Bug #1685892 “CVE-2017-7477: macsec: avoid heap overflow in skb_...” : Bugs : linux package : Ubuntu

Revision history for this message

Steve Beattie (sbeattie) wrote on 2017-04-24:

#1

MACsec driver was introduced in 4.6 series.

Changed in linux-hwe (Ubuntu Yakkety):
status:	New → Invalid
Changed in linux-hwe (Ubuntu Zesty):
status:	New → Invalid
Changed in linux (Ubuntu Xenial):
status:	New → Invalid

Revision history for this message

Steve Beattie (sbeattie) wrote on 2017-04-26:

#2

This issue needs a second patch applied: https://git.kernel.org/pub/scm/linux/kernel/git/davem/net.git/commit/?id=5294b83086cc1c35b4efeca03644cf9d12282e5b

(http://www.openwall.com/lists/oss-security/2017/04/26/8)

It was assigned CVE-2017-7477 (http://www.openwall.com/lists/oss-security/2017/04/25/7)

Stefan Bader (smb) on 2017-04-28

Changed in linux (Ubuntu Zesty):
assignee:	nobody → Kleber Sacilotto de Souza (kleber-souza)
status:	New → Fix Committed
Changed in linux (Ubuntu Yakkety):
assignee:	nobody → Stefan Bader (smb)
status:	New → Fix Committed

Stefan Bader (smb) on 2017-04-28

summary:

- macsec: avoid heap overflow in skb_to_sgvec
+ CVE-2017-7477: macsec: avoid heap overflow in skb_to_sgvec

Stefan Bader (smb) on 2017-04-28

Changed in linux-hwe (Ubuntu Xenial):
assignee:	nobody → Stefan Bader (smb)
status:	New → In Progress

Revision history for this message

Launchpad Janitor (janitor) wrote on 2017-05-16:

#3

This bug was fixed in the package linux - 4.8.0-52.55

---------------
linux (4.8.0-52.55) yakkety; urgency=low

* linux: 4.8.0-52.55 -proposed tracker (LP: #1686976)

  * CVE-2017-7477: macsec: avoid heap overflow in skb_to_sgvec (LP: #1685892)
    - macsec: avoid heap overflow in skb_to_sgvec
    - macsec: dynamically allocate space for sglist

  * net/ipv4: original ingress device index set as the loopback interface.
    (LP: #1683982)
    - net: fix incorrect original ingress device index in PKTINFO

* Touchpad not working correctly after kernel upgrade (LP: #1662589)
- Input: ALPS - fix V8+ protocol handling (73 03 28)

* ifup service of network device stay active after driver stop (LP: #1672144)
- net: use net->count to check whether a netns is alive or not

* [Hyper-V] mkfs regression in kernel 4.4+ (LP: #1682215)
- block: relax check on sg gap

* Potential memory corruption with capi adapters (LP: #1681469)
- powerpc/mm: Add missing global TLB invalidate if cxl is active

  * [Hyper-V/Azure] Please include Mellanox OFED drivers in Azure kernel and
    image (LP: #1650058)
    - net/mlx4_en: Fix bad WQE issue
    - net/mlx4_core: Fix racy CQ (Completion Queue) free
    - net/mlx4_core: Fix when to save some qp context flags for dynamic VST to VGT
      transitions
    - net/mlx4_core: Avoid command timeouts during VF driver device shutdown

-- Stefan Bader <email address hidden> Fri, 28 Apr 2017 12:17:12 +0200

Changed in linux (Ubuntu Yakkety):
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2017-05-16:

#4

Download full text (14.0 KiB)

This bug was fixed in the package linux - 4.10.0-21.23

---------------
linux (4.10.0-21.23) zesty; urgency=low

* linux: 4.10.0-21.23 -proposed tracker (LP: #1686414)

  * Need to stop using bzip2 compression in packages for zesty onward
    (LP: #1686782)
    - [Debian] Use default compression for all packages

