Bug #1982316 “focal/linux-gcp-5.15: 5.15.0-1015.20~20.04.1 -prop...” : Bugs : Kernel SRU Workflow

Thadeu Lima de Souza Cascardo (cascardo) on 2022-07-20

tags:	added: kernel-release-tracking-bug-live
description:	updated
tags:	added: kernel-sru-cycle-2022.07.11-2
description:	updated
description:	updated
tags:	added: kernel-sru-backport-of-1982273
Changed in kernel-sru-workflow:
status:	New → Confirmed
importance:	Undecided → Medium

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-20

Changed in linux-gcp-5.15 (Ubuntu Focal):
importance:	Undecided → Medium
Changed in kernel-sru-workflow:
status:	Confirmed → Triaged

Revision history for this message

Launchpad Janitor (janitor) wrote on 2022-07-20:

#1

Status changed to 'Confirmed' because the bug affects multiple users.

Changed in linux-gcp-5.15 (Ubuntu Focal):
status:	New → Confirmed

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-20

description:	updated
Changed in kernel-sru-workflow:
status:	Triaged → In Progress

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-21

description:

updated

Khaled El Mously (kmously) on 2022-07-22

summary:

- focal/linux-gcp-5.15: <version to be filled> -proposed tracker
+ focal/linux-gcp-5.15: 5.15.0-1015.20~20.04.1 -proposed tracker

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Andy Whitcroft (apw) on 2022-07-22

tags:

added: kernel-signing-bot

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-22

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-23

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-24

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-28

description:

updated

Khaled El Mously (kmously) on 2022-07-29

tags:

added: automated-testing-passed

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-29

description:

updated

Khaled El Mously (kmously) on 2022-07-29

tags:

added: regression-testing-passed

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-07-29

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-08-03

tags:

added: kernel-jira-issue-ksru-4491

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-08-03

description:

updated

Ubuntu Kernel Bot (ubuntu-kernel-bot) on 2022-08-05

Changed in kernel-sru-workflow:
status:	In Progress → Fix Committed

Revision history for this message

Launchpad Janitor (janitor) wrote on 2022-08-09:

#2

Download full text (9.0 KiB)

This bug was fixed in the package linux-gcp-5.15 - 5.15.0-1016.21~20.04.1

---------------
linux-gcp-5.15 (5.15.0-1016.21~20.04.1) focal; urgency=medium

[ Ubuntu: 5.15.0-1016.21 ]

  * CVE-2022-2585
    - SAUCE: posix-cpu-timers: Cleanup CPU timers before freeing them during exec
  * CVE-2022-2586
    - SAUCE: netfilter: nf_tables: do not allow SET_ID to refer to another table
    - SAUCE: netfilter: nf_tables: do not allow CHAIN_ID to refer to another table
    - SAUCE: netfilter: nf_tables: do not allow RULE_ID to refer to another chain
  * CVE-2022-2588
    - SAUCE: net_sched: cls_route: remove from list when handle is 0

linux-gcp-5.15 (5.15.0-1015.20~20.04.1) focal; urgency=medium

* focal/linux-gcp-5.15: 5.15.0-1015.20~20.04.1 -proposed tracker
(LP: #1982316)

[ Ubuntu: 5.15.0-1015.20 ]

