From patchwork Fri Nov 9 14:33:24 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kleber Sacilotto de Souza X-Patchwork-Id: 995573 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: ozlabs.org; dmarc=fail (p=none dis=none) header.from=canonical.com Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 42s2hQ6xgGz9s3C; Sat, 10 Nov 2018 01:33:42 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1gL7qo-0001F6-8M; Fri, 09 Nov 2018 14:33:34 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by huckleberry.canonical.com with esmtps (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:128) (Exim 4.86_2) (envelope-from ) id 1gL7ql-0001E5-Ka for kernel-team@lists.ubuntu.com; Fri, 09 Nov 2018 14:33:31 +0000 Received: from mail-wr1-f69.google.com ([209.85.221.69]) by youngberry.canonical.com with esmtps (TLS1.0:RSA_AES_128_CBC_SHA1:16) (Exim 4.76) (envelope-from ) id 1gL7ql-00068c-D8 for kernel-team@lists.ubuntu.com; Fri, 09 Nov 2018 14:33:31 +0000 Received: by mail-wr1-f69.google.com with SMTP id c16-v6so1666813wrr.8 for ; Fri, 09 Nov 2018 06:33:31 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:subject:date:message-id; bh=YtqXNgrcaLbtEWV3mnx/JLqnVqLfDF4IDpgS4YZyzv8=; b=akMl5B0E5tiY5R0s9VzHwnsQbRgyIk5ezDHAaCOMylhgXMjlyZ+cAZcz2q/dw4ubth iauWocB5pV/9vDiwcfz+sVaT8TQvQB0qyTj1dPSTj95jxc19CFZvRP8T2x5TFlClXMlW zrIwC05mqWTwd8tLmuf0PEx56Ucgk15NeYcu1S6BIjW1EEowMHC0KmizOTENizG3AP+i JzNJTg8qt1lgUDsVLz9EQXMoDDfs+Kg4bWARkQ1ssyb6rwB0Ug8ApS2aHMJaiE26tKR+ aU9OeM8gQVs4Q8ZXpmo2/XKx3jtB9ji0xcv1Vo2umeohSyexuki3CYdtwmnKmJ1VZZIB RYuA== X-Gm-Message-State: AGRZ1gL1RZ62vytBJMODrDSpY+ngJKwH1gnBjcbqONL0dlVvhvvgMi+O E4WrKBn12G7Q/l5Ay4Wdp0RCOkBy3rlMGNraFJHzcx5p5Ln7+gGsHCbfv2LgUYcB79XWPDxqF37 zm1U+Cu9sx24bnSKxBPW0i0b4KBCof2SCDRl8Fv65oQ== X-Received: by 2002:a1c:ae0a:: with SMTP id x10-v6mr5089034wme.137.1541774010735; Fri, 09 Nov 2018 06:33:30 -0800 (PST) X-Google-Smtp-Source: AJdET5dIy9B5uk1nRsd4NQZ2Zs65W17bh3OHc45SjIX6GaKKEfLSJwHemUM5BYAf6yYIH7vzVQOQow== X-Received: by 2002:a1c:ae0a:: with SMTP id x10-v6mr5089012wme.137.1541774010333; Fri, 09 Nov 2018 06:33:30 -0800 (PST) Received: from localhost ([2a02:8109:98c0:1604:d18b:fdaf:4fb2:4856]) by smtp.gmail.com with ESMTPSA id k5-v6sm10548118wre.82.2018.11.09.06.33.29 for (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Fri, 09 Nov 2018 06:33:29 -0800 (PST) From: Kleber Sacilotto de Souza To: kernel-team@lists.ubuntu.com Subject: [SRU][Trusty][Bionic][PATCH 0/1] Fix for CVE-2018-16276 Date: Fri, 9 Nov 2018 15:33:24 +0100 Message-Id: <20181109143326.31048-1-kleber.souza@canonical.com> X-Mailer: git-send-email 2.17.1 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" https://people.canonical.com/~ubuntu-security/cve/2018/CVE-2018-16276.html It was discovered that the YUREX USB device driver for the Linux kernel did not properly restrict user space reads or writes. A physically proximate attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code. Clean cherry-pick for Bionic, simple backport for Trusty only for context adjustment. Jann Horn (1): USB: yurex: fix out-of-bounds uaccess in read handler drivers/usb/misc/yurex.c | 23 ++++++----------------- 1 file changed, 6 insertions(+), 17 deletions(-) Acked-by: Khalid Elmously