Bug #1741556 “linux: 4.13.0-23.27 -proposed tracker” : Bugs : linux package : Ubuntu

Kleber Sacilotto de Souza (kleber-souza) on 2018-01-05

tags:	added: kernel-release-tracking-bug
tags:	added: kernel-release-tracking-bug-live
tags:	added: artful
Changed in kernel-sru-workflow:
status:	New → In Progress
importance:	Undecided → Medium
Changed in linux (Ubuntu):
status:	New → Invalid
tags:	added: kernel-sru-cycle-2017.11.20-4
tags:	added: kernel-sru-master-kernel

Kleber Sacilotto de Souza (kleber-souza) on 2018-01-05

description:

updated

Andy Whitcroft (apw) on 2018-01-06

Changed in linux (Ubuntu Artful):
status:	New → Confirmed

Kleber Sacilotto de Souza (kleber-souza) on 2018-01-06

summary:

- linux: <version to be filled> -proposed tracker
+ linux: 4.13.0-23.65 -proposed tracker

Kleber Sacilotto de Souza (kleber-souza) on 2018-01-06

summary:	- linux: 4.13.0-23.65 -proposed tracker + linux: <version to be filled> -proposed tracker
summary:	- linux: <version to be filled> -proposed tracker + linux: 4.13.0-23.26 -proposed tracker

Marcelo Cerri (mhcerri) on 2018-01-06

summary:

- linux: 4.13.0-23.26 -proposed tracker
+ linux: 4.13.0-23.27 -proposed tracker

Brad Figg (brad-figg) on 2018-01-07

description:	updated
description:	updated

Revision history for this message

Launchpad Janitor (janitor) wrote on 2018-01-09:

#1

Download full text (14.0 KiB)

This bug was fixed in the package linux - 4.13.0-25.29

---------------
linux (4.13.0-25.29) artful; urgency=low

* linux: 4.13.0-25.29 -proposed tracker (LP: #1741955)

  * CVE-2017-5754
    - Revert "UBUNTU: [Config] updateconfigs to enable PTI"
    - [Config] Enable PTI with UNWINDER_FRAME_POINTER

linux (4.13.0-24.28) artful; urgency=low

* linux: 4.13.0-24.28 -proposed tracker (LP: #1741745)

* CVE-2017-5754
- x86/cpu, x86/pti: Do not enable PTI on AMD processors

linux (4.13.0-23.27) artful; urgency=low

* linux: 4.13.0-23.27 -proposed tracker (LP: #1741556)

  [ Kleber Sacilotto de Souza ]
  * CVE-2017-5754
    - x86/mm: Add the 'nopcid' boot option to turn off PCID
    - x86/mm: Enable CR4.PCIDE on supported systems
    - x86/mm: Document how CR4.PCIDE restore works
    - x86/entry/64: Refactor IRQ stacks and make them NMI-safe
    - x86/entry/64: Initialize the top of the IRQ stack before switching stacks
    - x86/entry/64: Add unwind hint annotations
    - xen/x86: Remove SME feature in PV guests
    - x86/xen/64: Rearrange the SYSCALL entries
    - irq: Make the irqentry text section unconditional
    - x86/xen/64: Fix the reported SS and CS in SYSCALL
    - x86/paravirt/xen: Remove xen_patch()
    - x86/traps: Simplify pagefault tracing logic
    - x86/idt: Unify gate_struct handling for 32/64-bit kernels
    - x86/asm: Replace access to desc_struct:a/b fields
    - x86/xen: Get rid of paravirt op adjust_exception_frame
    - x86/paravirt: Remove no longer used paravirt functions
    - x86/entry: Fix idtentry unwind hint
    - x86/mm/64: Initialize CR4.PCIDE early
    - objtool: Add ORC unwind table generation
    - objtool, x86: Add facility for asm code to provide unwind hints
    - x86/unwind: Add the ORC unwinder
    - x86/kconfig: Consolidate unwinders into multiple choice selection
    - objtool: Upgrade libelf-devel warning to error for CONFIG_ORC_UNWINDER
    - x86/ldt/64: Refresh DS and ES when modify_ldt changes an entry
    - x86/mm: Give each mm TLB flush generation a unique ID
    - x86/mm: Track the TLB's tlb_gen and update the flushing algorithm
    - x86/mm: Rework lazy TLB mode and TLB freshness tracking
    - x86/mm: Implement PCID based optimization: try to preserve old TLB entries
      using PCID
    - x86/mm: Factor out CR3-building code
    - x86/mm/64: Stop using CR3.PCID == 0 in ASID-aware code
    - x86/mm: Flush more aggressively in lazy TLB mode
    - Revert "x86/mm: Stop calling leave_mm() in idle code"
    - kprobes/x86: Set up frame pointer in kprobe trampoline
    - x86/tracing: Introduce a static key for exception tracing
    - x86/boot: Add early cmdline parsing for options with arguments
    - mm, x86/mm: Fix performance regression in get_user_pages_fast()
    - x86/asm: Remove unnecessary \n\t in front of CC_SET() from asm templates
    - objtool: Don't report end of section error after an empty unwind hint
    - x86/head: Remove confusing comment
    - x86/head: Remove unused 'bad_address' code
    - x86/head: Fix head ELF function annotations
    - x86/boot: Annotate verify_cpu() as a callable function
    - x86/xen: Fix xen head ELF annotations
    - x86/xen: Add unwind hint anno...