  * [Hyper-V][SAUCE] pci-hyperv: Use only 16 bit integer for PCI domain
    (LP: #1684971)
    - SAUCE: pci-hyperv: Use only 16 bit integer for PCI domain

  * CVE-2017-7477: macsec: avoid heap overflow in skb_to_sgvec (LP: #1685892)
    - macsec: avoid heap overflow in skb_to_sgvec
    - macsec: dynamically allocate space for sglist

  * Zesty update to 4.10.11 stable release (LP: #1685140)
    - drm/i915: Fix forcewake active domain tracking
    - drm/i915: Move updating color management to before vblank evasion
    - drm/i915/fbdev: Stop repeating tile configuration on stagnation
    - drm/i915: Squelch any ktime/jiffie rounding errors for wait-ioctl
    - drm/i915/gen9: Increase PCODE request timeout to 50ms
    - drm/i915: Store a permanent error in obj->mm.pages
    - drm/i915: Nuke debug messages from the pipe update critical section
    - drm/i915: Avoid tweaking evaluation thresholds on Baytrail v3
    - drm/i915: Reject HDMI 12bpc if the sink doesn't indicate support
    - drm/i915: Only enable hotplug interrupts if the display interrupts are
      enabled
    - drm/i915: Drop support for I915_EXEC_CONSTANTS_* execbuf parameters.
    - drm/i915: Stop using RP_DOWN_EI on Baytrail
    - drm/i915: Avoid rcu_barrier() from reclaim paths (shrinker)
    - drm/i915: Do .init_clock_gating() earlier to avoid it clobbering watermarks
    - orangefs: Dan Carpenter influenced cleanups...
    - orangefs: fix buffer size mis-match between kernel space and user space.
    - nfs: flexfiles: fix kernel OOPS if MDS returns unsupported DS type
    - rt2x00usb: fix anchor initialization
    - rt2x00usb: do not anchor rx and tx urb's
    - MIPS: Introduce irq_stack
    - MIPS: Stack unwinding while on IRQ stack
    - MIPS: Only change $28 to thread_info if coming from user mode
    - MIPS: Switch to the irq_stack in interrupts
    - MIPS: Select HAVE_IRQ_EXIT_ON_IRQ_STACK
    - MIPS: IRQ Stack: Fix erroneous jal to plat_irq_dispatch
    - crypto: caam - fix RNG deinstantiation error checking
    - crypto: caam - fix invalid dereference in caam_rsa_init_tfm()
    - dma-buf: add support for compat ioctl
    - Linux 4.10.11

  * Zesty update to v4.10.10 stable release (LP: #1682130)
    - drm/vmwgfx: Type-check lookups of fence objects
    - drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()
    - drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()
    - drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces
    - drm/vmwgfx: Remove getparam error message
    - drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()
    - PCI: thunder-pem: Add legacy firmware support for Cavium ThunderX host
      controller
    - PCI: thunder-pem: Fix legacy firmware PEM-specific resources
    - sysfs: be careful of error returns from ops->show()
    - staging: android: ashmem: lseek failed due to no FM...

This bug was fixed in the package linux - 4.10.0-21.23

---------------
linux (4.10.0-21.23) zesty; urgency=low

* linux: 4.10.0-21.23 -proposed tracker (LP: #1686414)

* Need to stop using bzip2 compression in packages for zesty onward
    (LP: #1686782)
    - [Debian] Use default compression for all packages

* [Hyper-V][SAUCE] pci-hyperv: Use only 16 bit integer for PCI domain
    (LP: #1684971)
    - SAUCE: pci-hyperv: Use only 16 bit integer for PCI domain

* CVE-2017-7477: macsec: avoid heap overflow in skb_to_sgvec (LP: #1685892)
    - macsec: avoid heap overflow in skb_to_sgvec
    - macsec: dynamically allocate space for sglist

