High	Unassigned
Yakkety	New	High	Unassigned
linux-fsl-imx51 (Ubuntu)	Invalid	High	Unassigned
Precise	Invalid	High	Unassigned
Trusty	Invalid	High	Unassigned
Vivid	Invalid	High	Unassigned
Wily	Invalid	High	Unassigned
Xenial	Invalid	High	Unassigned
Yakkety	Invalid	High	Unassigned
linux-goldfish (Ubuntu)	New	High	Unassigned
Precise	Invalid	High	Unassigned
Trusty	Invalid	High	Unassigned
Vivid	Won't Fix	High	Unassigned
Wily	New	High	Unassigned
Xenial	New	High	Unassigned
Yakkety	New	High	Unassigned
linux-lts-backport-maverick (Ubuntu)	Invalid	Undecided	Unassigned
Lucid	Invalid	Undecided	Unassigned
Precise	Invalid	Undecided	Unassigned
Trusty	Invalid	Undecided	Unassigned
Utopic	Invalid	Undecided	Unassigned
Vivid	Invalid	Undecided	Unassigned
Wily	Invalid	Undecided	Unassigned
Xenial	Invalid	Undecided	Unassigned
Yakkety	Invalid	Undecided	Unassigned
linux-lts-backport-natty (Ubuntu)	Invalid	Undecided	Unassigned
Lucid	Invalid	Undecided	Unassigned
Precise	Invalid	Undecided	Unassigned
Trusty	Invalid	Undecided	Unassigned
Utopic	Invalid	Undecided	Unassigned
Vivid	Invalid	Undecided	Unassigned
Wily	Invalid	Undecided	Unassigned
Xenial	Invalid	Undecided	Unassigned
Yakkety	Invalid	Undecided	Unassigned
linux-lts-quantal (Ubuntu)	Invalid	High	Unassigned
Precise	Won't Fix	High	Unassigned
Trusty	Invalid	High	Unassigned
Vivid	Invalid	High	Unassigned
Wily	Invalid	High	Unassigned
Xenial	Invalid	High	Unassigned
Yakkety	Invalid	High	Unassigned
linux-lts-raring (Ubuntu)	Invalid	High	Unassigned
Precise	Invalid	High	Unassigned
Trusty	Invalid	High	Unassigned
Vivid	Invalid	High	Unassigned
Wily	Invalid	High	Unassigned
Xenial	Invalid	High	Unassigned
Yakkety	Invalid	High	Unassigned
linux-lts-saucy (Ubuntu)	Invalid	High	Unassigned
Precise	Won't Fix	High	Unassigned
Trusty	Invalid	High	Unassigned
Vivid	Invalid	High	Unassigned
Wily	Invalid	High	Unassigned
Xenial	Invalid	High	Unassigned
Yakkety	Invalid	High	Unassigned
linux-lts-trusty (Ubuntu)	Invalid	High	Unassigned
Precise	Fix Released	High	Unassigned
Trusty	Invalid	High	Unassigned
Vivid	Invalid	High	Unassigned
Wily	Invalid	High	Unassigned
Xenial	Invalid	High	Unassigned
Yakkety	Invalid	High	Unassigned
linux-lts-utopic (Ubuntu)	Invalid	High	Unassigned
Precise	Invalid	High	Unassigned
Trusty	Fix Committed	High	Unassigned
Vivid	Invalid	High	Unassigned
Wily	Invalid	High	Unassigned
Xenial	Invalid	High	Unassigned
Yakkety	Invalid	High	Unassigned
linux-lts-vivid (Ubuntu)	Invalid	High	Unassigned
Precise	Invalid	High	Unassigned
Trusty	Fix Committed	High	Unassigned
Vivid	Invalid	High	Unassigned
Wily	Invalid	High	Unassigned
Xenial	Invalid	High	Unassigned
Yakkety	Invalid	High	Unassigned
linux-lts-wily (Ubuntu)	Invalid	High	Unassigned
Precise	Invalid	High	Unassigned
Trusty	Invalid	High	Unassigned
Vivid	Invalid	High	Unassigned
Wily	Invalid	High	Unassigned
Xenial	Invalid	High	Unassigned
Yakkety	Invalid	High	Unassigned
linux-lts-xenial (Ubuntu)	Invalid	High	Unassigned
Precise	Invalid	High	Unassigned
Trusty	Fix Committed	High	Unassigned
Vivid	New	Undecided	Unassigned
Wily	Invalid	High	Unassigned
Xenial	Invalid	High	Unassigned
Yakkety	Invalid	High	Unassigned
linux-mako (Ubuntu)	New	High	Unassigned
Precise	Invalid	High	Unassigned
Trusty	Invalid	High	Unassigned
Vivid	Won't Fix	High	Unassigned
Wily	New	High	Unassigned
Xenial	New	High	Unassigned
Yakkety	New	High	Unassigned
linux-manta (Ubuntu)	Invalid	High	Unassigned
Precise	Invalid	High	Unassigned
Trusty	Invalid	High	Unassigned
Vivid	Won't Fix	High	Unassigned
Wily	New	High	Unassigned
Xenial	Invalid	High	Unassigned
Yakkety	Invalid	High	Unassigned
linux-mvl-dove (Ubuntu)	Invalid	High	Unassigned
Precise	Invalid	High	Unassigned
Trusty	Invalid	High	Unassigned
Vivid	Invalid	High	Unassigned
Wily	Invalid	High	Unassigned
Xenial	Invalid	High	Unassigned
Yakkety	Invalid	High	Unassigned
linux-raspi2 (Ubuntu)	Fix Committed	High	Unassigned
Precise	Invalid	High	Unassigned
Trusty	Invalid	High	Unassigned
Vivid	Invalid	High	Unassigned
Wily	Invalid	High	Unassigned
Xenial	Fix Committed	High	Unassigned
Yakkety	Fix Committed	High	Unassigned
linux-snapdragon (Ubuntu)	Invalid	High	Unassigned
Precise	Invalid	High	Unassigned
Trusty	Invalid	High	Unassigned
Vivid	New	Undecided	Unassigned
Wily	Invalid	High	Unassigned
Xenial	Invalid	High	Unassigned
Yakkety	Invalid	High	Unassigned
linux-ti-omap4 (Ubuntu)	Invalid	High	Unassigned
Precise	Fix Released	High	Unassigned
Trusty	Invalid	High	Unassigned
Vivid	Invalid	High	Unassigned
Wily	Invalid	High	Unassigned
Xenial	Invalid	High	Unassigned
Yakkety	Invalid	High	Unassigned