This bug was fixed in the package linux - 4.13.0-25.29

---------------
linux (4.13.0-25.29) artful; urgency=low

* linux: 4.13.0-25.29 -proposed tracker (LP: #1741955)

* CVE-2017-5754
    - Revert "UBUNTU: [Config] updateconfigs to enable PTI"
    - [Config] Enable PTI with UNWINDER_FRAME_POINTER

linux (4.13.0-24.28) artful; urgency=low

* linux: 4.13.0-24.28 -proposed tracker (LP: #1741745)

* CVE-2017-5754
    - x86/cpu, x86/pti: Do not enable PTI on AMD processors

linux (4.13.0-23.27) artful; urgency=low

* linux: 4.13.0-23.27 -proposed tracker (LP: #1741556)

[ Kleber Sacilotto de Souza ]
  * CVE-2017-5754
    - x86/mm: Add the 'nopcid' boot option to turn off PCID
    - x86/mm: Enable CR4.PCIDE on supported systems
    - x86/mm: Document how CR4.PCIDE restore works
    - x86/entry/64: Refactor IRQ stacks and make them NMI-safe
    - x86/entry/64: Initialize the top of the IRQ stack before switching stacks
    - x86/entry/64: Add unwind hint annotations
    - xen/x86: Remove SME feature in PV guests
    - x86/xen/64: Rearrange the SYSCALL entries
    - irq: Make the irqentry text section unconditional
    - x86/xen/64: Fix the reported SS and CS in SYSCALL
    - x86/paravirt/xen: Remove xen_patch()
    - x86/traps: Simplify pagefault tracing logic
    - x86/idt: Unify gate_struct handling for 32/64-bit kernels
    - x86/asm: Replace access to desc_struct:a/b fields
    - x86/xen: Get rid of paravirt op adjust_exception_frame
    - x86/paravirt: Remove no longer used paravirt functions
    - x86/entry: Fix idtentry unwind hint
    - x86/mm/64: Initialize CR4.PCIDE early
    - objtool: Add ORC unwind table generation
    - objtool, x86: Add facility for asm code to provide unwind hints
    - x86/unwind: Add the ORC unwinder
    - x86/kconfig: Consolidate unwinders into multiple choice selection
    - objtool: Upgrade libelf-devel warning to error for CONFIG_ORC_UNWINDER
    - x86/ldt/64: Refresh DS and ES when modify_ldt changes an entry
    - x86/mm: Give each mm TLB flush generation a unique ID
    - x86/mm: Track the TLB's tlb_gen and update the flushing algorithm
    - x86/mm: Rework lazy TLB mode and TLB freshness tracking
    - x86/mm: Implement PCID based optimization: try to preserve old TLB entries
      using PCID
    - x86/mm: Factor out CR3-building code
    - x86/mm/64: Stop using CR3.PCID == 0 in ASID-aware code
    - x86/mm: Flush more aggressively in lazy TLB mode
    - Revert "x86/mm: Stop calling leave_mm() in idle code"
    - kprobes/x86: Set up frame pointer in kprobe trampoline
    - x86/tracing: Introduce a static key for exception tracing
    - x86/boot: Add early cmdline parsing for options with arguments
    - mm, x86/mm: Fix performance regression in get_user_pages_fast()
    - x86/asm: Remove unnecessary \n\t in front of CC_SET() from asm templates
    - objtool: Don't report end of section error after an empty unwind hint
    - x86/head: Remove confusing comment
    - x86/head: Remove unused 'bad_address' code
    - x86/head: Fix head ELF function annotations
    - x86/boot: Annotate verify_cpu() as a callable function
    - x86/xen: Fix xen head ELF annotations
    - x86/xen: Add unwind hint annotations
    - x86/head: Add unwind hint annotations
    - ACPI / APEI: adjust a local variable type in ghes_ioremap_pfn_irq()
    - x86/unwinder: Make CONFIG_UNWINDER_ORC=y the default in the 64-bit defconfig
    - x86/fpu/debug: Remove unused 'x86_fpu_state' and 'x86_fpu_deactivate_state'
