[kernel-sec-discuss] r4115 - active retired

[Moritz Muehlenhoff]

Author: jmm
Date: 2016-01-25 17:16:52 +0000 (Mon, 25 Jan 2016)
New Revision: 4115

Added:
   retired/CVE-2015-7550
   retired/CVE-2015-8543
   retired/CVE-2015-8575
Removed:
   active/CVE-2015-7550
   active/CVE-2015-8543
   active/CVE-2015-8575
Log:
retire, these are fixed everywhere and pending for 2.6.32.x


Deleted: active/CVE-2015-7550
===================================================================
--- active/CVE-2015-7550	2016-01-25 08:04:35 UTC (rev 4114)
+++ active/CVE-2015-7550	2016-01-25 17:16:52 UTC (rev 4115)
@@ -1,12 +0,0 @@
-Description: Keyring subsystem race leads to null dereference
-References:
-Notes:
-Bugs:
-upstream: released (4.4-rc8) [b4a1b4f5047e4f54e194681125c74c0aa64d637d]
-3.16-upstream-stable: released (3.16.7-ckt22)
-3.2-upstream-stable: released (3.2.76) [keys-fix-race-between-read-and-revoke.patch]
-2.6.32-upstream-stable: pending (2.6.32.70)
-sid: released (4.3.3-3) [bugfix/all/keys-fix-race-between-read-and-revoke.patch]
-3.16-jessie-security: released (3.16.7-ckt20-1+deb8u2) [bugfix/all/keys-fix-race-between-read-and-revoke.patch]
-3.2-wheezy-security: released (3.2.73-2+deb7u2) [bugfix/all/keys-fix-race-between-read-and-revoke.patch]
-2.6.32-squeeze-security: released (2.6.32-48squeeze18) [bugfix/all/keys-fix-race-between-read-and-revoke.patch]

Deleted: active/CVE-2015-8543
===================================================================
--- active/CVE-2015-8543	2016-01-25 08:04:35 UTC (rev 4114)
+++ active/CVE-2015-8543	2016-01-25 17:16:52 UTC (rev 4115)
@@ -1,17 +0,0 @@
-Description: Connecting raw socket with invalid protocol number causes oops
-References:
- http://www.openwall.com/lists/oss-security/2015/12/09/3
- http://article.gmane.org/gmane.linux.network/391482
-Notes:
- bwh> Only exploitable with CAP_NET_RAW.  Since Linux 3.8 the capability
- bwh> checks use ns_capable() and containers can also exploit this.
- bwh> For earlier versions it's not important.
-Bugs:
-upstream: released (4.4-rc6) [79462ad02e861803b3840cc782248c7359451cd9]
-3.16-upstream-stable: released (3.16.7-ckt22)
-3.2-upstream-stable: released (3.2.75) [net-add-validation-for-the-socket-syscall-protocol-argument.patch]
-2.6.32-upstream-stable: pending (2.6.32.70)
-sid: released (4.3.3-1) [bugfix/all/net-add-validation-for-the-socket-syscall-protocol.patch]
-3.16-jessie-security: released (3.16.7-ckt20-1+deb8u1) [bugfix/all/net-add-validation-for-the-socket-syscall-protocol.patch]
-3.2-wheezy-security: released (3.2.73-2+deb7u2) [bugfix/all/net-add-validation-for-the-socket-syscall-protocol.patch]
-2.6.32-squeeze-security: released (2.6.32-48squeeze18) [bugfix/all/net-add-validation-for-the-socket-syscall-protocol.patch]

Deleted: active/CVE-2015-8575
===================================================================
--- active/CVE-2015-8575	2016-01-25 08:04:35 UTC (rev 4114)
+++ active/CVE-2015-8575	2016-01-25 17:16:52 UTC (rev 4115)
@@ -1,12 +0,0 @@
-Description: information leak from bluetooth/sco getsockname
-References:
-Notes:
-Bugs:
-upstream: released (4.4-rc6) [5233252fce714053f0151680933571a2da9cbfb4]
-3.16-upstream-stable: released (3.16.7-ckt22)
-3.2-upstream-stable: released (3.2.75) [bluetooth-validate-socket-address-length-in-sco_sock_bind.patch]
-2.6.32-upstream-stable: pending (2.6.32.70)
-sid: released (4.3.3-3) [bugfix/all/bluetooth-validate-socket-address-length-in-sco_sock.patch]
-3.16-jessie-security: released (3.16.7-ckt20-1+deb8u2) [bugfix/all/bluetooth-validate-socket-address-length-in-sco_sock.patch]
-3.2-wheezy-security: released (3.2.73-2+deb7u2) [bugfix/all/bluetooth-validate-socket-address-length-in-sco_sock.patch]
-2.6.32-squeeze-security: released (2.6.32-48squeeze18) [bugfix/all/bluetooth-validate-socket-address-length-in-sco_sock.patch]