Bug Description

arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 does not properly perform RIP changes, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application. A guest user with access to I/O or MMIO region can use this flaw to crash the guest.

Break-Fix: - 234f3ce485d54017f15cf5e0699cff4100121601
Break-Fix: - d1442d85cc30ea75f7d399474ca738e0bc96f715

See original description

Tags:

Related branches

lp://staging/ubuntu/precise-security/linux-lts-trusty

lp://staging/ubuntu/precise-proposed/linux-lts-trusty

lp://staging/ubuntu/trusty-proposed/linux-keystone

CVE References

Revision history for this message

John Johansen (jjohansen) wrote on 2014-10-23:

CVE-2014-3647

tags:	added: kernel-cve-tracking-bug
information type:	Public → Public Security
information type:	Public Security → Private Security

John Johansen (jjohansen) on 2014-10-27

Changed in linux-armadaxp (Ubuntu Lucid):
status:	New → Invalid
Changed in linux-armadaxp (Ubuntu Vivid):
status:	New → Invalid
Changed in linux-armadaxp (Ubuntu Trusty):
status:	New → Invalid
Changed in linux-ec2 (Ubuntu Precise):
status:	New → Invalid
Changed in linux-ec2 (Ubuntu Vivid):
status:	New → Invalid
Changed in linux-ec2 (Ubuntu Trusty):
status:	New → Invalid
Changed in linux-lts-quantal (Ubuntu Lucid):
status:	New → Invalid
Changed in linux-lts-quantal (Ubuntu Vivid):
status:	New → Invalid
Changed in linux-lts-quantal (Ubuntu Trusty):
status:	New → Invalid
Changed in linux-mvl-dove (Ubuntu Precise):
status:	New → Invalid
Changed in linux-mvl-dove (Ubuntu Vivid):
status:	New → Invalid
Changed in linux-mvl-dove (Ubuntu Trusty):
status:	New → Invalid
Changed in linux-lts-saucy (Ubuntu Lucid):
status:	New → Invalid
Changed in linux-lts-saucy (Ubuntu Vivid):
status:	New → Invalid
Changed in linux-lts-saucy (Ubuntu Trusty):
status:	New → Invalid
Changed in linux-ti-omap4 (Ubuntu Lucid):
status:	New → Invalid
Changed in linux-ti-omap4 (Ubuntu Vivid):
status:	New → Invalid
Changed in linux-ti-omap4 (Ubuntu Trusty):
status:	New → Invalid
Changed in linux-fsl-imx51 (Ubuntu Precise):
status:	New → Invalid
Changed in linux-fsl-imx51 (Ubuntu Vivid):
status:	New → Invalid
Changed in linux-fsl-imx51 (Ubuntu Trusty):
status:	New → Invalid
Changed in linux-lts-raring (Ubuntu Lucid):
status:	New → Invalid
Changed in linux-lts-raring (Ubuntu Vivid):
status:	New → Invalid
Changed in linux-lts-raring (Ubuntu Trusty):
status:	New → Invalid
description:	updated
Changed in linux-armadaxp (Ubuntu Precise):
importance:	Undecided → High
Changed in linux-armadaxp (Ubuntu Lucid):
importance:	Undecided → High
Changed in linux-armadaxp (Ubuntu Vivid):
importance:	Undecided → High
Changed in linux-armadaxp (Ubuntu Trusty):
importance:	Undecided → High
Changed in linux-ec2 (Ubuntu Precise):
importance:	Undecided → High
Changed in linux-ec2 (Ubuntu Lucid):
importance:	Undecided → High
Changed in linux-ec2 (Ubuntu Vivid):
importance:	Undecided → High
Changed in linux-ec2 (Ubuntu Trusty):
importance:	Undecided → High
Changed in linux-lts-quantal (Ubuntu Precise):
importance:	Undecided → High
Changed in linux-lts-quantal (Ubuntu Lucid):
importance:	Undecided → High
Changed in linux-lts-quantal (Ubuntu Vivid):
importance:	Undecided → High
Changed in linux-lts-quantal (Ubuntu Trusty):
importance:	Undecided → High
Changed in linux-mvl-dove (Ubuntu Precise):
importance:	Undecided → High
Changed in linux-mvl-dove (Ubuntu Lucid):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-mvl-dove (Ubuntu Vivid):
importance:	Undecided → High
Changed in linux-mvl-dove (Ubuntu Trusty):
importance:	Undecided → High
Changed in linux-lts-saucy (Ubuntu Precise):