  * jammy/linux-gcp: 5.15.0-1015.20 -proposed tracker (LP: #1982273)
  * CVE-2022-29900 // CVE-2022-29901
    - x86/lib/atomic64_386_32: Rename things
    - x86: Prepare asm files for straight-line-speculation
    - x86: Prepare inline-asm for straight-line-speculation
    - x86/alternative: Relax text_poke_bp() constraint
    - kbuild: move objtool_args back to scripts/Makefile.build
    - x86: Add straight-line-speculation mitigation
    - kvm/emulate: Fix SETcc emulation function offsets with SLS
    - crypto: x86/poly1305 - Fixup SLS
    - objtool: Add straight-line-speculation validation
    - objtool: Fix SLS validation for kcov tail-call replacement
    - objtool: Fix objtool regression on x32 systems
    - objtool: Fix symbol creation
    - objtool: Introduce CFI hash
    - objtool: Default ignore INT3 for unreachable
    - x86, kvm: use proper ASM macros for kvm_vcpu_is_preempted
    - x86/traps: Use pt_regs directly in fixup_bad_iret()
    - x86/entry: Switch the stack after error_entry() returns
    - x86/entry: Move PUSH_AND_CLEAR_REGS out of error_entry()
    - x86/entry: Don't call error_entry() for XENPV
    - x86/entry: Remove skip_r11rcx
    - x86/realmode: build with -D__DISABLE_EXPORTS
    - x86/ibt,ftrace: Make function-graph play nice
    - x86/kvm/vmx: Make noinstr clean
    - x86/cpufeatures: Move RETPOLINE flags to word 11
    - x86/retpoline: Cleanup some #ifdefery
    - x86/retpoline: Swizzle retpoline thunk
    - x86/retpoline: Use -mfunction-return
    - x86: Undo return-thunk damage
    - x86,objtool: Create .return_sites
    - objtool: skip non-text sections when adding return-thunk sites
    - x86,static_call: Use alternative RET encoding
    - x86/ftrace: Use alternative RET encoding
    - x86/bpf: Use alternative RET encoding
    - x86/kvm: Fix SETcc emulation for return thunks
    - x86/vsyscall_emu/64: Don't use RET in vsyscall emulation
    - x86/sev: Avoid using __x86_return_thunk
    - x86: Use return-thunk in asm code
    - x86/entry: Avoid very early RET
    - objtool: Treat .text.__x86.* as noinstr
    - x86: Add magic AMD return-thunk
    - x86/bugs: Report AMD retbleed vulnerability
    - x86/bugs: Add AMD retbleed= boot parameter
    - x86/bugs: Enable STIBP for JMP2RET
    - x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value
    - x86/entry: Add kernel IBRS implementation
    - x86/bugs: Optimize SPEC_C...

This bug was fixed in the package linux-gcp-5.15 - 5.15.0-1016.21~20.04.1

---------------
linux-gcp-5.15 (5.15.0-1016.21~20.04.1) focal; urgency=medium

[ Ubuntu: 5.15.0-1016.21 ]

* CVE-2022-2585
    - SAUCE: posix-cpu-timers: Cleanup CPU timers before freeing them during exec
  * CVE-2022-2586
    - SAUCE: netfilter: nf_tables: do not allow SET_ID to refer to another table
    - SAUCE: netfilter: nf_tables: do not allow CHAIN_ID to refer to another table
    - SAUCE: netfilter: nf_tables: do not allow RULE_ID to refer to another chain
  * CVE-2022-2588
    - SAUCE: net_sched: cls_route: remove from list when handle is 0

linux-gcp-5.15 (5.15.0-1015.20~20.04.1) focal; urgency=medium

* focal/linux-gcp-5.15: 5.15.0-1015.20~20.04.1 -proposed tracker
    (LP: #1982316)

[ Ubuntu: 5.15.0-1015.20 ]

