CVE-2010-4160

Bug Description

Multiple integer overflows in the (1) pppol2tp_sendmsg function in
net/l2tp/l2tp_ppp.c, and the (2) l2tp_ip_sendmsg function in
net/l2tp/l2tp_ip.c, in the PPPoL2TP and IPoL2TP implementations in the
Linux kernel before 2.6.36.2 allow local users to cause a denial of service
(heap memory corruption and panic) or possibly gain privileges via a
crafted sendto call.

This is fixed by the following two commits:

commit 8acfe468b0384e834a303f08ebc4953d72fb690a
Author: David S. Miller <email address hidden>
Date: Thu Oct 28 11:41:55 2010 -0700

net: Limit socket I/O iovec total length to INT_MAX.

This helps protect us from overflow issues down in the
individual protocol sendmsg/recvmsg handlers. Once
we hit INT_MAX we truncate out the rest of the iovec
by setting the iov_len members to zero.

This works because:

1) For SOCK_STREAM and SOCK_SEQPACKET sockets, partial
writes are allowed and the application will just continue
with another write to send the rest of the data.

2) For datagram oriented sockets, where there must be a
one-to-one correspondance between write() calls and
packets on the wire, INT_MAX is going to be far larger
than the packet size limit the protocol is going to
check for and signal with -EMSGSIZE.

Based upon a patch by Linus Torvalds.

Signed-off-by: David S. Miller <email address hidden>

commit 253eacc070b114c2ec1f81b067d2fed7305467b0
Author: Linus Torvalds <email address hidden>
Date: Sat Oct 30 16:43:10 2010 -0700

net: Truncate recvfrom and sendto length to INT_MAX.

Signed-off-by: Linus Torvalds <email address hidden>
Signed-off-by: David S. Miller <email address hidden>

Both of these commits were in v2.6.37-rc1 therefore Natty is not affected.

Both of these commits were in upstream stable 2.6.35.10 and which is already released into Maverick. Fix Released.

Both of these commits were in upstream stable 2.6.32.27 and which is already released into Lucid. Fix Released.

The fixes here are actually the same fixes required under CVE-2010-3859 therefore moved this committed to match that bug, and linked CVE and bugs to this one also.

This bug was fixed in the package linux - 2.6.24-28.86

---------------
linux (2.6.24-28.86) hardy-proposed; urgency=low

[ Brad Figg ]

* Release Tracking Bug
- LP: #716166

[Tim Gardner]

* xen unified block-device I/O interface back end can orphan devices,
CVE-2010-3699
- LP: #708019
- CVE-2010-3699

[Upstream Kernel Changes]

* Hardy SRU: thinkpad-acpi: lock down video output state access,
CVE-2010-3448
- LP: #706999
- CVE-2010-3448
* net: Limit socket I/O iovec total length to INT_MAX., CVE-2010-3859
- LP: #711855, #708839
- CVE-2010-4160
* net: Truncate recvfrom and sendto length to INT_MAX., CVE-2010-3859
- LP: #711855, #708839
- CVE-2010-4160
* net: ax25: fix information leak to userland, CVE-2010-3875
- LP: #710714
- CVE-2010-3875
* net: ax25: fix information leak to userland harder, CVE-2010-3875
- LP: #710714
- CVE-2010-3875
* memory corruption in X.25 facilities parsing, CVE-2010-3873
- LP: #709372
- CVE-2010-3873
* net: packet: fix information leak to userland, CVE-2010-3876
- LP: #710714
- CVE-2010-3876
* net: tipc: fix information leak to userland, CVE-2010-3877
- LP: #711291
- CVE-2010-3877
* KVM: VMX: fix vmx null pointer dereference on debug register access,
CVE-2010-0435
- LP: #712615
- CVE-2010-0435
* gdth: integer overflow in ioctl, CVE-2010-4157
- LP: #711797
- CVE-2010-4157
* posix-cpu-timers: workaround to suppress the problems with mt exec,
CVE-2010-4248
- LP: #712609
- CVE-2010-4248
* ALSA: sound/pci/rme9652: prevent reading uninitialized stack memory,
CVE-2010-4080, CVE-2010-4081
- LP: #712723, #712737
- CVE-2010-4081
* sys_semctl: fix kernel stack leakage, CVE-2010-4083
- LP: #712749
- CVE-2010-4083
* inet_diag: Make sure we actually run the same bytecode we audited,
CVE-2010-3880
- LP: #711865
- CVE-2010-3880

linux (2.6.24-28.85) hardy-proposed; urgency=low

[ Brad Figg ]

* Tracking Bug
- LP: #708315

[Upstream Kernel Changes]