importance:	Undecided → High
Changed in linux-lts-saucy (Ubuntu Lucid):
importance:	Undecided → High
Changed in linux-lts-saucy (Ubuntu Vivid):
importance:	Undecided → High
Changed in linux-lts-saucy (Ubuntu Trusty):
importance:	Undecided → High
Changed in linux (Ubuntu Precise):
importance:	Undecided → High
Changed in linux (Ubuntu Lucid):
importance:	Undecided → High
Changed in linux (Ubuntu Vivid):
importance:	Undecided → High
Changed in linux (Ubuntu Trusty):
importance:	Undecided → High
Changed in linux-ti-omap4 (Ubuntu Precise):
importance:	Undecided → High
Changed in linux-ti-omap4 (Ubuntu Lucid):
importance:	Undecided → High
Changed in linux-ti-omap4 (Ubuntu Vivid):
importance:	Undecided → High
Changed in linux-ti-omap4 (Ubuntu Trusty):
importance:	Undecided → High
Changed in linux-fsl-imx51 (Ubuntu Precise):
importance:	Undecided → High
Changed in linux-fsl-imx51 (Ubuntu Lucid):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-fsl-imx51 (Ubuntu Vivid):
importance:	Undecided → High
Changed in linux-fsl-imx51 (Ubuntu Trusty):
importance:	Undecided → High
Changed in linux-lts-raring (Ubuntu Precise):
importance:	Undecided → High
Changed in linux-lts-raring (Ubuntu Lucid):
importance:	Undecided → High
Changed in linux-lts-raring (Ubuntu Vivid):
importance:	Undecided → High
Changed in linux-lts-raring (Ubuntu Trusty):
importance:	Undecided → High

John Johansen (jjohansen) on 2014-10-27

Changed in linux-armadaxp (Ubuntu Utopic):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-ec2 (Ubuntu Utopic):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-lts-quantal (Ubuntu Utopic):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-mvl-dove (Ubuntu Utopic):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-lts-saucy (Ubuntu Utopic):
status:	New → Invalid
importance:	Undecided → High
Changed in linux (Ubuntu Utopic):
importance:	Undecided → High
Changed in linux-ti-omap4 (Ubuntu Utopic):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-fsl-imx51 (Ubuntu Utopic):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-lts-raring (Ubuntu Utopic):
status:	New → Invalid
importance:	Undecided → High

John Johansen (jjohansen) on 2014-10-28

information type:

Private Security → Public Security

Revision history for this message

Launchpad Janitor (janitor) wrote on 2014-10-29:

Download full text (10.4 KiB)

This bug was fixed in the package linux - 3.13.0-39.66

---------------
linux (3.13.0-39.66) trusty; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
- LP: #1386629

[ Upstream Kernel Changes ]

  * KVM: x86: Check non-canonical addresses upon WRMSR
    - LP: #1384539
    - CVE-2014-3610
  * KVM: x86: Prevent host from panicking on shared MSR writes.
    - LP: #1384539
    - CVE-2014-3610
  * KVM: x86: Improve thread safety in pit
    - LP: #1384540
    - CVE-2014-3611
  * KVM: x86: Fix wrong masking on relative jump/call
    - LP: #1384545
    - CVE-2014-3647
  * KVM: x86: Warn if guest virtual address space is not 48-bits
    - LP: #1384545
    - CVE-2014-3647
  * KVM: x86: Emulator fixes for eip canonical checks on near branches
    - LP: #1384545
    - CVE-2014-3647
  * KVM: x86: emulating descriptor load misses long-mode case
    - LP: #1384545
    - CVE-2014-3647
  * KVM: x86: Handle errors when RIP is set during far jumps
    - LP: #1384545
    - CVE-2014-3647
  * kvm: vmx: handle invvpid vm exit gracefully
    - LP: #1384544
    - CVE-2014-3646
  * Input: synaptics - gate forcepad support by DMI check
    - LP: #1381815

linux (3.13.0-38.65) trusty; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
- LP: #1379244

