CVE-2014-4171

Published: 23 June 2014

mm/shmem.c in the Linux kernel through 3.15.1 does not properly implement the interaction between range notification and hole punching, which allows local users to cause a denial of service (i_mutex hold) by using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADV_REMOVE madvise call or (2) an FALLOC_FL_PUNCH_HOLE fallocate call.

From the Ubuntu Security Team

Sasha Levin reported an issue with the Linux kernel's shared memory subsystem when used with range notifications and hole punching. A local user could exploit this flaw to cause a denial of service.

Notes

android kernels (goldfish, grouper, maguro, mako and manta) are not
supported on the Ubuntu Touch 13.10 preview kernels
android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.04 preview kernels

discussion on stable kernels backport is still on-going, as the
fix is likely to be different.

the break-fix is likely wrong now as they are reverting this commit in favour
of some other combo as well: break-fix: - f00cdc6df7d7cfcabb5b740911e6788cb0802bdb

linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4171
• http://ozlabs.org/~akpm/mmots/broken-out/shmem-fix-faulting-into-a-hole-while-its-punched.patch
• https://lkml.org/lkml/2014/7/2/518
• https://ubuntu.com/security/notices/USN-2334-1
• https://ubuntu.com/security/notices/USN-2335-1
• https://ubuntu.com/security/notices/USN-2336-1
• https://ubuntu.com/security/notices/USN-2337-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1333617