* Zesty update to 4.10.11 stable release (LP: #1685140)
    - drm/i915: Fix forcewake active domain tracking
    - drm/i915: Move updating color management to before vblank evasion
    - drm/i915/fbdev: Stop repeating tile configuration on stagnation
    - drm/i915: Squelch any ktime/jiffie rounding errors for wait-ioctl
    - drm/i915/gen9: Increase PCODE request timeout to 50ms
    - drm/i915: Store a permanent error in obj->mm.pages
    - drm/i915: Nuke debug messages from the pipe update critical section
    - drm/i915: Avoid tweaking evaluation thresholds on Baytrail v3
    - drm/i915: Reject HDMI 12bpc if the sink doesn't indicate support
    - drm/i915: Only enable hotplug interrupts if the display interrupts are
      enabled
    - drm/i915: Drop support for I915_EXEC_CONSTANTS_* execbuf parameters.
    - drm/i915: Stop using RP_DOWN_EI on Baytrail
    - drm/i915: Avoid rcu_barrier() from reclaim paths (shrinker)
    - drm/i915: Do .init_clock_gating() earlier to avoid it clobbering watermarks
    - orangefs: Dan Carpenter influenced cleanups...
    - orangefs: fix buffer size mis-match between kernel space and user space.
    - nfs: flexfiles: fix kernel OOPS if MDS returns unsupported DS type
    - rt2x00usb: fix anchor initialization
    - rt2x00usb: do not anchor rx and tx urb's
    - MIPS: Introduce irq_stack
    - MIPS: Stack unwinding while on IRQ stack
    - MIPS: Only change $28 to thread_info if coming from user mode
    - MIPS: Switch to the irq_stack in interrupts
    - MIPS: Select HAVE_IRQ_EXIT_ON_IRQ_STACK
    - MIPS: IRQ Stack: Fix erroneous jal to plat_irq_dispatch
    - crypto: caam - fix RNG deinstantiation error checking
    - crypto: caam - fix invalid dereference in caam_rsa_init_tfm()
    - dma-buf: add support for compat ioctl
    - Linux 4.10.11

