CVE-2013-0160

Priority
Low
Description
The Linux kernel through 3.7.9 allows local users to obtain sensitive
information about keystroke timing by using the inotify API on the
/dev/ptmx device.
References
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0160
http://www.openwall.com/lists/oss-security/2013/01/07
http://vladz.devzero.fr/013_ptmx-timing.php
http://grsecurity.net/~spender/sidechannel.diff
Bugs
https://bugzilla.novell.com/show_bug.cgi?id=797175
https://bugzilla.redhat.com/show_bug.cgi?id=892983
https://launchpad.net/bugs/1097680
Notes
apw> the spender sidechannel patch above may not be generally applicable
apw> but I include it for completeness.
henrix> commit b0de59b5733d18b0d1974a060860a8b5c1b36a2e is not sufficient to
henrix> fix the CVE because an application doesn't have to read atime/mtime
henrix> (as is the case for the PoC). The 2 additional commits fix a
henrix> regression and mark the shared ptmx node as un-notifiable (which will
henrix> cause additional problems to backport them to Lucid, as it doesn't have
henrix> this feature)
Package
Source: linux-armadaxp (LP Ubuntu Debian)
Upstream:released (3.10~rc1)
Ubuntu 10.04 LTS (Lucid Lynx):DNE
Ubuntu 12.04 LTS (Precise Pangolin):needed
Ubuntu 12.10 (Quantal Quetzal):needed
Ubuntu 13.04 (Raring Ringtail):DNE
Ubuntu 13.10 (Saucy Salamander):DNE
Package
Source: linux-ec2 (LP Ubuntu Debian)
Upstream:released (3.10~rc1)
Ubuntu 10.04 LTS (Lucid Lynx):needed
Ubuntu 12.04 LTS (Precise Pangolin):DNE
Ubuntu 12.10 (Quantal Quetzal):DNE
Ubuntu 13.04 (Raring Ringtail):DNE
Ubuntu 13.10 (Saucy Salamander):DNE
Package
Source: linux-lts-backport-oneiric (LP Ubuntu Debian)
Upstream:released (3.10~rc1)
Ubuntu 10.04 LTS (Lucid Lynx):ignored (reached end-of-life)
Ubuntu 12.04 LTS (Precise Pangolin):DNE
Ubuntu 12.10 (Quantal Quetzal):DNE
Ubuntu 13.04 (Raring Ringtail):DNE
Ubuntu 13.10 (Saucy Salamander):DNE
Package
Source: linux-linaro-shared (LP Ubuntu Debian)
Upstream:released (3.10~rc1)
Ubuntu 10.04 LTS (Lucid Lynx):DNE
Ubuntu 12.04 LTS (Precise Pangolin):ignored (abandoned)
Ubuntu 12.10 (Quantal Quetzal):ignored (abandoned)
Ubuntu 13.04 (Raring Ringtail):DNE
Ubuntu 13.10 (Saucy Salamander):DNE
Package
Source: linux-linaro-vexpress (LP Ubuntu Debian)
Upstream:released (3.10~rc1)
Ubuntu 10.04 LTS (Lucid Lynx):DNE
Ubuntu 12.04 LTS (Precise Pangolin):ignored (abandoned)
Ubuntu 12.10 (Quantal Quetzal):ignored (abandoned)
Ubuntu 13.04 (Raring Ringtail):DNE
Ubuntu 13.10 (Saucy Salamander):DNE
Package
Source: linux-qcm-msm (LP Ubuntu Debian)
Upstream:released (3.10~rc1)
Ubuntu 10.04 LTS (Lucid Lynx):ignored (abandoned)
Ubuntu 12.04 LTS (Precise Pangolin):ignored (abandoned)
Ubuntu 12.10 (Quantal Quetzal):ignored (abandoned)
Ubuntu 13.04 (Raring Ringtail):DNE
Ubuntu 13.10 (Saucy Salamander):DNE