      tracepoints
    - x86/unwind: Rename unwinder config options to 'CONFIG_UNWINDER_*'
    - x86/unwind: Make CONFIG_UNWINDER_ORC=y the default in kconfig for 64-bit
    - bitops: Add clear/set_bit32() to linux/bitops.h
    - x86/cpuid: Add generic table for CPUID dependencies
    - x86/fpu: Parse clearcpuid= as early XSAVE argument
    - x86/fpu: Make XSAVE check the base CPUID features before enabling
    - x86/fpu: Remove the explicit clearing of XSAVE dependent features
    - x86/platform/UV: Convert timers to use timer_setup()
    - objtool: Print top level commands on incorrect usage
    - x86/cpuid: Prevent out of bound access in do_clear_cpu_cap()
    - x86/entry: Use SYSCALL_DEFINE() macros for sys_modify_ldt()
    - mm/sparsemem: Allocate mem_section at runtime for CONFIG_SPARSEMEM_EXTREME=y
    - x86/kasan: Use the same shadow offset for 4- and 5-level paging
    - x86/xen: Provide pre-built page tables only for CONFIG_XEN_PV=y and
      CONFIG_XEN_PVH=y
    - x86/xen: Drop 5-level paging support code from the XEN_PV code
    - ACPI / APEI: remove the unused dead-code for SEA/NMI notification type
    - x86/asm: Don't use the confusing '.ifeq' directive
    - x86/build: Beautify build log of syscall headers
    - x86/mm/64: Rename the register_page_bootmem_memmap() 'size' parameter to
      'nr_pages'
    - x86/cpufeatures: Enable new SSE/AVX/AVX512 CPU features
    - x86/mm: Relocate page fault error codes to traps.h
    - x86/boot: Relocate definition of the initial state of CR0
    - ptrace,x86: Make user_64bit_mode() available to 32-bit builds
    - x86/entry/64: Remove the restore_c_regs_and_iret label
    - x86/entry/64: Split the IRET-to-user and IRET-to-kernel paths
    - x86/entry/64: Move SWAPGS into the common IRET-to-usermode path
    - x86/entry/64: Simplify reg restore code in the standard IRET paths
    - x86/entry/64: Shrink paranoid_exit_restore and make labels local
    - x86/entry/64: Use pop instead of movq in syscall_return_via_sysret
    - x86/entry/64: Merge the fast and slow SYSRET paths
    - x86/entry/64: Use POP instead of MOV to restore regs on NMI return
    - x86/entry/64: Remove the RESTORE_..._REGS infrastructure
    - xen, x86/entry/64: Add xen NMI trap entry
    - x86/entry/64: De-Xen-ify our NMI code
    - x86/entry/32: Pull the MSR_IA32_SYSENTER_CS update code out of
      native_load_sp0()
    - x86/entry/64: Pass SP0 directly to load_sp0()
    - x86/entry: Add task_top_of_stack() to find the top of a task's stack
    - x86/xen/64, x86/entry/64: Clean up SP code in cpu_initialize_context()
    - x86/entry/64: Stop initializing TSS.sp0 at boot
    - x86/entry/64: Remove all remaining direct thread_struct::sp0 reads
    - x86/entry/32: Fix cpu_current_top_of_stack initialization at boot
    - x86/entry/64: Remove thread_struct::sp0
    - x86/traps: Use a new on_thread_stack() helper to clean up an assertion
    - x86/entry/64: Shorten TEST instructions
    - x86/cpuid: Replace set/clear_bit32()
    - bitops: Revert cbe96375025e ("bitops: Add clear/set_bit32() to
      linux/bitops.h")
    - x86/mm: Define _PAGE_TABLE using _KERNPG_TABLE
    - x86/cpufeatures: Re-tabulate the X86_FEATURE definitions
    - x86/cpufeatures: Fix various details in the feature definitions
    - selftests/x86/protection_keys: Fix syscall NR redefinition warnings
    - selftests/x86/ldt_gdt: Robustify against set_thread_area() and LAR oddities
    - selftests/x86/ldt_gdt: Add infrastructure to test set_thread_area()
