CVE-2012-2123

Bug Description

The cap_bprm_set_creds function in security/commoncap.c in the Linux kernel before 3.3.3 does not properly handle the use of file system capabilities (aka fcaps) for implementing a privileged executable file, which allows local users to bypass intended personality restrictions via a crafted application, as demonstrated by an attack that uses a parent process to disable ASLR.

Break-Fix: - d52fc5dde171f030170a6cb78034d166b13c9445

CVE-2012-2123

This bug was fixed in the package linux - 2.6.32-41.89

---------------
linux (2.6.32-41.89) lucid-proposed; urgency=low

[Herton R. Krzesinski]

* Release Tracking Bug
- LP: #990103

[ Tim Gardner ]

* SAUCE: (no-up) remove __initdata from vesafb_fix
- LP: #969309

[ Upstream Kernel Changes ]

* jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer
- LP: #929781
- CVE-2011-4086
* fcaps: clear the same personality flags as suid when fcaps are used
- LP: #987571
- CVE-2012-2123
* lucid security: fix compile error in commoncap.c
- LP: #987571
- CVE-2012-2123
* KVM: Clean up error handling during VCPU creation
- LP: #971685
- CVE-2012-1601
* KVM: Ensure all vcpus are consistent with in-kernel irqchip settings
- LP: #971685
- CVE-2012-1601
-- Herton Ronaldo Krzesinski <email address hidden> 2012年4月27日 17:59:10 -0300

This bug was fixed in the package linux-ec2 - 2.6.32-345.48

---------------
linux-ec2 (2.6.32-345.48) lucid-proposed; urgency=low

[ Stefan Bader ]

* Rebased to Ubuntu-2.6.32-41.89
* Release Tracking Bug
- LP: #991770

[ Ubuntu: 2.6.32-41.89 ]

* SAUCE: (no-up) remove __initdata from vesafb_fix
- LP: #969309
* jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer
- LP: #929781
- CVE-2011-4086
* fcaps: clear the same personality flags as suid when fcaps are used
- LP: #987571
- CVE-2012-2123
* lucid security: fix compile error in commoncap.c
- LP: #987571
- CVE-2012-2123
* KVM: Clean up error handling during VCPU creation
- LP: #971685
- CVE-2012-1601
* KVM: Ensure all vcpus are consistent with in-kernel irqchip settings
- LP: #971685
- CVE-2012-1601
-- Stefan Bader <email address hidden> 2012年5月02日 12:14:39 +0200

This bug was fixed in the package linux - 2.6.38-15.60

---------------
linux (2.6.38-15.60) natty-proposed; urgency=low

[Luis Henriques]

* Release Tracking Bug
- LP: #1002384

[ Andy Whitcroft ]

* [Config] control.stub is an intermediate product not a dependancy
- LP: #992414

[ Herton Ronaldo Krzesinski ]

* linux: add Build-Depends for libnewt-dev, to enable perf TUI support
- LP: #981717

[ Tim Gardner ]

* [Config] perarch and indep tools builds need separate build directories

[ Upstream Kernel Changes ]

* fcaps: clear the same personality flags as suid when fcaps are used
- LP: #987571
- CVE-2012-2123
* natty security: fix compile error in commoncap.c
- LP: #987571
- CVE-2012-2123
* KVM: Clean up error handling during VCPU creation
- LP: #971685
- CVE-2012-1601
* KVM: Ensure all vcpus are consistent with in-kernel irqchip settings
- LP: #971685
- CVE-2012-1601
* KVM: unmap pages from the iommu when slots are removed
- LP: #987569
- CVE-2012-2121
* NFSv4: include bitmap in nfsv4 get acl data
- LP: #893147
- CVE-2011-4131
* hugepages: fix use after free bug in "quota" handling
- LP: #990368
- CVE-2012-2133
-- Luis Henriques <email address hidden> 2012年5月21日 17:56:07 +0100

This bug was fixed in the package linux-lts-backport-natty - 2.6.38-15.60~lucid1

---------------
linux-lts-backport-natty (2.6.38-15.60~lucid1) lucid-proposed; urgency=low

[Luis Henriques]

* Release Tracking Bug
- LP: #1003079

[ Andy Whitcroft ]

* [Config] control.stub is an intermediate product not a dependancy
- LP: #992414

[ Herton Ronaldo Krzesinski ]

* linux: add Build-Depends for libnewt-dev, to enable perf TUI support
- LP: #981717

[ Tim Gardner ]

* [Config] perarch and indep tools builds need separate build directories

[ Upstream Kernel Changes ]