Package
Source: linux-lts-quantal (LP Ubuntu Debian)
Upstream:released (3.10~rc1)
Ubuntu 10.04 LTS (Lucid Lynx):DNE
Ubuntu 12.04 LTS (Precise Pangolin):needed
Ubuntu 12.10 (Quantal Quetzal):DNE
Ubuntu 13.04 (Raring Ringtail):DNE
Ubuntu 13.10 (Saucy Salamander):DNE
Patches:
Package
Source: linux-mvl-dove (LP Ubuntu Debian)
Upstream:released (3.10~rc1)
Ubuntu 10.04 LTS (Lucid Lynx):ignored (reached end-of-life)
Ubuntu 12.04 LTS (Precise Pangolin):DNE
Ubuntu 12.10 (Quantal Quetzal):DNE
Ubuntu 13.04 (Raring Ringtail):DNE
Ubuntu 13.10 (Saucy Salamander):DNE
Package
Source: linux-lts-backport-maverick (LP Ubuntu Debian)
Upstream:released (3.10~rc1)
Ubuntu 10.04 LTS (Lucid Lynx):ignored (reached end-of-life)
Ubuntu 12.04 LTS (Precise Pangolin):DNE
Ubuntu 12.10 (Quantal Quetzal):DNE
Ubuntu 13.04 (Raring Ringtail):DNE
Ubuntu 13.10 (Saucy Salamander):DNE
Package
Source: linux (LP Ubuntu Debian)
Upstream:released (3.10~rc1)
Ubuntu 10.04 LTS (Lucid Lynx):needed
Ubuntu 12.04 LTS (Precise Pangolin):needed
Ubuntu 12.10 (Quantal Quetzal):needed
Ubuntu 13.04 (Raring Ringtail):not-affected (3.8.0-18.28)
Ubuntu 13.10 (Saucy Salamander):not-affected (3.8.0-18.28)
Patches:
Introduced by 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2Fixed by b0de59b5733d18b0d1974a060860a8b5c1b36a2e
Introduced by 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2Fixed by 37b7f3c76595e23257f61bd80b223de8658617ee
Introduced by 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2Fixed by b0b885657b6c8ef63a46bc9299b2a7715d19acde
Package
Source: linux-ti-omap4 (LP Ubuntu Debian)
Upstream:released (3.10~rc1)
Ubuntu 10.04 LTS (Lucid Lynx):DNE
Ubuntu 12.04 LTS (Precise Pangolin):needed
Ubuntu 12.10 (Quantal Quetzal):needed
Ubuntu 13.04 (Raring Ringtail):needed
Ubuntu 13.10 (Saucy Salamander):needed
Package
Source: linux-linaro-omap (LP Ubuntu Debian)
Upstream:released (3.10~rc1)
Ubuntu 10.04 LTS (Lucid Lynx):DNE
Ubuntu 12.04 LTS (Precise Pangolin):ignored (abandoned)
Ubuntu 12.10 (Quantal Quetzal):ignored (abandoned)
Ubuntu 13.04 (Raring Ringtail):DNE
Ubuntu 13.10 (Saucy Salamander):DNE
Package
Source: linux-fsl-imx51 (LP Ubuntu Debian)
Upstream:released (3.10~rc1)
Ubuntu 10.04 LTS (Lucid Lynx):ignored (reached end-of-life, does not affect buildd)
Ubuntu 12.04 LTS (Precise Pangolin):DNE
Ubuntu 12.10 (Quantal Quetzal):DNE
Ubuntu 13.04 (Raring Ringtail):DNE
Ubuntu 13.10 (Saucy Salamander):DNE
Package
Source: linux-lts-raring (LP Ubuntu Debian)
Upstream:released (3.10~rc1)
Ubuntu 10.04 LTS (Lucid Lynx):DNE
Ubuntu 12.04 LTS (Precise Pangolin):not-affected
Ubuntu 12.10 (Quantal Quetzal):DNE
Ubuntu 13.04 (Raring Ringtail):DNE
Ubuntu 13.10 (Saucy Salamander):DNE
More Information

Valid XHTML 1.0 Strict

Updated: 2013-05-22 14:15:09 UTC (commit 6866)