* Zesty update to v4.10.10 stable release (LP: #1682130)
    - drm/vmwgfx: Type-check lookups of fence objects
    - drm/vmwgfx: NULL pointer dereference in vmw_surface_define_ioctl()
    - drm/vmwgfx: avoid calling vzalloc with a 0 size in vmw_get_cap_3d_ioctl()
    - drm/ttm, drm/vmwgfx: Relax permission checking when opening surfaces
    - drm/vmwgfx: Remove getparam error message
    - drm/vmwgfx: fix integer overflow in vmw_surface_define_ioctl()
    - PCI: thunder-pem: Add legacy firmware support for Cavium ThunderX host
      controller
    - PCI: thunder-pem: Fix legacy firmware PEM-specific resources
    - sysfs: be careful of error returns from ops->show()
    - staging: android: ashmem: lseek failed due to no FMODE_LSEEK.
    - arm/arm64: KVM: Take mmap_sem in stage2_unmap_vm
    - arm/arm64: KVM: Take mmap_sem in kvm_arch_prepare_memory_region
    - kvm: arm/arm64: Fix locking for kvm_free_stage2_pgd
    - iio: core: Fix IIO_VAL_FRACTIONAL_LOG2 for negative values
    - iio: st_pressure: initialize lps22hb bootime
    - iio: bmg160: reset chip when probing
    - arm64: mm: unaligned access by user-land should be received as SIGBUS
    - cfg80211: check rdev resume callback only for registered wiphy
    - Reset TreeId to zero on SMB2 TREE_CONNECT
    - mm/page_alloc.c: fix print order in show_free_areas()
    - ptrace: fix PTRACE_LISTEN race corrupting task->state
    - dax: fix radix tree insertion race
    - dm verity fec: limit error correction recursion
    - dm verity fec: fix bufio leaks
    - ACPI / gpio: do not fall back to parsing _CRS when we get a deferral
    - ACPI / scan: Prefer devices without _HID for _ADR matching
    - Kbuild: use cc-disable-warning consistently for maybe-uninitialized
    - jump label: fix passing kbuild_cflags when checking for asm goto support
    - orangefs: move features validation to fix filesystem hang
    - xfs: Honor FALLOC_FL_KEEP_SIZE when punching ends of files
    - ring-buffer: Fix return value check in test_ringbuffer()
    - mac80211: unconditionally start new netdev queues with iTXQ support
    - brcmfmac: use local iftype avoiding use-after-free of virtual interface
    - metag/usercopy: Drop unused macros
    - metag/usercopy: Fix alignment error checking
    - metag/usercopy: Add early abort to copy_to_user
    - metag/usercopy: Zero rest of buffer from copy_from_user
    - metag/usercopy: Set flags before ADDZ
    - metag/usercopy: Fix src fixup in from user rapf loops
    - metag/usercopy: Add missing fixups
    - drm/msm: adreno: fix build error without debugfs
    - powerpc: Disable HFSCR[TM] if TM is not supported
    - powerpc/mm: Add missing global TLB invalidate if cxl is active
    - powerpc/64: Fix flush_(d|i)cache_range() called from modules
    - powerpc: Don't try to fix up misaligned load-with-reservation instructions
    - powerpc/crypto/crc32c-vpmsum: Fix missing preempt_disable()
    - dm raid: fix NULL pointer dereference for raid1 without bitmap
    - x86/mce: Don't print MCEs when mcelog is active
    - nios2: reserve boot memory for device tree
