Bra podcast
Sveriges mest populära poddar
- Affärsnyheter
- Alternativ hälsa
- Amerikansk fotboll
- Andlighet
- Animering och manga
- Astronomi
- Barn och familj
- Basket
- Berättelser för barn
- Böcker
- Buddhism
- Dagliga nyheter
- Dans och teater
- Design
- Djur
- Dokumentär
- Drama
- Efterprogram
- Entreprenörskap
- Fantasysporter
- Filmhistoria
- Filmintervjuer
- Filmrecensioner
- Filosofi
- Flyg
- Föräldraskap
- Fordon
- Fotboll
- Fritid
- Fysik
- Geovetenskap
- Golf
- Hälsa och motion
- Hantverk
- Hinduism
- Historia
- Hobbies
- Hockey
- Hus och trädgård
- Ideell
- Improvisering
- Investering
- Islam
- Judendom
- Karriär
- Kemi
- Komedi
- Komedifiktion
- Komediintervjuer
- Konst
- Kristendom
- Kurser
- Ledarskap
- Life Science
- Löpning
- Marknadsföring
- Mat
- Matematik
- Medicin
- Mental hälsa
- Mode och skönhet
- Motion
- Musik
- Musikhistoria
- Musikintervjuer
- Musikkommentarer
- Näringslära
- Näringsliv
- Natur
- Naturvetenskap
- Nyheter
- Nyhetskommentarer
- Personliga dagböcker
- Platser och resor
- Poddar
- Politik
- Relationer
- Religion
- Religion och spiritualitet
- Så gör man
- Sällskapsspel
- Samhälle och kultur
- Samhällsvetenskap
- Science fiction
- Sexualitet
- Simning
- Självhjälp
- Skönlitteratur
- Spel
- Sport
- Sportnyheter
- Språkkurs
- Stat och kommun
- Ståupp
- Tekniknyheter
- Teknologi
- Tennis
- TV och film
- TV-recensioner
- Underhållningsnyheter
- Utbildning
- Utbildning för barn
- Verkliga brott
- Vetenskap
- Vildmarken
- Visuell konst
Ubuntu Security Podcast
A fortnightly podcast talking about the latest developments and updates from the Ubuntu Security team, including a summary of recent security vulnerabilities and fixes as well as a discussion on some ...
239 avsnitt • Längd: 20 min • Månadsvis
Om podden
A fortnightly podcast talking about the latest developments and updates from the Ubuntu Security team, including a summary of recent security vulnerabilities and fixes as well as a discussion on some of the goings on in the wider Ubuntu Security community.
The podcast Ubuntu Security Podcast is created by Ubuntu Security Team. The podcast and the artwork on this page are embedded on this page using the public podcast feed (RSS).
Avsnitt
Episode 238
4 oktober 2024 |
32 min
Overview
For the first in a 3-part series for Cybersecurity Awareness month, Luci Stanescu joins Alex to discuss the recent CUPS vulnerabilities as well as the evolution of cybersecurity since the origin of the internet.
Get in contact
Episode 237
20 september 2024 |
16 min
Overview
John and Maximé have been talking about Ubuntu’s AppArmor user namespace restrictions at the the Linux Security Summit in Europe this past week, plus we cover some more details from the official announcement of permission prompting in Ubuntu 24.10, a new release of Intel TDX for Ubuntu 24.04 LTS and more.