    - selftests/x86/ldt_gdt: Run most existing LDT test cases against the GDT as
      well
    - selftests/x86/ldt_get: Add a few additional tests for limits
    - ACPI / APEI: Replace ioremap_page_range() with fixmap
    - x86/virt, x86/platform: Merge 'struct x86_hyper' into 'struct x86_platform'
      and 'struct x86_init'
    - x86/virt: Add enum for hypervisors to replace x86_hyper
    - drivers/misc/intel/pti: Rename the header file to free up the namespace
    - x86/cpufeature: Add User-Mode Instruction Prevention definitions
    - x86: Make X86_BUG_FXSAVE_LEAK detectable in CPUID on AMD
    - perf/x86: Enable free running PEBS for REGS_USER/INTR
    - bpf: fix build issues on um due to mising bpf_perf_event.h
    - locking/barriers: Add implicit smp_read_barrier_depends() to READ_ONCE()
    - locking/barriers: Convert users of lockless_dereference() to READ_ONCE()
    - x86/mm/kasan: Don't use vmemmap_populate() to initialize shadow
    - mm/sparsemem: Fix ARM64 boot crash when CONFIG_SPARSEMEM_EXTREME=y
    - objtool: Move synced files to their original relative locations
    - objtool: Move kernel headers/code sync check to a script
    - objtool: Fix cross-build
    - tools/headers: Sync objtool UAPI header
    - objtool: Fix 64-bit build on 32-bit host
    - x86/decoder: Fix and update the opcodes map
    - x86/decoder: Add new TEST instruction pattern
    - x86/insn-eval: Add utility functions to get segment selector
    - x86/entry/64/paravirt: Use paravirt-safe macro to access eflags
    - x86/unwinder/orc: Dont bail on stack overflow
    - x86/unwinder: Handle stack overflows more gracefully
    - x86/irq: Remove an old outdated comment about context tracking races
    - x86/irq/64: Print the offending IP in the stack overflow warning
    - x86/entry/64: Allocate and enable the SYSENTER stack
    - x86/dumpstack: Add get_stack_info() support for the SYSENTER stack
    - x86/entry/gdt: Put per-CPU GDT remaps in ascending order
    - x86/mm/fixmap: Generalize the GDT fixmap mechanism, introduce struct
      cpu_entry_area
    - x86/kasan/64: Teach KASAN about the cpu_entry_area
    - x86/entry: Fix assumptions that the HW TSS is at the beginning of cpu_tss
    - x86/dumpstack: Handle stack overflow on all stacks
    - x86/entry: Move SYSENTER_stack to the beginning of struct tss_struct
    - x86/entry: Remap the TSS into the CPU entry area
    - x86/entry/64: Separate cpu_current_top_of_stack from TSS.sp0
    - x86/espfix/64: Stop assuming that pt_regs is on the entry stack
    - x86/entry/64: Use a per-CPU trampoline stack for IDT entries
    - x86/entry/64: Return to userspace from the trampoline stack
    - x86/entry/64: Create a per-CPU SYSCALL entry trampoline
    - x86/entry/64: Move the IST stacks into struct cpu_entry_area
    - x86/entry/64: Remove the SYSENTER stack canary
    - x86/entry: Clean up the SYSENTER_stack code
    - x86/entry/64: Make cpu_entry_area.tss read-only
    - x86/paravirt: Dont patch flush_tlb_single
    - x86/paravirt: Provide a way to check for hypervisors
    - x86/cpufeatures: Make CPU bugs sticky
    - x86/Kconfig: Limit NR_CPUS on 32-bit to a sane amount
    - x86/mm/dump_pagetables: Check PAGE_PRESENT for real
    - x86/mm/dump_pagetables: Make the address hints correct and readable
    - x86/vsyscall/64: Explicitly set _PAGE_USER in the pagetable hierarchy
    - x86/vsyscall/64: Warn and fail vsyscall emulation in NATIVE mode
    - arch, mm: Allow arch_dup_mmap() to fail