[ Andy Whitcroft ]

  * Revert "SAUCE: scsi: hyper-v storsvc switch up to SPC-3"
    - LP: #1354397
  * [Config] linux-image-extra is additive to linux-image
    - LP: #1375310
  * [Config] linux-image-extra postrm is not needed on purge
    - LP: #1375310

[ Upstream Kernel Changes ]

This bug was fixed in the package linux - 3.13.0-39.66

---------------
linux (3.13.0-39.66) trusty; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
    - LP: #1386629

[ Upstream Kernel Changes ]

linux (3.13.0-38.65) trusty; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
    - LP: #1379244

[ Andy Whitcroft ]

[ Upstream Kernel Changes ]

* Revert "KVM: x86: Increase the number of fixed MTRR regs to 10"
    - LP: #1377564
  * Revert "USB: option,zte_ev: move most ZTE CDMA devices to zte_ev"
    - LP: #1377564
  * aufs: bugfix, stop calling security_mmap_file() again
    - LP: #1371316
  * ipvs: fix ipv6 hook registration for local replies
    - LP: #1349768
  * Drivers: add blist flags
    - LP: #1354397
  * sd: fix a bug in deriving the FLUSH_TIMEOUT from the basic I/O timeout
    - LP: #1354397
  * drm/i915/bdw: Add 42ms delay for IPS disable
    - LP: #1374389
  * drm/i915: add null render states for gen6, gen7 and gen8
    - LP: #1374389
  * drm/i915/bdw: 3D_CHICKEN3 has write mask bits
    - LP: #1374389
  * drm/i915/bdw: Disable idle DOP clock gating
    - LP: #1374389
  * drm/i915: call lpt_init_clock_gating on BDW too
    - LP: #1374389
  * drm/i915: shuffle panel code
    - LP: #1374389
  * drm/i915: extract backlight minimum brightness from VBT
    - LP: #1374389
  * drm/i915: respect the VBT minimum backlight brightness
    - LP: #1374389
  * drm/i915/bdw: Apply workarounds in render ring init function
    - LP: #1374389
  * drm/i915/bdw: Cleanup pre prod workarounds
    - LP: #1374389
  * drm/i915: Replace hardcoded cacheline size with macro
    - LP: #1374389
  * drm/i915: Refactor Broadwell PIPE_CONTROL emission into a helper.
    - LP: #1374389
  * drm/i915: Add the WaCsStallBeforeStateCacheInvalidate:bdw workaround.
    - LP: #1374389
  * drm/i915/bdw: Remove BDW preproduction W/As until C stepping.
    - LP: #1374389
  * mptfusion: enable no_write_same for vmware scsi disks
    - LP: #1371591
  * iommu/amd: Fix cleanup_domain for mass device removal
    - LP: #1375266
  * cifs: mask off top byte in get_rfc1002_length()
    - LP: #1372482
  * Input: synaptics - add support for ForcePads
    - LP: #1377564
  * ASoC: pxa-ssp: drop SNDRV_PCM_FMTBIT_S24_LE
    - LP: #1377564
  * drm/radeon: add bapm module parameter
    - LP: #1377564
  * drm/radeon: Add missing lines to ci_set_thermal_temperature_range
    - LP: #1377564
  * drm/radeon: Add ability to get and change dpm state when radeon PX card
    is turned off
    - LP: #1377564
  * ALSA: hda/realtek - Avoid setting wrong COEF on ALC269 & co
    - LP: #1377564
  * of/irq: Fix lookup to use 'interrupts-extended' property first
    - LP: #1377564
  * Possible null ptr deref in SMB2_tcon
    - LP: #1377564
  * CIFS: Fix SMB2 readdir error handling
    - LP: #1377564
  * CIFS: Fix wrong directory attributes after rename
    - LP: #1377564
  * md/raid6: avoid data corruption during recovery of double-degraded
    RAID6
    - LP: #1377564
  * ARM: dts: i.MX53: fix apparent bug in VPU clks
    - LP: #1377564
  * pata_scc: propagate return value of scc_wait_after_reset
    - LP: #1377564
  * libata: widen Crucial M550 blacklist matching
    - LP: #1377564
  * ALSA: hda - restore the gpio led after resume
    - LP: #1358116, #1377564
  * md/raid10: fix memory leak when reshaping a RAID10.
    - LP: #1377564
  * md/raid10: Fix memory leak when raid10 reshape completes.
    - LP: #1377564
  * MIPS: OCTEON: make get_system_type() thread-safe
    - LP: #1377564
  * can: c_can: checking IS_ERR() instead of NULL
    - LP: #1377564
  * HID: logitech: perform bounds checking on device_id early enough
    - LP: #1377564
  * firmware: Do not use WARN_ON(!spin_is_locked())
    - LP: #1377564
  * drm/radeon: add new KV pci id
    - LP: #1377564
  * drm/radeon: add new bonaire pci ids
    - LP: #1377564
  * drm/radeon: add additional SI pci ids
    - LP: #1377564
  * ibmveth: Fix endian issues with rx_no_buffer statistic
    - LP: #1377564
  * spi/omap-mcspi: Fix the spi task hangs waiting dma_rx
    - LP: #1377564
  * xtensa: replace IOCTL code definitions with constants
    - LP: #1377564
  * xtensa: fix address checks in dma_{alloc,free}_coherent
    - LP: #1377564
  * xtensa: fix access to THREAD_RA/THREAD_SP/THREAD_DS
    - LP: #1377564
  * xtensa: fix TLBTEMP_BASE_2 region handling in fast_second_level_miss
    - LP: #1377564
  * xtensa: fix a6 and a7 handling in fast_syscall_xtensa
    - LP: #1377564
  * staging: lustre: Remove circular dependency on header
    - LP: #1377564
  * USB: option: reduce interrupt-urb logging verbosity
