CVE-2014-4608
Published: 3 July 2014
** DISPUTED ** Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel before 3.15.2 allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run. NOTE: the author of the LZO algorithms says "the Linux kernel is *not* affected; media hype."
From the Ubuntu Security Team
Don Bailey discovered a flaw in the LZO decompress algorithm used by the Linux kernel. An attacker could exploit this flaw to cause a denial of service (memory corruption or OOPS).
Notes
Author | Note |
---|---|
jdstrand |
android kernels (goldfish, grouper, maguro, mako and manta) are not supported on the Ubuntu Touch 13.10 preview kernels android kernels (flo, goldfish, grouper, maguro, mako and manta) are not supported on the Ubuntu Touch 14.04 preview kernels |
jj |
206a81c18401c0cde6e579164f752c4b147324ce original commit was incomplete reverted by af958a38a60c7ca3d8a39c918c1baa2ff7b6b233 and replaced by 72cf90124e87d975d0b2114d930808c58b4c05e4, cause of -2 USN update |
Priority
Status
Package | Release | Status |
---|---|---|
linux
Launchpad, Ubuntu, Debian |
lucid |
Released
(2.6.32-68.135)
|
precise |
Released
(3.2.0-72.107)
|
|
saucy |
Released
(3.11.0-26.45)
|
|
trusty |
Released
(3.13.0-40.69)
|
|
upstream |
Released
(3.18~rc1)
|
|
utopic |
Released
(3.16.0-25.33)
|
|
vivid |
Not vulnerable
(3.16.0-25.33)
|
|
wily |
Not vulnerable
(3.19.0-15.15)
|
|
xenial |
Not vulnerable
(4.2.0-16.19)
|
|
yakkety |
Not vulnerable
(4.4.0-21.37)
|
|
zesty |
Not vulnerable
(4.8.0-22.24)
|
|
Patches:
Introduced by
64c70b1cf43de158282bc1675918d503e5b15cc1
Introduced by
64c70b1cf43de158282bc1675918d503e5b15cc1
|
||
linux-armadaxp
Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Released
(3.2.0-1641.59)
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.18~rc1)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
This package is not directly supported by the Ubuntu Security Team | ||
linux-aws
Launchpad, Ubuntu, Debian |
precise |
Does not exist
|
trusty |
Not vulnerable
(4.4.0-1002.2)
|
|
upstream |
Released
(3.18~rc1)
|
|
xenial |
Not vulnerable
(4.4.0-1001.10)
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
linux-ec2
Launchpad, Ubuntu, Debian |
lucid |
Released
(2.6.32-372.89)
|
precise |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.18~rc1)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
linux-flo
Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
(trusty was ignored)
|
|
upstream |
Released
(3.18~rc1)
|
|
utopic |
Ignored
(end of life)
|
|
vivid |
Ignored
(end of life)
|
|
wily |
Ignored
(end of life)
|
|
xenial |
Ignored
(abandoned)
|
|
yakkety |
Ignored
(end of life)
|
|
zesty |
Does not exist
|
|
linux-fsl-imx51
Launchpad, Ubuntu, Debian |
lucid |
Ignored
(end of life)
|
precise |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.18~rc1)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
linux-gke
Launchpad, Ubuntu, Debian |
precise |
Does not exist
|
trusty |
Does not exist
|
|
upstream |
Released
(3.18~rc1)
|
|
xenial |
Not vulnerable
(4.4.0-1003.3)
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
linux-goldfish
Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
saucy |
Ignored
|
|
trusty |
Does not exist
(trusty was ignored)
|
|
upstream |
Released
(3.18~rc1)
|
|
utopic |
Ignored
(end of life)
|
|
vivid |
Ignored
(end of life)
|
|
wily |
Ignored
(end of life)
|
|
xenial |
Ignored
(abandoned)
|
|
yakkety |
Ignored
(end of life)
|
|
zesty |
Ignored
(end of life)
|
|
linux-grouper
Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
saucy |
Ignored
|
|
trusty |
Does not exist
(trusty was ignored)
|
|
upstream |
Released
(3.18~rc1)
|
|
utopic |
Ignored
(end of life)
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
linux-hwe
Launchpad, Ubuntu, Debian |
precise |
Does not exist
|
trusty |
Does not exist
|
|
upstream |
Released
(3.18~rc1)
|
|
xenial |
Not vulnerable
(4.8.0-36.36~16.04.1)
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
linux-hwe-edge
Launchpad, Ubuntu, Debian |
precise |
Does not exist
|
trusty |
Does not exist
|
|
upstream |
Released
(3.18~rc1)
|
|
xenial |
Not vulnerable
(4.8.0-36.36~16.04.1)
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
linux-linaro-omap
Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Ignored
(end of life)
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.18~rc1)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
linux-linaro-shared
Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Ignored
(end of life)
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.18~rc1)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
linux-linaro-vexpress
Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Ignored
(end of life)
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.18~rc1)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
linux-lts-quantal
Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Ignored
(end of life, was pending)
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.18~rc1)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
