Bug#332587: marked as done (linux-2.6: [CAN-2005-3055] Oops while completing async USB via usbdevio)

[owner@bugs.debian.org (Debian Bug Tracking System)]

Your message dated Mon, 13 Feb 2006 18:11:02 -0500
with message-id <43F11206.5070104@vif.com>
and subject line Fixed
has caused the attached Bug report to be marked as done.

This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.

(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere.  Please contact me immediately.)

Debian bug tracking system administrator
(administrator, Debian Bugs database)

--- Begin Message ---

• To: Debian Bug Tracking System <submit@bugs.debian.org>
• Subject: linux-2.6: [CAN-2005-3055] Oops while completing async USB via usbdevio
• From: Horms <horms@debian.org>
• Date: Fri, 07 Oct 2005 17:12:45 +0900
• Message-id: <E1ENnLR-0007iE-00@tabatha.lab.ultramonkey.org>

Package: linux-2.6
Severity: normal
Tags: upstream security


>From CAN-2005-3055:

Linux kernel 2.6.8 to 2.6.14-rc2 allows local users to cause a denial
of service (kernel OOPS) via a userspace process that issues a USB
Request Block (URB) to a USB device and terminates before the URB is
finished, which leads to a stale pointer reference.

References: 
  [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-3055
  [2] http://marc.theaimsgroup.com/?l=linux-kernel&m=112766129313883
  [3] http://lkml.org/lkml/2005/9/30/218

I believe that the 2.6.12 and 2.6.13 kernels have this problem.
2.6.8 and 2.4.27 do not seem to have it as the driver is missing.

Upstream do not seem to have a solution (See [3] above) yet, 
but I expect it will show up in 2.6-stable when they do.

-- System Information:
Debian Release: testing/unstable
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)
Shell:  /bin/sh linked to /bin/bash
Kernel: Linux 2.6.12-1-686-smp
Locale: LANG=ja_JP.eucJP, LC_CTYPE=ja_JP.eucJP (charmap=EUC-JP) (ignored: LC_ALL set to ja_JP.eucJP)

--- End Message ---

--- Begin Message ---

• To: 330287-done@bugs.debian.org
• Subject: Fixed
• From: Filipus Klutiero <ido@vif.com>
• Date: Mon, 13 Feb 2006 18:11:02 -0500
• Message-id: <43F11206.5070104@vif.com>

Version: 2.6.14-1

The upstream fix for this is mentionned in the changelog as [PATCH] Fix signal sending in usbdevio on async URB completion

--- End Message ---