CVE-2014-4611

Published: 3 July 2014

Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4_uncompress function in lib/lz4/lz4_decompress.c in the Linux kernel before 3.15.2, on 32-bit platforms might allow context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted Literal Run that would be improperly handled by programs not complying with an API limitation, a different vulnerability than CVE-2014-4715.

From the Ubuntu Security Team

Don Bailey and Ludvig Strigeus discovered an integer overflow in the Linux kernel's implementation of the LZ4 decompression algorithm, when used by code not complying with API limitations. An attacker could exploit this flaw to cause a denial of service (memory corruption) or possibly other unspecified impact.

Notes

android kernels (goldfish, grouper, maguro, mako and manta) are not
supported on the Ubuntu Touch 13.10 preview kernels
android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.04 preview kernels

commented out the packages that are old so we can have this CVE in
active/ again.

Status

References

• https://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.html
• https://fastcompression.blogspot.ca/2014/06/debunking-lz4-20-years-old-bug-myth.html
• https://ubuntu.com/security/notices/USN-2287-1
• https://ubuntu.com/security/notices/USN-2288-1
• https://ubuntu.com/security/notices/USN-2289-1
• https://ubuntu.com/security/notices/USN-2290-1
• https://www.cve.org/CVERecord?id=CVE-2014-4611
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1335314