This week in Ubuntu Security Updates (01:11)
613 unique CVEs addressed in the past fortnight
[USN-6989-1] OpenStack vulnerability
- 1 CVEs addressed in Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-6990-1] znc vulnerability
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-6992-1] Firefox vulnerabilities
- 8 CVEs addressed in Focal (20.04 LTS)
[USN-6993-1] Vim vulnerabilities
- 2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-6991-1] AIOHTTP vulnerability
- 1 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-6995-1] Thunderbird vulnerabilities
- 10 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6996-1] WebKitGTK vulnerabilities
- 6 CVEs addressed in Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-6841-2] PHP vulnerability
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
[USN-6997-1, USN-6997-2] LibTIFF vulnerability
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-6994-1] Netty vulnerabilities
- 2 CVEs addressed in Jammy (22.04 LTS)
- HTTP/2 DoS, seen exploited in the wild and listen on the CISA KEV
[USN-6998-1] Unbound vulnerabilities
- 2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-6999-1] Linux kernel vulnerabilities
- 220 CVEs addressed in Noble (24.04 LTS)
- Full CVE list elided - see USN for details
[USN-7003-1, USN-7003-2, USN-7003-3] Linux kernel vulnerabilities
- 85 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- Full CVE list elided - see USN for details
[USN-7004-1] Linux kernel vulnerabilities
- 221 CVEs addressed in Noble (24.04 LTS)
- Full CVE list elided - see USN for details
[USN-7005-1, USN-7005-2] Linux kernel vulnerabilities
- 219 CVEs addressed in Jammy (22.04 LTS), Noble (24.04 LTS)
- Full CVE list elided - see USN for details
[USN-7006-1] Linux kernel vulnerabilities
- 94 CVEs addressed in Focal (20.04 LTS)
- Full CVE list elided - see USN for details
[USN-7007-1] Linux kernel vulnerabilities
- 219 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- Full CVE list elided - see USN for details
[USN-7008-1] Linux kernel vulnerabilities
- 222 CVEs addressed in Jammy (22.04 LTS)
- Full CVE list elided - see USN for details
[USN-7009-1] Linux kernel vulnerabilities
- 219 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- Full CVE list elided - see USN for details
[USN-7019-1] Linux kernel vulnerabilities
- 429 CVEs addressed in Jammy (22.04 LTS)
- Full CVE list elided - see USN for details
[USN-7002-1] Setuptools vulnerability
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-7000-1, USN-7000-2] Expat vulnerabilities
- 3 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-7001-1, USN-7001-2] xmltok library vulnerabilities
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-6560-3] OpenSSH vulnerability
- 1 CVEs addressed in Xenial ESM (16.04 ESM)
[USN-7011-1, USN-7011-2] ClamAV vulnerabilities
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-7012-1] curl vulnerability
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-7013-1] Dovecot vulnerabilities
- 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-7014-1] nginx vulnerability
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-7015-1] Python vulnerabilities
- 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-7010-1] DCMTK vulnerabilities
- 9 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-7016-1] FRR vulnerability
- 1 CVEs addressed in Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-7017-1] Quagga vulnerability
- 1 CVEs addressed in Focal (20.04 LTS)
[USN-7018-1] OpenSSL vulnerabilities
- 6 CVEs addressed in Trusty ESM (14.04 ESM)
Goings on in Ubuntu Security Community
Linux Security Summit Europe 2024 (03:44)
- https://events.linuxfoundation.org/linux-security-summit-europe/program/schedule/
- Sep 16-17 - Vienna, Austria
- John Johansen and Maxime Bélair from AppArmor team presented “Restricting Unprivileged User Namespaces in Ubuntu”
- Other talks
- Deep-dive into xz-utils supply chain attack
- Internals of the SLUB memory allocator for exploit developers
- Landlock update - including details of new IOCTL restrictions etc
- systemd and TPM2 update
Official announcement of Permissions Prompting in Ubuntu 24.10 (09:00)
- https://discourse.ubuntu.com/t/ubuntu-desktop-s-24-10-dev-cycle-part-5-introducing-permissions-prompting/47963
- Ubuntu Security Center with snapd-based AppArmor home file access prompting preview in episode 236
- Even works for command-line applications etc - not just graphical
- Covers future developments as well:
- Better default response suggestions based on user feedback.
- Shell integration of the prompting pop-ups (eg full screen takeovers)
- Improved rule management summaries and better messaging of overlapping or redundant prompts.
- Expansion of the prompting system to cover additional snap interfaces such as camera and microphone access.
- Smarter client side analysis of prompts, recommending additional options if multiple similar prompts are detected.
Version 2.1 of IntelⓇ TDX on Ubuntu 24.04 LTS Released (11:46)
- https://discourse.ubuntu.com/t/version-2-1-of-intel-tdx-on-ubuntu-24-04-lts-released/47918/1
- Confidential computing - using TDX to run VMs in confidential mode - runs workloads (VMs) in hardware-backed isolated execution environments (Trust Domains). VM memory isolation via encryption in hardware so can’t be accessed by the hypervisor, remote attestation etc (Confidential Computing with Ijlal Loutfi and Karen Horovitz from Episode 230)
- https://discourse.ubuntu.com/t/intel-tdx-1-0-technology-preview-available-on-ubuntu-23-10/40698
- Scripting to setup the required elements to use TDX on Ubuntu 24.04 host and
then setup guest VMs to run in confidential mode
- Install server image, run scripts, enable TDX in BIOS, create VM images etc
- Can also configure remote attestation of VM too
- See full changes at https://github.com/canonical/tdx/releases/tag/2.1
Ubuntu 22.04.5 LTS released (13:45)
- https://discourse.ubuntu.com/t/jammy-jellyfish-point-release-changes/29835/8
- Only covers changes in main and restricted, doesn’t list security updates either
- https://discourse.ubuntu.com/t/jammy-jellyfish-release-notes/24668
AppArmor security update for CVE-2016-1585 published (14:23)
- Upcoming AppArmor Security update for CVE-2016-1585 from Episode 226
- https://discourse.ubuntu.com/t/upcoming-apparmor-security-update-for-cve-2016-1585/44268/3
- Now published to -updates pocket for 20.04 LTS and 22.04 LTS
- Will be published to -security pocket next week
Get in contact
Episode 236
6 september 2024 |
18 min
Overview
The long awaited preview of snapd-based AppArmor file prompting is finally seeing the light of day, plus we cover the recent 24.04.1 LTS release and the podcast officially moves to a fortnightly cycle.
