This bug was fixed in the package linux - 4.15.0-29.31 --------------- linux (4.15.0-29.31) bionic; urgency=medium
* linux: 4.15.0-29.31 -proposed tracker (LP: #1782173) * [SRU Bionic][Cosmic] kernel panic in ipmi_ssif at msg_done_handler (LP: #1777716) - ipmi_ssif: Fix kernel panic at msg_done_handler * Update to ocxl driver for 18.04.1 (LP: #1775786) - misc: ocxl: use put_device() instead of device_unregister() - powerpc: Add TIDR CPU feature for POWER9 - powerpc: Use TIDR CPU feature to control TIDR allocation - powerpc: use task_pid_nr() for TID allocation - ocxl: Rename pnv_ocxl_spa_remove_pe to clarify it's action - ocxl: Expose the thread_id needed for wait on POWER9 - ocxl: Add an IOCTL so userspace knows what OCXL features are available - ocxl: Document new OCXL IOCTLs - ocxl: Fix missing unlock on error in afu_ioctl_enable_p9_wait() * Critical upstream bugfix missing in Ubuntu 18.04 - frequent Xorg crash after suspend (LP: #1776887) - ocxl: Document the OCXL_IOCTL_GET_METADATA IOCTL * Hard LOCKUP observed on stressing Ubuntu 18 04 (LP: #1777194) - powerpc: use NMI IPI for smp_send_stop - powerpc: Fix smp_send_stop NMI IPI handling * IPL: ppc64_cpu --frequency hang with INFO: rcu_sched detected stalls on CPUs/tasks on w34 and wsbmc016 with 920.1714.20170330n (LP: #1773964) - rtc: opal: Fix OPAL RTC driver OPAL_BUSY loops * [Regression] EXT4-fs error (device sda2): ext4_validate_block_bitmap:383: comm stress-ng: bg 4705: bad block bitmap checksum (LP: #1781709) - SAUCE: Revert "UBUNTU: SAUCE: ext4: fix ext4_validate_inode_bitmap: comm stress-ng: Corrupt inode bitmap" - SAUCE: ext4: check for allocation block validity with block group locked linux (4.15.0-28.30) bionic; urgency=medium * linux: 4.15.0-28.30 -proposed tracker (LP: #1781433) * Cannot set MTU higher than 1500 in Xen instance (LP: #1781413) - xen-netfront: Fix mismatched rtnl_unlock - xen-netfront: Update features after registering netdev linux (4.15.0-27.29) bionic; urgency=medium * linux: 4.15.0-27.29 -proposed tracker (LP: #1781062) * [Regression] EXT4-fs error (device sda1): ext4_validate_inode_bitmap:99: comm stress-ng: Corrupt inode bitmap (LP: #1780137) - SAUCE: ext4: fix ext4_validate_inode_bitmap: comm stress-ng: Corrupt inode bitmap linux (4.15.0-26.28) bionic; urgency=medium * linux: 4.15.0-26.28 -proposed tracker (LP: #1780112) * failure to boot with linux-image-4.15.0-24-generic (LP: #1779827) // Cloud- init causes potentially huge boot delays with 4.15 kernels (LP: #1780062) - random: Make getrandom() ready earlier linux (4.15.0-25.27) bionic; urgency=medium * linux: 4.15.0-25.27 -proposed tracker (LP: #1779354) * hisi_sas_v3_hw: internal task abort: timeout and not done. (LP: #1777736) - scsi: hisi_sas: Update a couple of register settings for v3 hw * hisi_sas: Add missing PHY spinlock init (LP: #1777734) - scsi: hisi_sas: Add missing PHY spinlock init * hisi_sas: improve read performance by pre-allocating slot DMA buffers (LP: #1777727) - scsi: hisi_sas: use dma_zalloc_coherent() - scsi: hisi_sas: Use dmam_alloc_coherent() - scsi: hisi_sas: Pre-allocate slot DMA buffers * hisi_sas: Failures during host reset (LP: #1777696) - scsi: hisi_sas: Only process broadcast change in phy_bcast_v3_hw() - scsi: hisi_sas: Fix the conflict between dev gone and host reset - scsi: hisi_sas: Adjust task reject period during host reset - scsi: hisi_sas: Add a flag to filter PHY events during reset - scsi: hisi_sas: Release all remaining resources in clear nexus ha * Fake SAS addresses for SATA disks on HiSilicon D05 are non-unique (LP: #1776750) - scsi: hisi_sas: make SAS address of SATA disks unique * Vcs-Git header on bionic linux source package points to zesty git tree (LP: #1766055) - [Packaging]: Update Vcs-Git * large KVM instances run out of IRQ routes (LP: #1778261) - SAUCE: kvm -- increase KVM_MAX_IRQ_ROUTES to 2048 on x86 -- Stefan Bader <stefan.ba...@canonical.com> Tue, 17 Jul 2018 10:57:50 +0200 ** Changed in: linux (Ubuntu Cosmic) Status: Incomplete => Fix Released -- You received this bug notification because you are a member of नेपाली भाषा समायोजकहरुको समूह, which is subscribed to Xenial. Matching subscriptions: Ubuntu 16.04 Bugs https://bugs.launchpad.net/bugs/1775856 Title: register on binfmt_misc may overflow and crash the system Status in linux package in Ubuntu: Fix Released Status in linux source package in Precise: Incomplete Status in linux source package in Trusty: Fix Released Status in linux source package in Xenial: Fix Released Status in linux source package in Artful: Fix Released Status in linux source package in Bionic: Fix Released Status in linux source package in Cosmic: Fix Released Bug description: [Impact] When registering a new binfmt_misc handler, it is possible to overflow the offset to get a negative value, which might crash the system, or possibly leak kernel data. Here is a crash log when 2500000000 was used as an offset: BUG: unable to handle kernel paging request at ffff989cfd6edca0 IP: load_misc_binary+0x22b/0x470 [binfmt_misc] PGD 1ef3e067 P4D 1ef3e067 PUD 0 Oops: 0000 [#1] SMP NOPTI Modules linked in: binfmt_misc kvm_intel ppdev kvm irqbypass joydev input_leds serio_raw mac_hid parport_pc qemu_fw_cfg parpy CPU: 0 PID: 2499 Comm: bash Not tainted 4.15.0-22-generic #24-Ubuntu Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-1 04/01/2014 RIP: 0010:load_misc_binary+0x22b/0x470 [binfmt_misc] Call Trace: search_binary_handler+0x97/0x1d0 do_execveat_common.isra.34+0x667/0x810 SyS_execve+0x31/0x40 do_syscall_64+0x73/0x130 entry_SYSCALL_64_after_hwframe+0x3d/0xa2 Use kstrtoint instead of simple_strtoul. It will work as the code already set the delimiter byte to '\0' and we only do it when the field is not empty. [Test Case] Tested with offsets -1, 2500000000, UINT_MAX and INT_MAX. Also tested with examples documented at Documentation/admin-guide/binfmt-misc.rst and other registrations from packages on Ubuntu. [Regression] Fail to register valid types. This was tested with a bionic kernel with the patch. To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1775856/+subscriptions _______________________________________________ Mailing list: https://launchpad.net/~group.of.nepali.translators Post to : group.of.nepali.translators@lists.launchpad.net Unsubscribe : https://launchpad.net/~group.of.nepali.translators More help : https://help.launchpad.net/ListHelp