linux-lts-raring
Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Released
(3.8.0-44.66~precise1)
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.18~rc1)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
linux-lts-saucy
Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Ignored
(end of life, was pending)
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.18~rc1)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
linux-lts-trusty
Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Released
(3.13.0-40.69~precise1)
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.18~rc1)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
linux-lts-utopic
Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
trusty |
Does not exist
(trusty was not-affected [3.16.0-25.33~14.04.2])
|
|
upstream |
Released
(3.18~rc1)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
linux-lts-vivid
Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
trusty |
Does not exist
(trusty was not-affected [3.19.0-18.18~14.04.1])
|
|
upstream |
Released
(3.18~rc1)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
linux-lts-wily
Launchpad, Ubuntu, Debian |
precise |
Does not exist
|
trusty |
Does not exist
(trusty was not-affected [4.2.0-18.22~14.04.1])
|
|
upstream |
Released
(3.18~rc1)
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
linux-lts-xenial
Launchpad, Ubuntu, Debian |
precise |
Does not exist
|
trusty |
Not vulnerable
(4.4.0-13.29~14.04.1)
|
|
upstream |
Released
(3.18~rc1)
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
linux-maguro
Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
saucy |
Ignored
|
|
trusty |
Does not exist
(trusty was ignored)
|
|
upstream |
Released
(3.18~rc1)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
linux-mako
Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
saucy |
Ignored
|
|
trusty |
Does not exist
(trusty was ignored)
|
|
upstream |
Released
(3.18~rc1)
|
|
utopic |
Ignored
(end of life)
|
|
vivid |
Ignored
(end of life)
|
|
wily |
Ignored
(end of life)
|
|
xenial |
Ignored
(abandoned)
|
|
yakkety |
Ignored
(end of life)
|
|
zesty |
Does not exist
|
|
linux-manta
Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
saucy |
Ignored
|
|
trusty |
Does not exist
(trusty was ignored)
|
|
upstream |
Released
(3.18~rc1)
|
|
utopic |
Ignored
(end of life)
|
|
vivid |
Ignored
(end of life)
|
|
wily |
Ignored
(end of life)
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
linux-mvl-dove
Launchpad, Ubuntu, Debian |
lucid |
Ignored
(end of life)
|
precise |
Does not exist
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.18~rc1)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
linux-qcm-msm
Launchpad, Ubuntu, Debian |
lucid |
Ignored
(end of life)
|
precise |
Ignored
(end of life)
|
|
saucy |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.18~rc1)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
|
linux-raspi2
Launchpad, Ubuntu, Debian |
precise |
Does not exist
|
trusty |
Does not exist
|
|
upstream |
Released
(3.18~rc1)
|
|
vivid |
Does not exist
|
|
wily |
Not vulnerable
(4.2.0-1008.12)
|
|
xenial |
Not vulnerable
(4.2.0-1013.19)
|
|
yakkety |
Not vulnerable
(4.4.0-1009.10)
|
|
zesty |
Not vulnerable
(4.8.0-1013.15)
|
|
linux-snapdragon
Launchpad, Ubuntu, Debian |
precise |
Does not exist
|
trusty |
Does not exist
|
|
upstream |
Released
(3.18~rc1)
|
|
wily |
Does not exist
|
|
xenial |
Not vulnerable
(4.4.0-1012.12)
|
|
yakkety |
Not vulnerable
(4.4.0-1012.12)
|
|
zesty |
Not vulnerable
(4.4.0-1029.32)
|
|
linux-ti-omap4
Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Released
(3.2.0-1456.76)
|
|
saucy |
Ignored
(end of life)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.18~rc1)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
xenial |
Does not exist
|
|
yakkety |
Does not exist
|
|
zesty |
Does not exist
|
References
- https://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html
- https://fastcompression.blogspot.ca/2014/06/debunking-lz4-20-years-old-bug-myth.html
- https://ubuntu.com/security/notices/USN-2281-1
- https://ubuntu.com/security/notices/USN-2282-1
- https://ubuntu.com/security/notices/USN-2283-1
- https://ubuntu.com/security/notices/USN-2284-1
- https://ubuntu.com/security/notices/USN-2285-1
- https://ubuntu.com/security/notices/USN-2286-1
- https://ubuntu.com/security/notices/USN-2287-1
- https://ubuntu.com/security/notices/USN-2288-1
- https://ubuntu.com/security/notices/USN-2289-1
- https://ubuntu.com/security/notices/USN-2290-1
- https://ubuntu.com/security/notices/USN-2416-1
- https://ubuntu.com/security/notices/USN-2417-1
- https://ubuntu.com/security/notices/USN-2418-1
- https://ubuntu.com/security/notices/USN-2419-1
- https://ubuntu.com/security/notices/USN-2420-1
- https://ubuntu.com/security/notices/USN-2421-1
- https://ubuntu.com/security/notices/USN-2415-1
- https://www.cve.org/CVERecord?id=CVE-2014-4608
- NVD
- Launchpad
- Debian