Ubuntu
linux-source-2.6.15 package

compiled without -fno-delete-null-pointer-checks

Jaunty (9.04)
Bug #403647

Bug #403647 reported by Kees Cook on 2009-07-23

258

This bug affects 1 person

	Status	Importance	Assigned to
linux (Ubuntu)	Fix Released	Medium	Stefan Bader
Dapper	Invalid	Undecided	Unassigned
Hardy	Fix Released	Medium	Stefan Bader
Intrepid	Fix Released	Medium	Stefan Bader
Jaunty	Fix Released	Medium	Stefan Bader
Karmic	Fix Released	Medium	Stefan Bader
linux-source-2.6.15 (Ubuntu)	Invalid	Undecided	Unassigned
Dapper	Fix Released	Medium	Stefan Bader
Hardy	Invalid	Undecided	Unassigned
Intrepid	Invalid	Undecided	Unassigned
Jaunty	Invalid	Undecided	Unassigned
Karmic	Invalid	Undecided	Unassigned

Bug Description

Please backport the following patch for the released kernels, to avoid potentially hidden NULL deref bugs which might be leveraged into security vulnerabilities:

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=a3ca86aea507904148870946d599e07a340b39bf

ProblemType: Bug
Architecture: amd64
Date: Thu Jul 23 10:45:53 2009
DistroRelease: Ubuntu 9.10
HibernationDevice: RESUME=/dev/md1
Package: linux-image-2.6.31-3-generic 2.6.31-3.19
ProcCmdLine: BOOT_IMAGE=/vmlinuz-2.6.31-3-generic root=/dev/mapper/systemvg-root2lv ro splash security=apparmor
ProcEnviron:
PATH=(custom, user)
LANG=en_US.UTF-8
SHELL=/bin/bash
ProcVersionSignature: Ubuntu 2.6.31-3.19-generic
RelatedPackageVersions: linux-backports-modules-2.6.31-3-generic N/A
SourcePackage: linux
Uname: Linux 2.6.31-3-generic x86_64
dmi.bios.date: 09/22/2008
dmi.bios.vendor: Intel Corp.
dmi.bios.version: JOQ3510J.86A.0954.2008.0922.2331
dmi.board.asset.tag: Base Board Asset Tag
dmi.board.name: DQ35JO
dmi.board.vendor: Intel Corporation
dmi.board.version: AAD82085-800
dmi.chassis.type: 3
dmi.modalias: dmi:bvnIntelCorp.:bvrJOQ3510J.86A.0954.2008.0922.2331:bd09/22/2008:svn:pn:pvr:rvnIntelCorporation:rnDQ35JO:rvrAAD82085-800:cvn:ct3:cvr:

Tags:

Related branches

lp://staging/ubuntu/dapper-security/linux-source-2.6.15

lp://staging/ubuntu/dapper-updates/linux-source-2.6.15

CVE References

Revision history for this message

Kees Cook (kees) wrote on 2009-07-23:

BootDmesg.txt Edit (59.7 KiB, text/plain; charset="utf-8")
CurrentDmesg.txt Edit (123.7 KiB, text/plain; charset="utf-8")
Dependencies.txt Edit (1.1 KiB, text/plain; charset="utf-8")
Lspci.txt Edit (16.2 KiB, text/plain; charset="utf-8")
Lsusb.txt Edit (659 bytes, text/plain; charset="utf-8")
ProcCpuinfo.txt Edit (2.9 KiB, text/plain; charset="utf-8")
ProcInterrupts.txt Edit (1.9 KiB, text/plain; charset="utf-8")
ProcModules.txt Edit (4.9 KiB, text/plain; charset="utf-8")
UdevDb.txt Edit (142.3 KiB, text/plain; charset="utf-8")
UdevLog.txt Edit (225.5 KiB, text/plain; charset="utf-8")