This week in Ubuntu Security Updates
45 unique CVEs addressed
[USN-6972-4] Linux kernel (Oracle) vulnerabilities
- 18 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
[USN-6982-1] Dovecot vulnerabilities
- 2 CVEs addressed in Noble (24.04 LTS)
[USN-6983-1] FFmpeg vulnerability
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-6984-1] WebOb vulnerability
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-6973-4] Linux kernel (Raspberry Pi) vulnerabilities
- 9 CVEs addressed in Bionic ESM (18.04 ESM)
[USN-6981-2] Drupal vulnerabilities
- 3 CVEs addressed in Trusty ESM (14.04 ESM)
- 2 of these are in the CISA KEV - Discussion of CISA KEV from Episode 231
[USN-6986-1] OpenSSL vulnerability
- 1 CVEs addressed in Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-6987-1] Django vulnerabilities
- 2 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-6988-1] Twisted vulnerabilities
- 2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-6985-1] ImageMagick vulnerabilities
- 11 CVEs addressed in Trusty ESM (14.04 ESM)
Goings on in Ubuntu Security Community
Ubuntu 24.04.1 LTS released (02:55)
- On 29th August - https://lists.ubuntu.com/archives/ubuntu-announce/2024-August/000304.html
- https://discourse.ubuntu.com/t/ubuntu-24-04-lts-noble-numbat-release-notes/39890
- Discussed high level features previously in Ubuntu 24.04 LTS (Noble Numbat) released from Episode 227
- New security features / improvements:
- Unprivileged user namespace restrictions
- Binary hardening
- AppArmor 4
- Disabling of old TLS versions
- Upstream Kernel Security Features
- Intel shadow stack support
- Secure virtualisation with AMD SEV-SNP and Intel TDX
- Strict compile-time bounds checking
- New security features / improvements:
- Initially offered upgrades from 22.04 but this has been pulled just recently
due to reports of a critical bug in the ubuntu-release-upgrader package and
its interaction with the apt solver - essentially resulting in packages like
linux-headers being in an broken state since it would remove some packages
that were seen as obsolete but which were still required due to other packages
depending on them
- likely will not be fixed until early next week
Ubuntu Security Center with snapd-based AppArmor home file access prompting preview (05:45)
- https://news.itsfoss.com/ubuntu-security-center-near-stable/
- Details the new Desktop Security Center application
- Written by the Ubuntu Desktop team - new application built using Flutter + Dart etc and published a snap
- Eventually this will allow to manage various security related things like
full-disk encryption, enabling/usage of Ubuntu Pro, Firewall control and
finally for snap permission prompting
- this last feature is the only one currently supported - has a single toggle which is to enable “snaps to ask for system permissions” - aka. snapd-based AppArmor prompting
- and then once this is enabled, allows the specific permissions to be futher fine-tuned
- What is AppArmor?