    - x86/ldt: Rework locking
    - x86/ldt: Prevent LDT inheritance on exec
    - x86/mm/64: Improve the memory map documentation
    - x86/doc: Remove obvious weirdnesses from the x86 MM layout documentation
    - x86/entry: Rename SYSENTER_stack to CPU_ENTRY_AREA_entry_stack
    - x86/uv: Use the right TLB-flush API
    - x86/microcode: Dont abuse the TLB-flush interface
    - x86/mm: Use __flush_tlb_one() for kernel memory
    - x86/mm: Remove superfluous barriers
    - x86/mm: Add comments to clarify which TLB-flush functions are supposed to
      flush what
    - x86/mm: Move the CR3 construction functions to tlbflush.h
    - x86/mm: Remove hard-coded ASID limit checks
    - x86/mm: Put MMU to hardware ASID translation in one place
    - x86/mm: Create asm/invpcid.h
    - x86/cpu_entry_area: Move it to a separate unit
    - x86/cpu_entry_area: Move it out of the fixmap
    - init: Invoke init_espfix_bsp() from mm_init()
    - x86/cpu_entry_area: Prevent wraparound in setup_cpu_entry_area_ptes() on
      32bit
    - x86/cpufeatures: Add X86_BUG_CPU_INSECURE
    - x86/mm/pti: Disable global pages if PAGE_TABLE_ISOLATION=y
    - x86/mm/pti: Prepare the x86/entry assembly code for entry/exit CR3 switching
    - x86/mm/pti: Add infrastructure for page table isolation
    - x86/pti: Add the pti= cmdline option and documentation
    - x86/mm/pti: Add mapping helper functions
    - x86/mm/pti: Allow NX poison to be set in p4d/pgd
    - x86/mm/pti: Allocate a separate user PGD
    - x86/mm/pti: Populate user PGD
    - x86/mm/pti: Add functions to clone kernel PMDs
    - x86/mm/pti: Force entry through trampoline when PTI active
    - x86/mm/pti: Share cpu_entry_area with user space page tables
    - x86/entry: Align entry text section to PMD boundary
    - x86/mm/pti: Share entry text PMD
    - x86/mm/pti: Map ESPFIX into user space
    - x86/cpu_entry_area: Add debugstore entries to cpu_entry_area
    - x86/events/intel/ds: Map debug buffers in cpu_entry_area
    - x86/mm/64: Make a full PGD-entry size hole in the memory map
    - x86/pti: Put the LDT in its own PGD if PTI is on
    - x86/pti: Map the vsyscall page if needed
    - x86/mm: Allow flushing for future ASID switches
    - x86/mm: Abstract switching CR3
    - x86/mm: Use/Fix PCID to optimize user/kernel switches
    - x86/mm: Optimize RESTORE_CR3
    - x86/mm: Use INVPCID for __native_flush_tlb_single()
    - x86/mm: Clarify the whole ASID/kernel PCID/user PCID naming
    - x86/dumpstack: Indicate in Oops whether PTI is configured and enabled
    - x86/mm/pti: Add Kconfig
    - x86/mm/dump_pagetables: Add page table directory to the debugfs VFS
      hierarchy
    - x86/mm/dump_pagetables: Check user space page table for WX pages
    - x86/mm/dump_pagetables: Allow dumping current pagetables
    - x86/ldt: Make the LDT mapping RO
    - x86/smpboot: Remove stale TLB flush invocations
    - x86/mm: Remove preempt_disable/enable() from __native_flush_tlb()
    - x86/ldt: Plug memory leak in error path
    - x86/ldt: Make LDT pgtable free conditional
    - [Config] updateconfigs to enable PTI
    - kvm: x86: fix RSM when PCID is non-zero
    - x86/pti: Switch to kernel CR3 at early in entry_SYSCALL_compat()
    - SAUCE: only attempt to use PCID in 64 bit builds
    - SAUCE: BODGE: temporarily disable some kprobe trace points which are
      cratering
    - s390/mm: use generic mm_hooks
    - objtool: use sh to invoke sync-check.sh in the Makefile

