[kernel-sec-discuss] r5002 - active retired

[Ben Hutchings]

Author: benh
Date: 2017-02-23 22:24:06 +0000 (Thu, 23 Feb 2017)
New Revision: 5002

Added:
   retired/CVE-2014-9892
Removed:
   active/CVE-2014-9892
Log:
Explain why CVE-2014-9892 is bullshit, and retire it

Deleted: active/CVE-2014-9892
===================================================================
--- active/CVE-2014-9892	2017-02-23 21:55:28 UTC (rev 5001)
+++ active/CVE-2014-9892	2017-02-23 22:24:06 UTC (rev 5002)
@@ -1,14 +0,0 @@
-Description: 
-References:
- http://source.android.com/security/bulletin/2016-08-01.html
- https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=591b1f455c32206704cbcf426bb30911c260c33e 
-Notes:
- jmm> Fixed in Android 3.10 kernel, but unfixed in Linux mainline
-Bugs:
-upstream:
-4.9-upstream-stable:
-3.16-upstream-stable:
-3.2-upstream-stable:
-sid:
-3.16-jessie-security:
-3.2-wheezy-security:

Copied: retired/CVE-2014-9892 (from rev 5001, active/CVE-2014-9892)
===================================================================
--- retired/CVE-2014-9892	                        (rev 0)
+++ retired/CVE-2014-9892	2017-02-23 22:24:06 UTC (rev 5002)
@@ -0,0 +1,20 @@
+Description: [disputed] infoleak in ioctl(SNDRV_COMPRESS_TSTAMP)
+References:
+ http://source.android.com/security/bulletin/2016-08-01.html
+ https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=591b1f455c32206704cbcf426bb30911c260c33e 
+Notes:
+ jmm> Fixed in Android 3.10 kernel, but unfixed in Linux mainline
+ bwh> This doesn't make sense - there should be no padding in a
+ bwh> structure that has all 32-bit members, unless the natural
+ bwh> alignment is explicitly overridden.  I consider this invalid.
+ bwh> Additionally, snd_compr_tstamp and all the other sound
+ bwh> compression related structures now have their alignment
+ bwh> explicitly set to 4 to avoid compat issues on i386/amd64.
+Bugs:
+upstream: N/A "Invalid"
+4.9-upstream-stable: N/A "Invalid"
+3.16-upstream-stable: N/A "Invalid"
+3.2-upstream-stable: N/A "Supposedly vulnerable code not present"
+sid: N/A "Invalid"
+3.16-jessie-security: N/A "Invalid"
+3.2-wheezy-security: N/A "Supposedly vulnerable code not present"