    - LP: #1377564
  * USB: option: add VIA Telecom CDS7 chipset device id
    - LP: #1377564
  * USB: zte_ev: remove duplicate Gobi PID
    - LP: #1377564
  * USB: zte_ev: remove duplicate Qualcom PID
    - LP: #1377564
  * USB: ftdi_sio: add Basic Micro ATOM Nano USB2Serial PID
    - LP: #1377564
  * USB: serial: pl2303: add device id for ztek device
    - LP: #1377564
  * USB: ftdi_sio: Added PID for new ekey device
    - LP: #1377564
  * xhci: Treat not finding the event_seg on COMP_STOP the same as
    COMP_STOP_INVAL
    - LP: #1377564
  * usb: xhci: amd chipset also needs short TX quirk
    - LP: #1377564
  * xhci: rework cycle bit checking for new dequeue pointers
    - LP: #1377564
  * spi/pxa2xx: Add ACPI ID for Intel Braswell
    - LP: #1377564
  * ALSA: core: fix buffer overflow in snd_info_get_line()
    - LP: #1377564
  * HID: logitech-dj: prevent false errors to be shown
    - LP: #1377564
  * usb: ehci: using wIndex + 1 for hub port
    - LP: #1377564
  * staging/rtl8188eu: add 0df6:0076 Sitecom Europe B.V.
    - LP: #1377564
  * staging: r8188eu: Add new USB ID
    - LP: #1377564
  * mtd: nand: omap: Fix 1-bit Hamming code scheme, omap_calculate_ecc()
    - LP: #1377564
  * trace: Fix epoll hang when we race with new entries
    - LP: #1377564
  * cfq-iosched: Fix wrong children_weight calculation
    - LP: #1377564
  * USB: sisusb: add device id for Magic Control USB video
    - LP: #1377564
  * NFSv4: Fix problems with close in the presence of a delegation
    - LP: #1377564
  * usb: hub: Prevent hub autosuspend if usbcore.autosuspend is -1
    - LP: #1377564
  * ARM: 8128/1: abort: don't clear the exclusive monitors
    - LP: #1377564
  * ARM: 8129/1: errata: work around Cortex-A15 erratum 830321 using dummy
    strex
    - LP: #1377564
  * USB: serial: fix potential stack buffer overflow
    - LP: #1377564
  * USB: serial: fix potential heap buffer overflow
    - LP: #1377564
  * ext4: update i_disksize coherently with block allocation on error path
    - LP: #1377564
  * jbd2: fix infinite loop when recovering corrupt journal blocks
    - LP: #1377564
  * jbd2: fix descriptor block size handling errors with journal_csum
    - LP: #1377564
  * memblock, memhotplug: fix wrong type in memblock_find_in_range_node().
    - LP: #1377564
  * xattr: fix check for simultaneous glibc header inclusion
    - LP: #1377564
  * KVM: s390: Fix user triggerable bug in dead code
    - LP: #1377564
  * KVM: s390/mm: try a cow on read only pages for key ops
    - LP: #1377564
  * regmap: Fix regcache debugfs initialization
    - LP: #1377564
  * regmap: Fix handling of volatile registers for format_write() chips
    - LP: #1377564
  * ASoC: rt5640: Do not allow regmap to use bulk read-write operations
    - LP: #1377564
  * drm/i915: Remove bogus __init annotation from DMI callbacks
    - LP: #1377564
  * hwmon: (ds1621) Update zbits after conversion rate change
    - LP: #1377564
  * arm64: ptrace: fix compat hardware watchpoint reporting
    - LP: #1377564
  * ARM/ARM64: KVM: Nuke Hyp-mode tlbs before enabling MMU
    - LP: #1377564
  * arm/arm64: KVM: Complete WFI/WFE instructions
    - LP: #1377564
  * get rid of propagate_umount() mistakenly treating slaves as busy.
    - LP: #1377564
  * fix EBUSY on umount() from MNT_SHRINKABLE
    - LP: #1377564
  * regmap: Don't attempt block writes when syncing cache on single_rw
    devices
    - LP: #1377564
  * drm/vmwgfx: Fix a potential infinite spin waiting for fifo idle
    - LP: #1377564
  * ALSA: hda - Fix digital mic on Acer Aspire 3830TG
    - LP: #1377564
  * xfs: don't dirty buffers beyond EOF
    - LP: #1377564
  * xfs: don't zero partial page cache pages during O_DIRECT writes
    - LP: #1377564
  * xfs: don't zero partial page cache pages during O_DIRECT writes
    - LP: #1377564
  * ALSA: hda - Fix COEF setups for ALC1150 codec
    - LP: #1377564
  * i2c: rcar: fix MNR interrupt handling
    - LP: #1377564
  * i2c: mv64xxx: continue probe when clock-frequency is missing
    - LP: #1377564
  * i2c: at91: Fix a race condition during signal handling in
    at91_do_twi_xfer.
    - LP: #1377564
  * i2c: at91: add bound checking on SMBus block length bytes
    - LP: #1377564
  * aio: add missing smp_rmb() in read_events_ring
    - LP: #1377564
  * KEYS: Fix use-after-free in assoc_array_gc()
    - LP: #1377564
  * ACPI / cpuidle: fix deadlock between cpuidle_lock and cpu_hotplug.lock
    - LP: #1377564
  * USB: fix build error with CONFIG_PM_RUNTIME disabled
    - LP: #1377564
  * Linux 3.13.11.8
    - LP: #1377564
  * powerpc: Fix kdump hang issue on p8 with relocation on exception
    enabled.
    - LP: #1352056
  * net-gre-gro: Fix a bug that breaks the forwarding path
    - LP: #1377851
 -- Luis Henriques <luis.henriques@canonical.com>   Tue, 28 Oct 2014 10:29:51 +0000