    - xtensa: make __pa work with uncached KSEG addresses
    - s390/decompressor: fix initrd corruption caused by bss clear
    - s390/uaccess: get_user() should zero on failure (again)
    - MIPS: Force o32 fp64 support on 32bit MIPS64r6 kernels
    - MIPS: ralink: Fix typos in rt3883 pinctrl
    - MIPS: End spinlocks with .insn
    - MIPS: Lantiq: fix missing xbar kernel panic
    - MIPS: Check TLB before handle_ri_rdhwr() for Loongson-3
    - MIPS: Add MIPS_CPU_FTLB for Loongson-3A R2
    - MIPS: Flush wrong invalid FTLB entry for huge page
    - MIPS: c-r4k: Fix Loongson-3's vcache/scache waysize calculation
    - drm/i915/gvt: Fix gvt scheduler interval time
    - drm/i915/kvmgt: fix suspicious rcu dereference usage
    - usb: dwc3: gadget: delay unmap of bounced requests
    - Documentation: stable-kernel-rules: fix stable-tag format
    - mm/mempolicy.c: fix error handling in set_mempolicy and mbind.
    - random: use chacha20 for get_random_int/long
    - kvm: fix page struct leak in handle_vmon
    - drm/edid: constify edid quirk list
    - drm/i915: fix INTEL_BDW_IDS definition
    - drm/i915: more .is_mobile cleanups for BDW
    - drm/i915: actually drive the BDW reserved IDs
    - ASoC: Intel: bytcr_rt5640: quirks for Insyde devices
    - usb: chipidea: msm: Rely on core to override AHBBURST
    - serial: 8250_omap: Add OMAP_DMA_TX_KICK quirk for AM437x
    - usb: xhci: add quirk flag for broken PED bits
    - usb: host: xhci-plat: enable BROKEN_PED quirk if platform requested
    - usb: dwc3: host: pass quirk-broken-port-ped property for known broken
      revisions
    - drm/mga: remove device_is_agp callback
    - PCI: Add ACS quirk for Intel Union Point
    - PCI: xgene: Fix double free on init error
    - sata: ahci-da850: implement a workaround for the softreset quirk
    - ACPI / button: Change default behavior to lid_init_state=open
    - ASoC: codecs: rt5670: add quirk for Lenovo Thinkpad 10
    - ASoC: Intel: Baytrail: add quirk for Lenovo Thinkpad 10
    - ASoC: Intel: cht_bsw_rt5645: harden ACPI device detection
    - ASoC: Intel: cht_bsw_rt5645: add Baytrail MCLK support
    - ACPI: save NVS memory for Lenovo G50-45
    - ASoC: sun4i-i2s: Add quirks to handle a31 compatible
    - HID: wacom: don't apply generic settings to old devices
    - arm: kernel: Add SMC structure parameter
    - firmware: qcom: scm: Fix interrupted SCM calls
    - ARM: smccc: Update HVC comment to describe new quirk parameter
    - PCI: Add Broadcom Northstar2 PAXC quirk for device class and MPSS
    - PCI: Disable MSI for HiSilicon Hip06/Hip07 Root Ports
    - mmc: sdhci-of-esdhc: remove default broken-cd for ARM
    - PCI: Sort the list of devices with D3 delay quirk by ID
    - watchdog: s3c2410: Fix infinite interrupt in soft mode
    - platform/x86: asus-wmi: Detect quirk_no_rfkill from the DSDT
    - x86/reboot/quirks: Add ASUS EeeBook X205TA reboot quirk
    - x86/reboot/quirks: Add ASUS EeeBook X205TA/W reboot quirk
    - usb-storage: Add ignore-residue quirk for Initio INIC-3619
    - x86/reboot/quirks: Fix typo in ASUS EeeBook X205TA reboot quirk
    - Linux 4.10.10