Copied: retired/CVE-2015-7550 (from rev 4114, active/CVE-2015-7550)
===================================================================
--- retired/CVE-2015-7550	                        (rev 0)
+++ retired/CVE-2015-7550	2016-01-25 17:16:52 UTC (rev 4115)
@@ -0,0 +1,12 @@
+Description: Keyring subsystem race leads to null dereference
+References:
+Notes:
+Bugs:
+upstream: released (4.4-rc8) [b4a1b4f5047e4f54e194681125c74c0aa64d637d]
+3.16-upstream-stable: released (3.16.7-ckt22)
+3.2-upstream-stable: released (3.2.76) [keys-fix-race-between-read-and-revoke.patch]
+2.6.32-upstream-stable: pending (2.6.32.70)
+sid: released (4.3.3-3) [bugfix/all/keys-fix-race-between-read-and-revoke.patch]
+3.16-jessie-security: released (3.16.7-ckt20-1+deb8u2) [bugfix/all/keys-fix-race-between-read-and-revoke.patch]
+3.2-wheezy-security: released (3.2.73-2+deb7u2) [bugfix/all/keys-fix-race-between-read-and-revoke.patch]
+2.6.32-squeeze-security: released (2.6.32-48squeeze18) [bugfix/all/keys-fix-race-between-read-and-revoke.patch]

Copied: retired/CVE-2015-8543 (from rev 4114, active/CVE-2015-8543)
===================================================================
--- retired/CVE-2015-8543	                        (rev 0)
+++ retired/CVE-2015-8543	2016-01-25 17:16:52 UTC (rev 4115)
@@ -0,0 +1,17 @@
+Description: Connecting raw socket with invalid protocol number causes oops
+References:
+ http://www.openwall.com/lists/oss-security/2015/12/09/3
+ http://article.gmane.org/gmane.linux.network/391482
+Notes:
+ bwh> Only exploitable with CAP_NET_RAW.  Since Linux 3.8 the capability
+ bwh> checks use ns_capable() and containers can also exploit this.
+ bwh> For earlier versions it's not important.
+Bugs:
+upstream: released (4.4-rc6) [79462ad02e861803b3840cc782248c7359451cd9]
+3.16-upstream-stable: released (3.16.7-ckt22)
+3.2-upstream-stable: released (3.2.75) [net-add-validation-for-the-socket-syscall-protocol-argument.patch]
+2.6.32-upstream-stable: pending (2.6.32.70)
+sid: released (4.3.3-1) [bugfix/all/net-add-validation-for-the-socket-syscall-protocol.patch]
+3.16-jessie-security: released (3.16.7-ckt20-1+deb8u1) [bugfix/all/net-add-validation-for-the-socket-syscall-protocol.patch]
+3.2-wheezy-security: released (3.2.73-2+deb7u2) [bugfix/all/net-add-validation-for-the-socket-syscall-protocol.patch]
+2.6.32-squeeze-security: released (2.6.32-48squeeze18) [bugfix/all/net-add-validation-for-the-socket-syscall-protocol.patch]

Copied: retired/CVE-2015-8575 (from rev 4114, active/CVE-2015-8575)
===================================================================
--- retired/CVE-2015-8575	                        (rev 0)
+++ retired/CVE-2015-8575	2016-01-25 17:16:52 UTC (rev 4115)
@@ -0,0 +1,12 @@
+Description: information leak from bluetooth/sco getsockname
+References:
+Notes:
+Bugs:
+upstream: released (4.4-rc6) [5233252fce714053f0151680933571a2da9cbfb4]
+3.16-upstream-stable: released (3.16.7-ckt22)
+3.2-upstream-stable: released (3.2.75) [bluetooth-validate-socket-address-length-in-sco_sock_bind.patch]
+2.6.32-upstream-stable: pending (2.6.32.70)
+sid: released (4.3.3-3) [bugfix/all/bluetooth-validate-socket-address-length-in-sco_sock.patch]
+3.16-jessie-security: released (3.16.7-ckt20-1+deb8u2) [bugfix/all/bluetooth-validate-socket-address-length-in-sco_sock.patch]
+3.2-wheezy-security: released (3.2.73-2+deb7u2) [bugfix/all/bluetooth-validate-socket-address-length-in-sco_sock.patch]
+2.6.32-squeeze-security: released (2.6.32-48squeeze18) [bugfix/all/bluetooth-validate-socket-address-length-in-sco_sock.patch]