Changed in linux (Ubuntu Trusty):
status:	New → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2014-10-29:

This bug was fixed in the package linux - 3.16.0-24.32

---------------
linux (3.16.0-24.32) utopic; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
- LP: #1386635

[ Upstream Kernel Changes ]

  * KVM: x86: Check non-canonical addresses upon WRMSR
    - LP: #1384539
    - CVE-2014-3610
  * KVM: x86: Prevent host from panicking on shared MSR writes.
    - LP: #1384539
    - CVE-2014-3610
  * KVM: x86: Improve thread safety in pit
    - LP: #1384540
    - CVE-2014-3611
  * KVM: x86: Fix wrong masking on relative jump/call
    - LP: #1384545
    - CVE-2014-3647
  * KVM: x86: Warn if guest virtual address space is not 48-bits
    - LP: #1384545
    - CVE-2014-3647
  * KVM: x86: Emulator fixes for eip canonical checks on near branches
    - LP: #1384545
    - CVE-2014-3647
  * KVM: x86: emulating descriptor load misses long-mode case
    - LP: #1384545
    - CVE-2014-3647
  * KVM: x86: Handle errors when RIP is set during far jumps
    - LP: #1384545
    - CVE-2014-3647
  * kvm: vmx: handle invvpid vm exit gracefully
    - LP: #1384544
    - CVE-2014-3646
-- Luis Henriques <email address hidden> Tue, 28 Oct 2014 10:40:55 +0000

Changed in linux (Ubuntu Utopic):
status:	New → Fix Released

Andy Whitcroft (apw) on 2014-10-29

Changed in linux-lts-backport-maverick (Ubuntu Lucid):
status:	New → Invalid
Changed in linux-lts-backport-maverick (Ubuntu Trusty):
status:	New → Invalid
Changed in linux-lts-backport-natty (Ubuntu):
status:	New → Invalid
Changed in linux-lts-backport-natty (Ubuntu Lucid):
status:	New → Invalid
Changed in linux-lts-backport-natty (Ubuntu Trusty):
status:	New → Invalid
Changed in linux-lts-backport-maverick (Ubuntu):
status:	New → Invalid
Changed in linux-lts-backport-maverick (Ubuntu Precise):
status:	New → Invalid
Changed in linux-lts-backport-natty (Ubuntu Precise):
status:	New → Invalid
Changed in linux-lts-backport-maverick (Ubuntu Utopic):
status:	New → Invalid
Changed in linux-lts-backport-natty (Ubuntu Utopic):
status:	New → Invalid

Revision history for this message

Launchpad Janitor (janitor) wrote on 2014-10-30:

This bug was fixed in the package linux - 3.16.0-24.32

---------------
linux (3.16.0-24.32) utopic; urgency=low

[ Luis Henriques ]

* Release Tracking Bug
- LP: #1386635

[ Upstream Kernel Changes ]

