** Description changed: - The camera post processing engine (CPP) and video processing engine - (VPE) provide an ioctl system call interface to user space clients for - communication. When processing arguments passed to the - VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO or - VIDIOC_MSM_VPE_DEQUEUE_STREAM_BUFF_INFO ioctl subdev handlers, a user - space supplied length value is used to copy memory to a local stack - buffer without proper bounds checking. An application with access to the - respective device nodes can use this flaw to, e.g., elevate privileges. + Multiple stack-based buffer overflows in the MSM camera driver for the + Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android + contributions for MSM devices and other products, allow attackers to gain + privileges via (1) a crafted VIDIOC_MSM_VPE_DEQUEUE_STREAM_BUFF_INFO ioctl + call, related to drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.c, + or (2) a crafted VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO ioctl call, + related to drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c. Break-Fix: - c9c81836ee44db9974007d34cf2aaeb1a51a8d45 Break-Fix: - 28385b9c3054c91dca1aa194ffa750550c50f3ce
-- You received this bug notification because you are a member of Kernel Packages, which is subscribed to linux-armadaxp in Ubuntu. https://bugs.launchpad.net/bugs/1244800 Title: CVE-2013-4738 Status in linux package in Ubuntu: Invalid Status in linux-armadaxp package in Ubuntu: Invalid Status in linux-ec2 package in Ubuntu: Invalid Status in linux-fsl-imx51 package in Ubuntu: Invalid Status in linux-lts-backport-maverick package in Ubuntu: Won't Fix Status in linux-lts-backport-natty package in Ubuntu: Won't Fix Status in linux-lts-quantal package in Ubuntu: Invalid Status in linux-lts-raring package in Ubuntu: Invalid Status in linux-mvl-dove package in Ubuntu: Invalid Status in linux-ti-omap4 package in Ubuntu: Invalid Status in linux source package in Lucid: New Status in linux-armadaxp source package in Lucid: Invalid Status in linux-ec2 source package in Lucid: New Status in linux-fsl-imx51 source package in Lucid: Invalid Status in linux-lts-backport-maverick source package in Lucid: Won't Fix Status in linux-lts-backport-natty source package in Lucid: Won't Fix Status in linux-lts-quantal source package in Lucid: Invalid Status in linux-lts-raring source package in Lucid: Invalid Status in linux-mvl-dove source package in Lucid: Invalid Status in linux-ti-omap4 source package in Lucid: Invalid Status in linux source package in Precise: New Status in linux-armadaxp source package in Precise: New Status in linux-ec2 source package in Precise: Invalid Status in linux-fsl-imx51 source package in Precise: Invalid Status in linux-lts-backport-maverick source package in Precise: Won't Fix Status in linux-lts-backport-natty source package in Precise: Won't Fix Status in linux-lts-quantal source package in Precise: Invalid Status in linux-lts-raring source package in Precise: Won't Fix Status in linux-mvl-dove source package in Precise: Invalid Status in linux-ti-omap4 source package in Precise: New Status in linux source package in Quantal: Won't Fix Status in linux-armadaxp source package in Quantal: Won't Fix Status in linux-ec2 source package in Quantal: Invalid Status in linux-fsl-imx51 source package in Quantal: Invalid Status in linux-lts-backport-maverick source package in Quantal: Won't Fix Status in linux-lts-backport-natty source package in Quantal: Won't Fix Status in linux-lts-quantal source package in Quantal: Invalid Status in linux-lts-raring source package in Quantal: Invalid Status in linux-mvl-dove source package in Quantal: Invalid Status in linux-ti-omap4 source package in Quantal: Won't Fix Status in linux source package in Raring: Won't Fix Status in linux-armadaxp source package in Raring: Invalid Status in linux-ec2 source package in Raring: Invalid Status in linux-fsl-imx51 source package in Raring: Invalid Status in linux-lts-backport-maverick source package in Raring: Won't Fix Status in linux-lts-backport-natty source package in Raring: Won't Fix Status in linux-lts-quantal source package in Raring: Invalid Status in linux-lts-raring source package in Raring: Invalid Status in linux-mvl-dove source package in Raring: Invalid Status in linux-ti-omap4 source package in Raring: Won't Fix Status in linux source package in Saucy: Won't Fix Status in linux-armadaxp source package in Saucy: Invalid Status in linux-ec2 source package in Saucy: Invalid Status in linux-fsl-imx51 source package in Saucy: Invalid Status in linux-lts-backport-maverick source package in Saucy: Won't Fix Status in linux-lts-backport-natty source package in Saucy: Won't Fix Status in linux-lts-quantal source package in Saucy: Invalid Status in linux-lts-raring source package in Saucy: Invalid Status in linux-mvl-dove source package in Saucy: Invalid Status in linux-ti-omap4 source package in Saucy: Won't Fix Status in linux source package in Trusty: Invalid Status in linux-armadaxp source package in Trusty: Invalid Status in linux-ec2 source package in Trusty: Invalid Status in linux-fsl-imx51 source package in Trusty: Invalid Status in linux-lts-backport-maverick source package in Trusty: Won't Fix Status in linux-lts-backport-natty source package in Trusty: Won't Fix Status in linux-lts-quantal source package in Trusty: Invalid Status in linux-lts-raring source package in Trusty: Invalid Status in linux-mvl-dove source package in Trusty: Invalid Status in linux-ti-omap4 source package in Trusty: Invalid Bug description: Multiple stack-based buffer overflows in the MSM camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allow attackers to gain privileges via (1) a crafted VIDIOC_MSM_VPE_DEQUEUE_STREAM_BUFF_INFO ioctl call, related to drivers/media/platform/msm/camera_v2/pproc/vpe/msm_vpe.c, or (2) a crafted VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO ioctl call, related to drivers/media/platform/msm/camera_v2/pproc/cpp/msm_cpp.c. Break-Fix: - c9c81836ee44db9974007d34cf2aaeb1a51a8d45 Break-Fix: - 28385b9c3054c91dca1aa194ffa750550c50f3ce To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1244800/+subscriptions -- Mailing list: https://launchpad.net/~kernel-packages Post to : kernel-packages@lists.launchpad.net Unsubscribe : https://launchpad.net/~kernel-packages More help : https://help.launchpad.net/ListHelp
