[kernel-sec-discuss] r4062 - active

[Ben Hutchings]

Author: benh
Date: 2015-12-27 06:04:13 +0000 (Sun, 27 Dec 2015)
New Revision: 4062

Added:
   active/CVE-2015-8550
   active/CVE-2015-8551
   active/CVE-2015-8552
Log:
Add CVE-2015-855{0,1,2}

Added: active/CVE-2015-8550
===================================================================
--- active/CVE-2015-8550	                        (rev 0)
+++ active/CVE-2015-8550	2015-12-27 06:04:13 UTC (rev 4062)
@@ -0,0 +1,12 @@
+Description: paravirtualized drivers incautious about shared memory contents
+References: http://xenbits.xen.org/xsa/advisory-155.html
+Notes:
+Bugs:
+upstream: released (4.4-rc6) [454d5d882c7e412b840e3c99010fe81a9862f6fb, 0f589967a73f1f30ab4ac4dd9ce0bb399b4d6357, 68a33bfd8403e4e22847165d149823a2e0e67c9c, 1f13d75ccb806260079e0679d55d9253e370ec8a, 18779149101c0dd43ded43669ae2a92d21b6f9cb, be69746ec12f35b484707da505c6c76ff06f97dc, 8135cf8b092723dbfcc611fe6fdcb3a36c9951c5]
+3.16-upstream-stable: needed
+3.2-upstream-stable: needed
+2.6.32-upstream-stable: N/A "Vulnerable code not present"
+sid: pending (4.3.3-3) [bugfix/all/xen-add-ring_copy_request.patch, bugfix/all/xen-netback-don-t-use-last-request-to-determine-mini.patch, bugfix/all/xen-netback-use-ring_copy_request-throughout.patch, bugfix/all/xen-blkback-only-read-request-operation-from-shared-.patch, bugfix/all/xen-blkback-read-from-indirect-descriptors-only-once.patch, bugfix/all/xen-scsiback-safely-copy-requests.patch, bugfix/all/xen-pciback-save-xen_pci_op-commands-before-processi.patch]
+3.16-jessie-security: needed
+3.2-wheezy-security: needed
+2.6.32-squeeze-security: ignored "Xen not supported in Squeeze LTS"

Added: active/CVE-2015-8551
===================================================================
--- active/CVE-2015-8551	                        (rev 0)
+++ active/CVE-2015-8551	2015-12-27 06:04:13 UTC (rev 4062)
@@ -0,0 +1,12 @@
+Description: Linux pciback missing sanity checks leading to crash
+References: http://xenbits.xen.org/xsa/advisory-157.html
+Notes: Same set of fixes as for CVE-2015-8552
+Bugs:
+upstream: released (4.4-rc6) [56441f3c8e5bd45aab10dd9f8c505dd4bec03b0d, 5e0ce1455c09dd61d029b8ad45d82e1ac0b6c4c9, a396f3a210c3a61e94d6b87ec05a75d0be2a60d0, 7cfb905b9638982862f0331b36ccaaca5d383b49, 408fb0e5aa7fda0059db282ff58c3b2a4278baa0]
+3.16-upstream-stable: needed
+3.2-upstream-stable: needed
+2.6.32-upstream-stable: N/A "Vulnerable code not present"
+sid: pending (4.3.3-3) [bugfix/all/xen-pciback-return-error-on-xen_pci_op_enable_msi-wh.patch, bugfix/all/xen-pciback-return-error-on-xen_pci_op_enable_msix-w.patch, bugfix/all/xen-pciback-do-not-install-an-irq-handler-for-msi-in.patch, bugfix/all/xen-pciback-for-xen_pci_op_disable_msi-x-only-disabl.patch, bugfix/all/xen-pciback-don-t-allow-msi-x-ops-if-pci_command_mem.patch]
+3.16-jessie-security: needed
+3.2-wheezy-security: needed
+2.6.32-squeeze-security: ignored "Xen not supported in Squeeze LTS"

Added: active/CVE-2015-8552
===================================================================
--- active/CVE-2015-8552	                        (rev 0)
+++ active/CVE-2015-8552	2015-12-27 06:04:13 UTC (rev 4062)
@@ -0,0 +1,12 @@
+Description: Linux pciback missing sanity checks leading to crash
+References: http://xenbits.xen.org/xsa/advisory-157.html
+Notes: Same set of fixes as for CVE-2015-8551
+Bugs:
+upstream: released (4.4-rc6) [56441f3c8e5bd45aab10dd9f8c505dd4bec03b0d, 5e0ce1455c09dd61d029b8ad45d82e1ac0b6c4c9, a396f3a210c3a61e94d6b87ec05a75d0be2a60d0, 7cfb905b9638982862f0331b36ccaaca5d383b49, 408fb0e5aa7fda0059db282ff58c3b2a4278baa0]
+3.16-upstream-stable: needed
+3.2-upstream-stable: needed
+2.6.32-upstream-stable: N/A "Vulnerable code not present"
+sid: pending (4.3.3-3) [bugfix/all/xen-pciback-return-error-on-xen_pci_op_enable_msi-wh.patch, bugfix/all/xen-pciback-return-error-on-xen_pci_op_enable_msix-w.patch, bugfix/all/xen-pciback-do-not-install-an-irq-handler-for-msi-in.patch, bugfix/all/xen-pciback-for-xen_pci_op_disable_msi-x-only-disabl.patch, bugfix/all/xen-pciback-don-t-allow-msi-x-ops-if-pci_command_mem.patch]
+3.16-jessie-security: needed
+3.2-wheezy-security: needed
+2.6.32-squeeze-security: ignored "Xen not supported in Squeeze LTS"