* jammy/linux-gcp: 5.15.0-1015.20 -proposed tracker (LP: #1982273)
  * CVE-2022-29900 // CVE-2022-29901
    - x86/lib/atomic64_386_32: Rename things
    - x86: Prepare asm files for straight-line-speculation
    - x86: Prepare inline-asm for straight-line-speculation
    - x86/alternative: Relax text_poke_bp() constraint
    - kbuild: move objtool_args back to scripts/Makefile.build
    - x86: Add straight-line-speculation mitigation
    - kvm/emulate: Fix SETcc emulation function offsets with SLS
    - crypto: x86/poly1305 - Fixup SLS
    - objtool: Add straight-line-speculation validation
    - objtool: Fix SLS validation for kcov tail-call replacement
    - objtool: Fix objtool regression on x32 systems
    - objtool: Fix symbol creation
    - objtool: Introduce CFI hash
    - objtool: Default ignore INT3 for unreachable
    - x86, kvm: use proper ASM macros for kvm_vcpu_is_preempted
    - x86/traps: Use pt_regs directly in fixup_bad_iret()
    - x86/entry: Switch the stack after error_entry() returns
    - x86/entry: Move PUSH_AND_CLEAR_REGS out of error_entry()
    - x86/entry: Don't call error_entry() for XENPV
    - x86/entry: Remove skip_r11rcx
    - x86/realmode: build with -D__DISABLE_EXPORTS
    - x86/ibt,ftrace: Make function-graph play nice
    - x86/kvm/vmx: Make noinstr clean
    - x86/cpufeatures: Move RETPOLINE flags to word 11
    - x86/retpoline: Cleanup some #ifdefery
    - x86/retpoline: Swizzle retpoline thunk
    - x86/retpoline: Use -mfunction-return
    - x86: Undo return-thunk damage
    - x86,objtool: Create .return_sites
    - objtool: skip non-text sections when adding return-thunk sites
    - x86,static_call: Use alternative RET encoding
    - x86/ftrace: Use alternative RET encoding
    - x86/bpf: Use alternative RET encoding
    - x86/kvm: Fix SETcc emulation for return thunks
    - x86/vsyscall_emu/64: Don't use RET in vsyscall emulation
    - x86/sev: Avoid using __x86_return_thunk
    - x86: Use return-thunk in asm code
    - x86/entry: Avoid very early RET
    - objtool: Treat .text.__x86.* as noinstr
    - x86: Add magic AMD return-thunk
    - x86/bugs: Report AMD retbleed vulnerability
    - x86/bugs: Add AMD retbleed= boot parameter
    - x86/bugs: Enable STIBP for JMP2RET
    - x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value
    - x86/entry: Add kernel IBRS implementation
    - x86/bugs: Optimize SPEC_CTRL MSR writes
    - x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS
    - x86/bugs: Split spectre_v2_select_mitigation() and
      spectre_v2_user_select_mitigation()
    - x86/bugs: Report Intel retbleed vulnerability
    - intel_idle: Disable IBRS during long idle
    - objtool: Update Retpoline validation
    - x86/xen: Rename SYS* entry points
    - x86/xen: Add UNTRAIN_RET
    - x86/bugs: Add retbleed=ibpb
    - x86/bugs: Do IBPB fallback check only once
    - objtool: Add entry UNRET validation
    - x86/cpu/amd: Add Spectral Chicken
    - x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n
    - x86/speculation: Fix firmware entry SPEC_CTRL handling
    - x86/speculation: Fix SPEC_CTRL write on SMT state change
    - x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit
    - x86/speculation: Remove x86_spec_ctrl_mask
    - objtool: Re-add UNWIND_HINT_{SAVE_RESTORE}
    - KVM: VMX: Flatten __vmx_vcpu_run()
    - KVM: VMX: Convert launched argument to flags
    - KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS
    - KVM: VMX: Fix IBRS handling after vmexit
    - x86/speculation: Fill RSB on vmexit for IBRS
    - KVM: VMX: Prevent RSB underflow before vmenter
    - x86/common: Stamp out the stepping madness
    - x86/cpu/amd: Enumerate BTC_NO
    - x86/retbleed: Add fine grained Kconfig knobs
    - x86/bugs: Add Cannon lake to RETBleed affected CPU list
    - x86/entry: Move PUSH_AND_CLEAR_REGS() back into error_entry
    - x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported
    - x86/kexec: Disable RET on kexec
    - x86/speculation: Disable RRSBA behavior
    - [Config]: Enable speculation mitigations
    - x86/static_call: Serialize __static_call_fixup() properly
    - x86/asm/32: Fix ANNOTATE_UNRET_SAFE use on 32-bit
    - x86/bugs: Mark retbleed_strings static
    - x86/entry: Remove UNTRAIN_RET from native_irq_return_ldt
    - x86/kvm: fix FASTOP_SIZE when return thunks are enabled
    - x86/speculation: Use DECLARE_PER_CPU for x86_spec_ctrl_current
    - KVM: emulate: do not adjust size of fastop and setcc subroutines
    - x86/bugs: Remove apostrophe typo
    - efi/x86: use naked RET on mixed mode call wrapper

[ Ubuntu: 5.15.0-1014.19 ]