  * KVM: x86: Check non-canonical addresses upon WRMSR
    - LP: #1384539
    - CVE-2014-3610
  * KVM: x86: Prevent host from panicking on shared MSR writes.
    - LP: #1384539
    - CVE-2014-3610
  * KVM: x86: Improve thread safety in pit
    - LP: #1384540
    - CVE-2014-3611
  * KVM: x86: Fix wrong masking on relative jump/call
    - LP: #1384545
    - CVE-2014-3647
  * KVM: x86: Warn if guest virtual address space is not 48-bits
    - LP: #1384545
    - CVE-2014-3647
  * KVM: x86: Emulator fixes for eip canonical checks on near branches
    - LP: #1384545
    - CVE-2014-3647
  * KVM: x86: emulating descriptor load misses long-mode case
    - LP: #1384545
    - CVE-2014-3647
  * KVM: x86: Handle errors when RIP is set during far jumps
    - LP: #1384545
    - CVE-2014-3647
  * kvm: vmx: handle invvpid vm exit gracefully
    - LP: #1384544
    - CVE-2014-3646
-- Luis Henriques <email address hidden> Tue, 28 Oct 2014 10:40:55 +0000

Changed in linux (Ubuntu Vivid):
status:	New → Fix Released

John Johansen (jjohansen) on 2014-10-30

Changed in linux-lts-raring (Ubuntu Precise):
status:	New → Invalid

John Johansen (jjohansen) on 2014-11-12

Changed in linux-lts-quantal (Ubuntu Precise):
status:	New → Fix Committed
Changed in linux-lts-saucy (Ubuntu Precise):
status:	New → Fix Committed
Changed in linux (Ubuntu Precise):
status:	New → Fix Committed
description:	updated

John Johansen (jjohansen) on 2014-11-14

Changed in linux-armadaxp (Ubuntu Precise):
status:	New → Fix Committed
Changed in linux-ti-omap4 (Ubuntu Precise):
status:	New → Fix Committed

John Johansen (jjohansen) on 2014-12-02

Changed in linux-armadaxp (Ubuntu Precise):
status:	Fix Committed → Fix Released
Changed in linux (Ubuntu Precise):
status:	Fix Committed → Fix Released
Changed in linux-ti-omap4 (Ubuntu Precise):
status:	Fix Committed → Fix Released

John Johansen (jjohansen) on 2014-12-08

Changed in linux-lts-trusty (Ubuntu Precise):
status:	New → Fix Released
importance:	Undecided → High
Changed in linux-lts-trusty (Ubuntu Trusty):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-lts-trusty (Ubuntu Lucid):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-lts-trusty (Ubuntu Vivid):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-lts-trusty (Ubuntu Utopic):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-lts-utopic (Ubuntu Precise):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-lts-utopic (Ubuntu Trusty):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-lts-utopic (Ubuntu Lucid):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-lts-utopic (Ubuntu Vivid):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-lts-utopic (Ubuntu Utopic):
status:	New → Invalid
importance:	Undecided → High

John Johansen (jjohansen) on 2015-01-28

Changed in linux-flo (Ubuntu Precise):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-flo (Ubuntu Trusty):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-flo (Ubuntu Lucid):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-flo (Ubuntu Vivid):
importance:	Undecided → High
Changed in linux-flo (Ubuntu Utopic):
importance:	Undecided → High
Changed in linux-goldfish (Ubuntu Precise):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-goldfish (Ubuntu Trusty):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-goldfish (Ubuntu Lucid):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-goldfish (Ubuntu Vivid):
importance:	Undecided → High
Changed in linux-goldfish (Ubuntu Utopic):
importance:	Undecided → High
Changed in linux-mako (Ubuntu Precise):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-mako (Ubuntu Trusty):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-mako (Ubuntu Lucid):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-mako (Ubuntu Vivid):
importance:	Undecided → High
Changed in linux-mako (Ubuntu Utopic):
importance:	Undecided → High
Changed in linux-manta (Ubuntu Precise):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-manta (Ubuntu Trusty):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-manta (Ubuntu Lucid):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-manta (Ubuntu Vivid):
importance:	Undecided → High
Changed in linux-manta (Ubuntu Utopic):
importance:	Undecided → High

John Johansen (jjohansen) on 2015-05-04

no longer affects:	linux-lts-trusty (Ubuntu Lucid)
no longer affects:	linux-armadaxp (Ubuntu Lucid)
no longer affects:	linux-ec2 (Ubuntu Lucid)
no longer affects:	linux-goldfish (Ubuntu Lucid)
no longer affects:	linux-lts-saucy (Ubuntu Lucid)
no longer affects:	linux-lts-quantal (Ubuntu Lucid)
no longer affects:	linux-mvl-dove (Ubuntu Lucid)
no longer affects:	linux-ti-omap4 (Ubuntu Lucid)
no longer affects:	linux (Ubuntu Lucid)
no longer affects:	linux-mako (Ubuntu Lucid)
no longer affects:	linux-fsl-imx51 (Ubuntu Lucid)
no longer affects:	linux-lts-utopic (Ubuntu Lucid)
no longer affects:	linux-flo (Ubuntu Lucid)
no longer affects:	linux-lts-raring (Ubuntu Lucid)
no longer affects:	linux-manta (Ubuntu Lucid)