* CVE-2017-17862
    - bpf: fix branch pruning logic

* CVE-2017-17864
    - SAUCE: bpf/verifier: Fix states_equal() comparison of pointer and UNKNOWN

* CVE-2017-16995
    - bpf: fix incorrect sign extension in check_alu_op()

* CVE-2017-17863
    - SAUCE: bpf: reject out-of-bounds stack pointer calculation

-- Marcelo Henrique Cerri <marcelo.cerri@canonical.com>  Mon, 08 Jan 2018 17:13:57 -0200

Changed in linux (Ubuntu Artful):
status:	Confirmed → Fix Released
status:	Confirmed → Fix Released

Launchpad Janitor (janitor) on 2018-01-10

Changed in linux (Ubuntu):
status:	Invalid → Fix Released

Andy Whitcroft (apw) on 2022-06-06

tags:	removed: kernel-release-tracking-bug-live
Changed in kernel-sru-workflow:
status:	In Progress → Fix Released

Ubuntu
linux package

linux: 4.13.0-23.27 -proposed tracker

Bug Description

CVE References

Other bug subscribers

Remote bug watches

	Status	Importance	Assigned to
Kernel SRU Workflow	Fix Released	Medium	Unassigned
Automated-testing	New	Medium	Canonical Kernel Team
Certification-testing	New	Medium	Canonical Hardware Certification
Prepare-package	Fix Released	Medium	Marcelo Cerri
Prepare-package-meta	Fix Released	Medium	Kleber Sacilotto de Souza
Prepare-package-signed	Fix Released	Medium	Kleber Sacilotto de Souza
Promote-to-proposed	New	Medium	Ubuntu Stable Release Updates Team
Promote-to-security	New	Medium	Ubuntu Stable Release Updates Team
Promote-to-updates	New	Medium	Ubuntu Stable Release Updates Team
Regression-testing	New	Medium	Canonical Kernel Team
Security-signoff	New	Medium	Canonical Security Team
Upload-to-ppa	Invalid	Medium	Unassigned
Verification-testing	New	Medium	Canonical Kernel Team
linux (Ubuntu)	Fix Released	Undecided	Unassigned
Artful	Fix Released	Undecided	Unassigned

Ubuntulinux package