* jammy/linux-gcp: 5.15.0-1014.19 -proposed tracker (LP: #1981217)
  * Miscellaneous Ubuntu changes
    - [config] Update configs after rebase
  * jammy/linux: 5.15.0-43.46 -proposed tracker (LP: #1981243)
  * Packaging resync (LP: #1786013)
    - debian/dkms-versions -- update from kernel-versions (main/2022.07.11)
  * nbd: requests can become stuck when disconnecting from server with qemu-nbd
    (LP: #1896350)
    - nbd: don't handle response without a corresponding request message
    - nbd: make sure request completion won't concurrent
    - nbd: don't clear 'NBD_CMD_INFLIGHT' flag if request is not completed
    - nbd: fix io hung while disconnecting device
  * Ubuntu 22.04 and 20.04 DPC Fixes for Failure Cases of DownPort Containment
    events (LP: #1965241)
    - PCI/portdrv: Rename pm_iter() to pcie_port_device_iter()
    - PCI: pciehp: Ignore Link Down/Up caused by error-induced Hot Reset
    - [Config] Enable config option CONFIG_PCIE_EDR
  * [SRU] Ubuntu 22.04 Feature Request-Add support for a NVMe-oF-TCP CDC Client
    - TP 8010 (LP: #1948626)
    - nvme: add CNTRLTYPE definitions for 'identify controller'
    - nvme: send uevent on connection up
    - nvme: expose cntrltype and dctype through sysfs
  * [UBUNTU 22.04] Kernel oops while removing device from cio_ignore list
    (LP: #1980951)
    - s390/cio: derive cdev information only for IO-subchannels
  * Jammy Charmed OpenStack deployment fails over connectivity issues when using
    converged OVS bridge for control and data planes (LP: #1978820)
    - net/mlx5e: TC NIC mode, fix tc chains miss table
  * Hairpin traffic does not work with centralized NAT gw (LP: #1967856)
    - net: openvswitch: fix misuse of the cached connection on tuple changes
  * alsa: asoc: amd: the internal mic can't be dedected on yellow carp machines
    (LP: #1980700)
    - ASoC: amd: Add driver data to acp6x machine driver
    - ASoC: amd: Add support for enabling DMIC on acp6x via _DSD
  * AMD ACP 6.x DMIC Supports (LP: #1949245)
    - ASoC: amd: add Yellow Carp ACP6x IP register header
    - ASoC: amd: add Yellow Carp ACP PCI driver
    - ASoC: amd: add acp6x init/de-init functions
    - ASoC: amd: add platform devices for acp6x pdm driver and dmic driver
    - ASoC: amd: add acp6x pdm platform driver
    - ASoC: amd: add acp6x irq handler
    - ASoC: amd: add acp6x pdm driver dma ops
    - ASoC: amd: add acp6x pci driver pm ops
    - ASoC: amd: add acp6x pdm driver pm ops
    - ASoC: amd: enable Yellow carp acp6x drivers build
    - ASoC: amd: create platform device for acp6x machine driver
    - ASoC: amd: add YC machine driver using dmic
    - ASoC: amd: enable Yellow Carp platform machine driver build
    - ASoC: amd: fix uninitialized variable in snd_acp6x_probe()
    - [Config] Enable AMD ACP 6 DMIC Support
  * [UBUNTU 20.04] Include patches to avoid self-detected stall with Secure
    Execution (LP: #1979296)
    - KVM: s390: pv: add macros for UVC CC values
    - KVM: s390: pv: avoid stalls when making pages secure
  * [22.04 FEAT] KVM: Attestation support for Secure Execution (crypto)
    (LP: #1959973)
    - drivers/s390/char: Add Ultravisor io device
    - s390/uv_uapi: depend on CONFIG_S390
    - [Config] CONFIG_S390_UV_UAPI=y for s390x
  * CVE-2022-1679
    - SAUCE: ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
  * CVE-2022-28893
    - SUNRPC: Ensure we flush any closed sockets before xs_xprt_free()
    - SUNRPC: Don't leak sockets in xs_local_connect()
  * CVE-2022-34918
    - netfilter: nf_tables: stricter validation of element data
  * CVE-2022-1652
    - floppy: use a statically allocated error counter

-- Thadeu Lima de Souza Cascardo <cascardo@canonical.com>  Fri, 05 Aug 2022 09:16:46 -0300

Changed in linux-gcp-5.15 (Ubuntu Focal):
status:	Confirmed → Fix Released

Kernel SRU Workflow

focal/linux-gcp-5.15: 5.15.0-1015.20~20.04.1 -proposed tracker

Bug Description

CVE References

Other bug subscribers

Remote bug watches

	Status	Importance	Assigned to
Kernel SRU Workflow	Fix Committed	Medium	Unassigned
Automated-testing	Fix Released	Medium	Canonical Kernel Team
Boot-testing	Fix Released	Medium	Unassigned
Certification-testing	Invalid	Medium	Unassigned
New-review	Fix Released	Medium	Andy Whitcroft
Prepare-package	Fix Released	Medium	Khaled El Mously
Prepare-package-lrg	Fix Released	Medium	Khaled El Mously
Prepare-package-lrm	Fix Released	Medium	Khaled El Mously
Prepare-package-lrs	Fix Released	Medium	Khaled El Mously
Prepare-package-meta	Fix Released	Medium	Khaled El Mously
Prepare-package-signed	Fix Released	Medium	Khaled El Mously
Promote-signing-to-proposed	Invalid	Medium	Unassigned
Promote-to-proposed	Fix Released	Medium	Ubuntu Stable Release Updates Team
Promote-to-security	New	Medium	Ubuntu Stable Release Updates Team
Promote-to-updates	New	Medium	Ubuntu Stable Release Updates Team
Regression-testing	Fix Released	Medium	Canonical Kernel Team
Security-signoff	Fix Released	Medium	Canonical Security Team
Sru-review	Fix Released	Medium	Stefan Bader
Verification-testing	Fix Released	Medium	Canonical Kernel Team
linux-gcp-5.15 (Ubuntu)
Focal	Fix Released	Medium	Unassigned