visibility:	private → public
Changed in linux (Ubuntu):
assignee:	nobody → Stefan Bader (stefan-bader-canonical)
importance:	Undecided → Medium
status:	New → Triaged
Changed in linux (Ubuntu Karmic):
status:	Triaged → Fix Released
Changed in linux (Ubuntu Jaunty):
status:	New → In Progress
status:	In Progress → Triaged
Changed in linux (Ubuntu Intrepid):
status:	New → Triaged
Changed in linux (Ubuntu Dapper):
status:	New → Triaged
importance:	Undecided → Medium
Changed in linux (Ubuntu Hardy):
importance:	Undecided → Medium
status:	New → Triaged
Changed in linux (Ubuntu Jaunty):
importance:	Undecided → Medium
Changed in linux (Ubuntu Intrepid):
importance:	Undecided → Medium
Changed in linux (Ubuntu Jaunty):
assignee:	nobody → Stefan Bader (stefan-bader-canonical)
Changed in linux (Ubuntu Intrepid):
assignee:	nobody → Stefan Bader (stefan-bader-canonical)
Changed in linux (Ubuntu Hardy):
assignee:	nobody → Stefan Bader (stefan-bader-canonical)
Changed in linux (Ubuntu Dapper):
assignee:	nobody → Stefan Bader (stefan-bader-canonical)

Revision history for this message

Launchpad Janitor (janitor) wrote on 2009-07-28:

This bug was fixed in the package linux - 2.6.24-24.57

---------------
linux (2.6.24-24.57) hardy-security; urgency=low

[Upstream Kernel Changes]

  * Add '-fno-delete-null-pointer-checks' to gcc CFLAGS
    - LP: #403647
  * personality: fix PER_CLEAR_ON_SETID
    - CVE-2009-1895
  * KVM: detect if VCPU triple faults
    - CVE-2009-2287
  * KVM: x86: check for cr3 validity in ioctl_set_sregs
    - CVE-2009-2287
  * r8169: fix crash when large packets are received
    - CVE-2009-1389
  * eCryptfs: Check Tag 11 literal data buffer size
    - CVE-2009-2406
  * eCryptfs: parse_tag_3_packet check tag 3 packet encrypted key size
    - CVE-2009-2407

-- Stefan Bader <email address hidden> Thu, 23 Jul 2009 15:37:05 +0200

Changed in linux (Ubuntu Hardy):
status:	Triaged → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2009-07-28:

This bug was fixed in the package linux - 2.6.27-14.37

---------------
linux (2.6.27-14.37) intrepid-security; urgency=low

[ Upstream Kernel Changes ]

  * Add '-fno-delete-null-pointer-checks' to gcc CFLAGS
    - LP: #403647
  * personality: fix PER_CLEAR_ON_SETID
    - CVE-2009-1895
  * KVM: x86: check for cr3 validity in ioctl_set_sregs
    - CVE-2009-2287
  * r8169: fix crash when large packets are received
    - CVE-2009-1389
  * eCryptfs: Check Tag 11 literal data buffer size
    - CVE-2009-2406
  * eCryptfs: parse_tag_3_packet check tag 3 packet encrypted key size
    - CVE-2009-2407

-- Stefan Bader <email address hidden> Thu, 23 Jul 2009 15:46:29 +0200

Changed in linux (Ubuntu Intrepid):
status:	Triaged → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2009-07-28:

This bug was fixed in the package linux - 2.6.28-14.47

---------------
linux (2.6.28-14.47) jaunty-security; urgency=low

[ Upstream Kernel Changes ]

-- Stefan Bader <email address hidden> Thu, 23 Jul 2009 15:49:09 +0200

Changed in linux (Ubuntu Jaunty):
status:	Triaged → Fix Released

Kees Cook (kees) on 2009-07-29

Changed in linux (Ubuntu Dapper):
status:	Triaged → Invalid
Changed in linux-source-2.6.15 (Ubuntu Hardy):
status:	New → Invalid
Changed in linux-source-2.6.15 (Ubuntu Intrepid):
status:	New → Invalid
Changed in linux-source-2.6.15 (Ubuntu Jaunty):
status:	New → Invalid
Changed in linux-source-2.6.15 (Ubuntu Karmic):
status:	New → Invalid
Changed in linux-source-2.6.15 (Ubuntu Dapper):
assignee:	nobody → Stefan Bader (stefan-bader-canonical)
importance:	Undecided → Medium
status:	New → Fix Released
Changed in linux (Ubuntu Dapper):
assignee:	Stefan Bader (stefan-bader-canonical) → nobody
importance:	Medium → Undecided

Report a bug

This report contains Public Security information

Everyone can see this security related information.

You are

Subscribing...

Edit bug mail

Other bug subscribers

Bug attachments

Add attachment

Remote bug watches

Bug watches keep track of this bug in other bug trackers.

Ubuntulinux-source-2.6.15 package

compiled without -fno-delete-null-pointer-checks

Bug Description

Related branches

CVE References

Other bug subscribers

Bug attachments

Remote bug watches

Ubuntu
linux-source-2.6.15 package