* fcaps: clear the same personality flags as suid when fcaps are used
- LP: #987571
- CVE-2012-2123
* natty security: fix compile error in commoncap.c
- LP: #987571
- CVE-2012-2123
* KVM: Clean up error handling during VCPU creation
- LP: #971685
- CVE-2012-1601
* KVM: Ensure all vcpus are consistent with in-kernel irqchip settings
- LP: #971685
- CVE-2012-1601
* KVM: unmap pages from the iommu when slots are removed
- LP: #987569
- CVE-2012-2121
* NFSv4: include bitmap in nfsv4 get acl data
- LP: #893147
- CVE-2011-4131
* hugepages: fix use after free bug in "quota" handling
- LP: #990368
- CVE-2012-2133
-- Luis Henriques <email address hidden> 2012年5月23日 09:43:28 +0100

The verification of this Stable Release Update has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regresssions.

This bug was fixed in the package linux-ti-omap4 - 2.6.38-1209.25

---------------
linux-ti-omap4 (2.6.38-1209.25) natty-proposed; urgency=low

* Release Tracking Bug
- LP: #1029784

[ Andy Whitcroft ]

* SAUCE: rds_ib_send() -- prevent local pings triggering BUG_ON()
- LP: #1016299
- CVE-2012-2372

[ Upstream Kernel Changes ]

* fcaps: clear the same personality flags as suid when fcaps are used
- LP: #987571
- CVE-2012-2123
* security: fix compile error in commoncap.c
- LP: #987571
- CVE-2012-2123
* net: sock: validate data_len before allocating skb in
sock_alloc_send_pskb()
- LP: #1006622
- CVE-2012-2136
* dl2k: Clean up rio_ioctl
- CVE-2012-2313
* hfsplus: Fix potential buffer overflows
- CVE-2012-2319
* nfs: don't lose MS_SYNCHRONOUS on remount of noac mount
- LP: #775809
* NFSv4.1: Ensure state manager thread dies on last umount
- LP: #775809
* NFSv4: Handle expired stateids when the lease is still valid
- LP: #793702
* NFSv4.1: Fix the handling of NFS4ERR_SEQ_MISORDERED errors
- LP: #793702
* NFSv4: include bitmap in nfsv4 get acl data
- LP: #893147
- CVE-2011-4131
* Avoid reading past buffer when calling GETACL
- LP: #1002505
- CVE-2012-2375
* Avoid beyond bounds copy while caching ACL
- LP: #1002505
- CVE-2012-2375
* Fix length of buffer copied in __nfs4_get_acl_uncached
- LP: #1002505
- CVE-2012-2375
-- Paolo Pisati <email address hidden> 2012年7月27日 15:54:18 +0200

Patch d52fc5dde171f030170a6cb78034d166b13c9445 in upstream 3.5 already

This bug was nominated against a series that is no longer supported, ie vivid. The bug task representing the vivid nomination is being closed as Won't Fix.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

The Precise Pangolin has reached end of life, so this bug will not be fixed for that release

The task "linux-lts-saucy (Ubuntu)" has expired because it has had no new comments or updates for more than three years.

If this issue is still present in an Ubuntu LTS kernel still under active support, please reopen the bug and provide updated details. If this issue was reported against an Ubuntu kernel no longer under active support but the issue still exists in a currently supported Ubuntu kernel, please open a new bug against that kernel version and provide the updated details, with a reference link to the original bug.

This action was performed by an automated process maintained by the Ubuntu Kernel Team.

The task "linux-lts-saucy (Ubuntu Trusty)" has expired because it has had no new comments or updates for more than three years.

If this issue is still present in an Ubuntu LTS kernel still under active support, please reopen the bug and provide updated details. If this issue was reported against an Ubuntu kernel no longer under active support but the issue still exists in a currently supported Ubuntu kernel, please open a new bug against that kernel version and provide the updated details, with a reference link to the original bug.

This action was performed by an automated process maintained by the Ubuntu Kernel Team.

The task "linux-lts-saucy (Ubuntu Wily)" has been closed automatically because it was filed against an Ubuntu release that is now end-of-life.

If this issue is still present in a supported Ubuntu kernel, please open a new bug and provide updated details.

This action was performed by an automated process maintained by the Ubuntu Kernel Team.

The task "linux-lts-saucy (Ubuntu Xenial)" has expired because it has had no new comments or updates for more than three years.

If this issue is still present in an Ubuntu LTS kernel still under active support, please reopen the bug and provide updated details. If this issue was reported against an Ubuntu kernel no longer under active support but the issue still exists in a currently supported Ubuntu kernel, please open a new bug against that kernel version and provide the updated details, with a reference link to the original bug.

This action was performed by an automated process maintained by the Ubuntu Kernel Team.