CVE-2012-2100

Bug Description

The ext4_fill_flex_info function in fs/ext4/super.c in the Linux kernel before 3.2.2, on the x86 platform and unspecified other platforms, allows user-assisted remote attackers to trigger inconsistent filesystem-groups data and possibly cause a denial of service via a malformed ext4 filesystem containing a super block with a large FLEX_BG group size (aka s_log_groups_per_flex value). NOTE: this vulnerability exists because of an incomplete fix for CVE-2009-4307.

Break-Fix: 503358ae01b70ce6909d19dd01287093f6b6271c d50f2ab6f050311dbf7b8f5501b25f0bf64a439b

CVE-2012-2100

This bug was fixed in the package linux - 2.6.38-15.59

---------------
linux (2.6.38-15.59) natty-proposed; urgency=low

[Luis Henriques]

* Release Tracking Bug
- LP: #987281

[ Brad Figg ]

* SAUCE (no-up) Provide a param for allowing the BIOS to handle changing
the brightness on AC/battery status changes.
- LP: #949311

[ Tim Gardner ]

* SAUCE: ubuntu drivers: use UMH_WAIT_PROC consistently
- LP: #963685
* SAUCE: disable_nx should not be in __cpuinitdata section for X86_32
- LP: #968233
* SAUCE: (no-up) remove __initdata from vesafb_fix
- LP: #969309

[ Upstream Kernel Changes ]

* usermodehelper: use UMH_WAIT_PROC consistently
- LP: #963685
* usermodehelper: introduce umh_complete(sub_info)
- LP: #963685
* usermodehelper: implement UMH_KILLABLE
- LP: #963685
* usermodehelper: kill umh_wait, renumber UMH_* constants
- LP: #963685
* usermodehelper: ____call_usermodehelper() doesn't need do_exit()
- LP: #963685
* kmod: introduce call_modprobe() helper
- LP: #963685
* kmod: make __request_module() killable
- LP: #963685
* drm/i915: Fixes distorted external screen image on HP 2730p
- LP: #796030
* ext4: fix undefined behavior in ext4_fill_flex_info()
- LP: #984757
- CVE-2012-2100
* jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer
- LP: #929781
- CVE-2011-4086
* cifs: fix dentry refcount leak when opening a FIFO on lookup
- LP: #947997
- CVE-2012-1090
-- Luis Henriques <email address hidden> 2012年4月23日 14:02:53 +0100

This bug was fixed in the package linux-lts-backport-natty - 2.6.38-15.59~lucid1

---------------
linux-lts-backport-natty (2.6.38-15.59~lucid1) lucid-proposed; urgency=low

[Luis Henriques]

* Release Tracking Bug
- LP: #990208

[ Brad Figg ]

* SAUCE (no-up) Provide a param for allowing the BIOS to handle changing
the brightness on AC/battery status changes.
- LP: #949311

[ Tim Gardner ]

* SAUCE: ubuntu drivers: use UMH_WAIT_PROC consistently
- LP: #963685
* SAUCE: disable_nx should not be in __cpuinitdata section for X86_32
- LP: #968233
* SAUCE: (no-up) remove __initdata from vesafb_fix
- LP: #969309

[ Upstream Kernel Changes ]

* usermodehelper: use UMH_WAIT_PROC consistently
- LP: #963685
* usermodehelper: introduce umh_complete(sub_info)
- LP: #963685
* usermodehelper: implement UMH_KILLABLE
- LP: #963685
* usermodehelper: kill umh_wait, renumber UMH_* constants
- LP: #963685
* usermodehelper: ____call_usermodehelper() doesn't need do_exit()
- LP: #963685
* kmod: introduce call_modprobe() helper
- LP: #963685
* kmod: make __request_module() killable
- LP: #963685
* drm/i915: Fixes distorted external screen image on HP 2730p
- LP: #796030
* ext4: fix undefined behavior in ext4_fill_flex_info()
- LP: #984757
- CVE-2012-2100
* jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer
- LP: #929781
- CVE-2011-4086
* cifs: fix dentry refcount leak when opening a FIFO on lookup
- LP: #947997
- CVE-2012-1090
-- Luis Henriques <email address hidden> 2012年4月30日 09:52:55 +0100

This bug was fixed in the package linux-ti-omap4 - 2.6.38-1209.24

---------------
linux-ti-omap4 (2.6.38-1209.24) natty-proposed; urgency=low

* Release Tracking Bug
- LP: #990206

[ Upstream Kernel Changes ]

* ext4: fix undefined behavior in ext4_fill_flex_info()
- LP: #984757
- CVE-2012-2100
* jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer
- LP: #929781
- CVE-2011-4086
* cifs: fix dentry refcount leak when opening a FIFO on lookup
- LP: #947997
- CVE-2012-1090
-- Paolo Pisati <email address hidden> 2012年4月30日 10:12:35 +0200

Patch 503358ae01b70ce6909d19dd01287093f6b6271c d50f2ab6f050311dbf7b8f5501b25f0bf64a439b already in upstream 3.5

03358ae01b70ce6909d19dd01287093f6b6271c ext4: avoid divide by zero when trying to mount a corrupted file system in upstream 2.6.32-rc8
e2860111eaf589699ff399191dd13b5d3409ef2b ext4: fix undefined behavior in ext4_fill_flex_info() is in linux-armadaxp through 3.2.2 and Ubuntu-3.2.0-12.20

This bug was nominated against a series that is no longer supported, ie vivid. The bug task representing the vivid nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

The Precise Pangolin has reached end of life, so this bug will not be fixed for that release

The task "linux-lts-saucy (Ubuntu)" has expired because it has had no new comments or updates for more than three years.

If this issue is still present in an Ubuntu LTS kernel still under active support, please reopen the bug and provide updated details. If this issue was reported against an Ubuntu kernel no longer under active support but the issue still exists in a currently supported Ubuntu kernel, please open a new bug against that kernel version and provide the updated details, with a reference link to the original bug.

This action was performed by an automated process maintained by the Ubuntu Kernel Team.

The task "linux-lts-saucy (Ubuntu Trusty)" has expired because it has had no new comments or updates for more than three years.

If this issue is still present in an Ubuntu LTS kernel still under active support, please reopen the bug and provide updated details. If this issue was reported against an Ubuntu kernel no longer under active support but the issue still exists in a currently supported Ubuntu kernel, please open a new bug against that kernel version and provide the updated details, with a reference link to the original bug.

This action was performed by an automated process maintained by the Ubuntu Kernel Team.

The task "linux-lts-saucy (Ubuntu Wily)" has been closed automatically because it was filed against an Ubuntu release that is now end-of-life.

If this issue is still present in a supported Ubuntu kernel, please open a new bug and provide updated details.

This action was performed by an automated process maintained by the Ubuntu Kernel Team.

The task "linux-lts-saucy (Ubuntu Xenial)" has expired because it has had no new comments or updates for more than three years.

If this issue is still present in an Ubuntu LTS kernel still under active support, please reopen the bug and provide updated details. If this issue was reported against an Ubuntu kernel no longer under active support but the issue still exists in a currently supported Ubuntu kernel, please open a new bug against that kernel version and provide the updated details, with a reference link to the original bug.

This action was performed by an automated process maintained by the Ubuntu Kernel Team.