* Broken PowerNV PCI hotplug driver - Patch backporting to zesty
    (LP: #1680328)
    - drivers/pci/hotplug: Mask PDC interrupt if required

* Zesty update to v4.10.9 stable release (LP: #1681875)
    - libceph: force GFP_NOIO for socket allocations
    - KVM: nVMX: fix nested EPT detection
    - xfs: pull up iolock from xfs_free_eofblocks()
    - xfs: sync eofblocks scans under iolock are livelock prone
    - xfs: fix eofblocks race with file extending async dio writes
    - xfs: fix toctou race when locking an inode to access the data map
    - xfs: fail _dir_open when readahead fails
    - xfs: filter out obviously bad btree pointers
    - xfs: check for obviously bad level values in the bmbt root
    - xfs: verify free block header fields
    - xfs: allow unwritten extents in the CoW fork
    - xfs: mark speculative prealloc CoW fork extents unwritten
    - xfs: reset b_first_retry_time when clear the retry status of xfs_buf_t
    - xfs: reject all unaligned direct writes to reflinked files
    - xfs: update ctime and mtime on clone destinatation inodes
    - xfs: correct null checks and error processing in xfs_initialize_perag
    - xfs: don't fail xfs_extent_busy allocation
    - xfs: handle indlen shortage on delalloc extent merge
    - xfs: split indlen reservations fairly when under reserved
    - xfs: fix uninitialized variable in _reflink_convert_cow
    - xfs: don't reserve blocks for right shift transactions
    - xfs: Use xfs_icluster_size_fsb() to calculate inode chunk alignment
    - xfs: tune down agno asserts in the bmap code
    - xfs: only reclaim unwritten COW extents periodically
    - xfs: fix and streamline error handling in xfs_end_io
    - xfs: Use xfs_icluster_size_fsb() to calculate inode alignment mask
    - xfs: use iomap new flag for newly allocated delalloc blocks
    - xfs: try any AG when allocating the first btree block when reflinking
    - scsi: sg: check length passed to SG_NEXT_CMD_LEN
    - scsi: libsas: fix ata xfer length
    - scsi: scsi_dh_alua: Check scsi_device_get() return value
    - scsi: scsi_dh_alua: Ensure that alua_activate() calls the completion
      function
    - PCI: iproc: Save host bridge window resource in struct iproc_pcie
    - PCI: thunder-pem: Use Cavium assigned hardware ID for ThunderX host
      controller
    - ALSA: seq: Fix race during FIFO resize
    - ALSA: hda - fix a problem for lineout on a Dell AIO machine
    - ASoC: atmel-classd: fix audio clock rate
    - ASoC: Intel: Skylake: fix invalid memory access due to wrong reference of
      pointer
    - ASoC: rt5665: fix getting wrong work handler container
    - HID: wacom: Don't add ghost interface as shared data
    - mmc: sdhci: Disable runtime pm when the sdio_irq is enabled
    - mmc: sdhci-of-at91: fix MMC_DDR_52 timing selection
    - crypto: ccp - Make some CCP DMA channels private
    - crypto: xts,lrw - fix out-of-bounds write after kmalloc failure
    - ARCv2: SLC: Make sure busy bit is set properly on SLC flushing
    - NFSv4.1 fix infinite loop on IO BAD_STATEID error
    - nfsd: map the ENOKEY to nfserr_perm for avoiding warning
    - dt-bindings: rng: clocks property on omap_rng not always mandatory
    - parisc: Clean up fixup routines for get_user()/put_user()
    - parisc: Avoid stalled CPU warnings after system shutdown
    - parisc: Fix access fault handling in pa_memcpy()
    - ACPI: Fix incompatibility with mcount-based function graph tracing
    - ACPI: Do not create a platform_device for IOAPIC/IOxAPIC
    - tty/serial: atmel: fix race condition (TX+DMA)
    - tty/serial: atmel: fix TX path in atmel_console_write()
    - xhci: Set URB actual length for stopped control transfers
    - USB: fix linked-list corruption in rh_call_control()
    - serial: mxs-auart: Fix baudrate calculation
    - KVM: x86: clear bus pointer when destroyed
    - KVM: kvm_io_bus_unregister_dev() should never fail
    - drm/radeon: Override fpfn for all VRAM placements in radeon_evict_flags
    - drm/vc4: Allocate the right amount of space for boot-time CRTC state.
    - drm/etnaviv: (re-)protect fence allocation with GPU mutex
    - drm/i915/kvmgt: Hold struct kvm reference
    - x86/mm/KASLR: Exclude EFI region from KASLR VA space randomization
    - x86/mce: Fix copy/paste error in exception table entries
    - lib/syscall: Clear return values when no stack
    - mm: rmap: fix huge file mmap accounting in the memcg stats
    - mm: workingset: fix premature shadow node shrinking with cgroups
    - mm, hugetlb: use pte_present() instead of pmd_present() in follow_huge_pmd()
    - drm/armada: Fix compile fail
    - ARM: dts: BCM5301X: Correct GIC_PPI interrupt flags
    - MIPS: Lantiq: Fix cascaded IRQ setup
    - blk: improve order of bio handling in generic_make_request()
    - blk: Ensure users for current->bio_list can see the full list.
    - padata: avoid race in reordering
    - nvme/core: Fix race kicking freed request_queue
    - nvme/pci: Disable on removal when disconnected
    - drm/i915: Move the release of PT page to the upper caller
    - drm/i915: Let execlist_update_context() cover !FULL_PPGTT mode.
    - drm/i915: A hotfix for making aliasing PPGTT work for GVT-g
    - Linux 4.10.9

* POWER9: Improve performance on memory management (LP: #1681429)
    - SAUCE: powerpc/mm/radix: Don't do page walk cache flush when doing full mm
      flush
    - SAUCE: powerpc/mm/radix: Remove unnecessary ptesync

* Disable CONFIG_HVC_UDBG on ppc64el (LP: #1680888)
    - [Config] Disable CONFIG_HVC_UDBG on ppc64el

-- Kleber Sacilotto de Souza <kleber.souza@canonical.com>  Fri, 28 Apr 2017 12:41:49 +0200

Changed in linux (Ubuntu Zesty):
status:	Fix Committed → Fix Released

Revision history for this message

Launchpad Janitor (janitor) wrote on 2017-05-16:

#5

This bug was fixed in the package linux-hwe - 4.8.0-52.55~16.04.1

---------------
linux-hwe (4.8.0-52.55~16.04.1) xenial; urgency=low

* linux-hwe: 4.8.0-52.55~16.04.1 -proposed tracker (LP: #1686978)