* ata_piix: IDE mode SATA patch for Intel ICH10 DeviceID's
- LP: #693401
* USB: serial/mos*: prevent reading uninitialized stack memory,
CVE-2010-4074
- LP: #706149
- CVE-2010-4074
* KVM: Fix fs/gs reload oops with invalid ldt
- LP: #707000
- CVE-2010-3698
* drivers/video/sis/sis_main.c: prevent reading uninitialized stack
memory, CVE-2010-4078
- LP: #707579
- CVE-2010-4078
* V4L/DVB: ivtvfb: prevent reading uninitialized stack memory,
CVE-2010-4079
- LP: #707649
- CVE-2010-4079

linux (2.6.24-28.84) hardy-proposed; urgency=low

[ Steve Conklin ]

* Tracking Bug
- LP: #698185

linux (2.6.24-28.83) hardy-proposed; urgency=low

[ Steve Conklin ]
* tracking bug moved from here to latest entry

linux (2.6.24-28.82) hardy-proposed; urgency=low

[ Leann Ogasawara ]

* Revert "SAUCE: AF_ECONET saddr->cookie prevent NULL pointer
dereference"
* Revert "SAUCE: AF_ECONET SIOCSIFADDR ioctl does not check privileges"
* Revert "SAUCE: AF_ECONET prevent kernel stack overflow"

[Upstream Kernel Changes]

* xfs: validate untrust...

This bug was fixed in the package linux - 2.6.31-22.73

---------------
linux (2.6.31-22.73) karmic-proposed; urgency=low

[ Steve Conklin ]

* Release Tracking Bug
- LP: #716648

[ Upstream Kernel Changes ]

* copied ABI directory
* net: Limit socket I/O iovec total length to INT_MAX., CVE-2010-3859
- LP: #708839, #711855
- CVE-2010-4160
* net: Truncate recvfrom and sendto length to INT_MAX., CVE-2010-3859
- LP: #708839, #711855
- CVE-2010-4160
* net: fix rds_iovec page count overflow, CVE-2010-3865
- LP: #709153
- CVE-2010-3865
* net: ax25: fix information leak to userland, CVE-2010-3875
- LP: #710714
- CVE-2010-3875
* net: ax25: fix information leak to userland harder, CVE-2010-3875
- LP: #710714
- CVE-2010-3875
* can-bcm: fix minor heap overflow
- LP: #710680
- CVE-2010-3874
* memory corruption in X.25 facilities parsing, CVE-2010-3873
- LP: #709372
- CVE-2010-3873
* net: packet: fix information leak to userland, CVE-2010-3876
- LP: #710714
- CVE-2010-3876
* net: tipc: fix information leak to userland, CVE-2010-3877
- LP: #711291
- CVE-2010-3877
* KVM: VMX: fix vmx null pointer dereference on debug register access,
CVE-2010-0435
- LP: #712615
- CVE-2010-0435
* gdth: integer overflow in ioctl, CVE-2010-4157
- LP: #711797
- CVE-2010-4157
* posix-cpu-timers: workaround to suppress the problems with mt exec,
CVE-2010-4248
- LP: #712609
- CVE-2010-4248
* ALSA: sound/pci/rme9652: prevent reading uninitialized stack memory,
CVE-2010-4080, CVE-2010-4081
- LP: #712723, #712737
- CVE-2010-4081
* drivers/video/via/ioctl.c: prevent reading uninitialized stack memory,
CVE-2010-4082
- LP: #712744
- CVE-2010-4082
* sys_semctl: fix kernel stack leakage, CVE-2010-4083
- LP: #712749
- CVE-2010-4083
* inet_diag: Make sure we actually run the same bytecode we audited,
CVE-2010-3880
- LP: #711865
- CVE-2010-3880

linux (2.6.31-22.72) karmic-proposed; urgency=low

[ Brad Figg ]

* Tracking Bug
- LP: #708860

[ Upstream Kernel Changes ]

* Karmic SRU: thinkpad-acpi: lock down video output state access, CVE-2010-3448
- LP: #706999
- CVE-2010-3448
* USB: serial/mos*: prevent reading uninitialized stack memory,
CVE-2010-4074
- LP: #706149
- CVE-2010-4074
* KVM: Fix fs/gs reload oops with invalid ldt
- LP: #707000
- CVE-2010-3698
* drivers/video/sis/sis_main.c: prevent reading uninitialized stack
memory, CVE-2010-4078
- LP: #707579
- CVE-2010-4078
* V4L/DVB: ivtvfb: prevent reading uninitialized stack memory,
CVE-2010-4079
- LP: #707649
- CVE-2010-4079

linux (2.6.31-22.71) karmic-proposed; urgency=low

[ Brad Figg ]

- LP: #698214

[ Upstream Kernel Changes ]

* ipc: initialize structure memory to zero for compat functions
* tcp: Increase TCP_MAXSEG socket option minimum.
- CVE-2010-4165
* perf_events: Fix perf_counter_mmap() hook in mprotect()
- CVE-2010-4169
* af_unix: limit unix_tot_inflight
- CVE-2010-4249
-- Steve Conklin <email address hidden> 2011年2月10日 13:49:49...

karmic is EOL

lucid has seen the end of its life and is no longer receiving any updates. Marking the lucid task for this ticket as "Won't Fix".