John Johansen (jjohansen) on 2015-05-08

Changed in linux-lts-vivid (Ubuntu Precise):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-lts-vivid (Ubuntu Vivid):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-lts-vivid (Ubuntu Wily):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-lts-vivid (Ubuntu Utopic):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-lts-vivid (Ubuntu Trusty):
status:	New → Fix Committed
importance:	Undecided → High

Andy Whitcroft (apw) on 2015-05-21

Changed in linux-lts-utopic (Ubuntu Trusty):
status:	Invalid → Fix Committed

John Johansen (jjohansen) on 2015-07-28

no longer affects:	linux-lts-trusty (Ubuntu Utopic)
no longer affects:	linux-armadaxp (Ubuntu Utopic)
no longer affects:	linux-ec2 (Ubuntu Utopic)
no longer affects:	linux-goldfish (Ubuntu Utopic)
no longer affects:	linux-lts-saucy (Ubuntu Utopic)
no longer affects:	linux-lts-quantal (Ubuntu Utopic)
no longer affects:	linux-mvl-dove (Ubuntu Utopic)
no longer affects:	linux-ti-omap4 (Ubuntu Utopic)
no longer affects:	linux-lts-vivid (Ubuntu Utopic)
no longer affects:	linux (Ubuntu Utopic)
no longer affects:	linux-mako (Ubuntu Utopic)
no longer affects:	linux-fsl-imx51 (Ubuntu Utopic)
no longer affects:	linux-lts-utopic (Ubuntu Utopic)
no longer affects:	linux-flo (Ubuntu Utopic)
no longer affects:	linux-lts-raring (Ubuntu Utopic)
no longer affects:	linux-manta (Ubuntu Utopic)

Steve Beattie (sbeattie) on 2015-11-10

Changed in linux-lts-wily (Ubuntu Precise):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-lts-wily (Ubuntu Wily):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-lts-wily (Ubuntu Xenial):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-lts-wily (Ubuntu Trusty):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-lts-wily (Ubuntu Vivid):
status:	New → Invalid
importance:	Undecided → High

Steve Beattie (sbeattie) on 2015-11-16

Changed in linux-raspi2 (Ubuntu Precise):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-raspi2 (Ubuntu Wily):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-raspi2 (Ubuntu Xenial):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-raspi2 (Ubuntu Trusty):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-raspi2 (Ubuntu Vivid):
status:	New → Invalid
importance:	Undecided → High

Steve Beattie (sbeattie) on 2015-12-03

Changed in linux-raspi2 (Ubuntu Xenial):
status:	Invalid → Fix Committed

Steve Beattie (sbeattie) on 2016-02-10

Changed in linux-lts-xenial (Ubuntu Precise):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-lts-xenial (Ubuntu Wily):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-lts-xenial (Ubuntu Xenial):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-lts-xenial (Ubuntu Trusty):
status:	New → Fix Committed
importance:	Undecided → High

Steve Beattie (sbeattie) on 2016-04-19

Changed in linux-manta (Ubuntu Xenial):
status:	New → Invalid

Steve Beattie (sbeattie) on 2016-05-05

Changed in linux-snapdragon (Ubuntu Precise):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-snapdragon (Ubuntu Wily):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-snapdragon (Ubuntu Xenial):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-snapdragon (Ubuntu Yakkety):
status:	New → Invalid
importance:	Undecided → High
Changed in linux-snapdragon (Ubuntu Trusty):
status:	New → Invalid
importance:	Undecided → High

Revision history for this message

Andy Whitcroft (apw) wrote on 2017-10-17: Closing unsupported series nomination.

This bug was nominated against a series that is no longer supported, ie vivid. The bug task representing the vivid nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux-flo (Ubuntu Vivid):
status:	New → Won't Fix

Andy Whitcroft (apw) on 2017-10-17

Changed in linux-goldfish (Ubuntu Vivid):
status:	New → Won't Fix

Andy Whitcroft (apw) on 2017-10-17

Changed in linux-mako (Ubuntu Vivid):
status:	New → Won't Fix

Andy Whitcroft (apw) on 2017-10-17

Changed in linux-manta (Ubuntu Vivid):
status:	New → Won't Fix

Revision history for this message

Steve Langasek (vorlon) wrote on 2021-10-14:

The Precise Pangolin has reached end of life, so this bug will not be fixed for that release

Changed in linux-lts-saucy (Ubuntu Precise):
status:	Fix Committed → Won't Fix
Changed in linux-lts-quantal (Ubuntu Precise):
status:	Fix Committed → Won't Fix

Report a bug

This report contains Public Security information

Everyone can see this security related information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntulinux-goldfish package

CVE-2014-3647

Bug Description

Related branches

CVE References

Other bug subscribers

Remote bug watches

Ubuntu
linux-goldfish package