| Message ID | 20190830001351.3686-1-connor.kuehl@canonical.com |
|---|---|
| Headers | show |
| Series | Fixes for CVE-2019-15117 & CVE-2019-15118 | expand |
On Thu, Aug 29, 2019 at 05:13:47PM -0700, Connor Kuehl wrote: > CVE-2019-15117: > > https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-15117.html > > "parse_audio_mixer_unit in sound/usb/mixer.c in the Linux kernel through > 5.2.9 mishandles a short descriptor, leading to out-of-bounds memory > access." > > Clean cherry-pick for Disco and Eoan. > > Xenial/Bionic required backporting, but those notes are in the patch > provenance. > > CVE-2019-15118: > > https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-15118.html > > "check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 > mishandles recursion, leading to kernel stack exhaustion." > > Clean cherry-pick for Disco and Eoan. > > Xenial/Bionic required backporting, but those notes are in the patch > provenance. Acked-by: Seth Forshee <seth.forshee@canonical.com> Applied to eoan/master-next, thanks!
On 8/30/19 2:13 AM, Connor Kuehl wrote: > CVE-2019-15117: > > https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-15117.html > > "parse_audio_mixer_unit in sound/usb/mixer.c in the Linux kernel through > 5.2.9 mishandles a short descriptor, leading to out-of-bounds memory > access." > > Clean cherry-pick for Disco and Eoan. > > Xenial/Bionic required backporting, but those notes are in the patch > provenance. > > CVE-2019-15118: > > https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-15118.html > > "check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 > mishandles recursion, leading to kernel stack exhaustion." > > Clean cherry-pick for Disco and Eoan. > > Xenial/Bionic required backporting, but those notes are in the patch > provenance. > Pinging this for X/B/D.
On 2019-08-29 17:13:47, Connor Kuehl wrote: > CVE-2019-15117: > > https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-15117.html > > "parse_audio_mixer_unit in sound/usb/mixer.c in the Linux kernel through > 5.2.9 mishandles a short descriptor, leading to out-of-bounds memory > access." > > Clean cherry-pick for Disco and Eoan. > > Xenial/Bionic required backporting, but those notes are in the patch > provenance. > > CVE-2019-15118: > > https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-15118.html > > "check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 > mishandles recursion, leading to kernel stack exhaustion." > > Clean cherry-pick for Disco and Eoan. > > Xenial/Bionic required backporting, but those notes are in the patch > provenance. For Xenial and Bionic: Acked-by: Tyler Hicks <tyhicks@canonical.com> Disco has since picked up the fixes via upstream linux-stable. The fixes are present in 5.0.0-30.32, currently in disco-proposed, so there's no longer a need to apply these to Disco. Tyler > > -- > 2.17.1 > > > -- > kernel-team mailing list > kernel-team@lists.ubuntu.com > https://lists.ubuntu.com/mailman/listinfo/kernel-team
On 30.08.19 02:13, Connor Kuehl wrote: > CVE-2019-15117: > > https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-15117.html > > "parse_audio_mixer_unit in sound/usb/mixer.c in the Linux kernel through > 5.2.9 mishandles a short descriptor, leading to out-of-bounds memory > access." > > Clean cherry-pick for Disco and Eoan. > > Xenial/Bionic required backporting, but those notes are in the patch > provenance. > > CVE-2019-15118: > > https://people.canonical.com/~ubuntu-security/cve/2019/CVE-2019-15118.html > > "check_input_term in sound/usb/mixer.c in the Linux kernel through 5.2.9 > mishandles recursion, leading to kernel stack exhaustion." > > Clean cherry-pick for Disco and Eoan. > > Xenial/Bionic required backporting, but those notes are in the patch > provenance. > As mentioned by Tyler, these fixes had already been applied to Disco. For Xenial and Bionic they have been applied as well as stable update to 4.4.191 and stable patchset 2019-09-09 for Bionic. Thanks, Kleber