- AppArmor policies - and MAC systems in general are static - policy defined by sysadmin etc
- Not well suited for dynamic applications that are controlled by a user - like desktop / CLI etc - can’t know in advance every possible file a user may want to open in say Firefox so have to grant access to all files in home directory just in case
- Ideally system would only allow files that the user explicitly chooses - number of ways this can be done, XDG Portals one such way - using Powerbox concept pioneered in tools from the object-capability based security community like CapDesk/Polaris and Plash (principle of least-authority shell) - access is mediated by a privileged component that acts with the users whole authority to then delegate some of that authority to the application - seen say in the file-chooser dialog with portals - this runs outside of the scope of the application itself and so has the full, unrestricted access to the system to allow a file to be chosen - then the application is then just given a file-descriptor to the file to grant it the access (or similar)
- This only works in the case of applications that open files interactively - can’t allow the user to explicitly grant access to the configuration file that gets loaded from a well-known path at startup in a server application etc
- One way to handle that case is to alert the user and explicitly prompt them for that access - and this is currently how this new prompting feature works
- When the feature is enabled, the usual broad-based access rules for the
homeinterface in snapd get tagged with a prompt attribute - any access then which would normally be allowed is instead delegated to a trusted helper application which displays a dialog to the user asking them to explicitly allow such access
- since this happens directly in the system-call path within the kernel, the application itself is unaware that this is happening - but is just suspended whilst waiting for the users response - and then assuming they grant the access it proceeds as normal (or if they deny then the application gets a permission denied error)
- Completely transparent to the application and supports any kind of file-access regardless of which API might be used (unlike portals which only support the regular file-chooser scenario)
- Allows tighter control of what files a snap is granted access to - and can be managed by the user in the Security Center later to revoke any such permission that they granted
- Has been in development for a long time, and is certainly not a new concept -
seccomp has supported this via the
seccomp_unotifyinterface - allows to delegate seccomp decisions to userspace in a very similar manner - existed since the 5.5 kernel released in January 2020 - Even before that, prototype LSMs existed which implemented this kind of functionality (https://sourceforge.net/projects/pulse-lsm/ / https://crpit.scem.westernsydney.edu.au/confpapers/CRPITV81Murray.pdf)
- Can test this now on an up-to-date 24.04 or 24.10 install
- Need to use snapd from the latest/edge channel and then install both the
desktop-security-centersnap as well as theprompting-clientsnap - Launch Security Center and toggle the option
- Need to use snapd from the latest/edge channel and then install both the
- Note this is experimental but has undergone a fair amount of internal testing
- Very exciting to see this finally available in this pre-release stage - has been talked about since at least 2018
- Give it a spin and provide feedback - I would suggest to use the link in the security center application itself for this but it is not working currently - instead report via a Github issue on the desktop-security-center project
Get in contact
Episode 235
23 augusti 2024 |
18 min
Overview
A recent Microsoft Windows update breaks Linux dual-boot - or does it? This week we look into reports of the recent Windows patch-Tuesday update breaking dual-boot, including a deep-dive into the technical details of Secure Boot, SBAT, grub, shim and more, plus we look at a vulnerability in GNOME Shell and the handling of captive portals as well.
This week in Ubuntu Security Updates
135 unique CVEs addressed
[USN-6960-1] RMagick vulnerability
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6951-2] Linux kernel (Azure) vulnerabilities
- 83 CVEs addressed in Focal (20.04 LTS)
- CVE-2022-48674
- CVE-2024-39471
- CVE-2024-39292
- CVE-2024-36270
- CVE-2024-36904
- CVE-2024-38618
- CVE-2024-36014
- CVE-2024-36941
- CVE-2024-38637
- CVE-2024-38613
- CVE-2024-36286
- CVE-2024-36902
- CVE-2024-38599
- CVE-2024-39301
- CVE-2024-39475
- CVE-2024-36954
- CVE-2024-33621
- CVE-2024-38552
- CVE-2024-36950
- CVE-2024-38582
- CVE-2024-36015
- CVE-2023-52434
- CVE-2024-38659
- CVE-2024-36940
- CVE-2024-38607
- CVE-2024-39480
- CVE-2024-38583
- CVE-2023-52882
- CVE-2024-39467
- CVE-2024-39489
- CVE-2024-38601
- CVE-2024-27019
- CVE-2023-52752
- CVE-2024-36960
- CVE-2024-38549
- CVE-2024-38567
- CVE-2024-38587
- CVE-2024-38635
- CVE-2024-38598
- CVE-2024-38612
- CVE-2024-38579
- CVE-2024-27401
- CVE-2024-36946
- CVE-2024-36017
- CVE-2022-48772
- CVE-2024-36905
- CVE-2024-35947
- CVE-2024-38381
- CVE-2024-38565
- CVE-2024-38589
- CVE-2024-36939
- CVE-2024-38661
- CVE-2024-39488
- CVE-2024-36883
- CVE-2024-38621
- CVE-2024-37353
- CVE-2024-38780
- CVE-2024-36964
- CVE-2024-38627
- CVE-2024-36971
- CVE-2024-38615
- CVE-2024-38559
- CVE-2024-31076
- CVE-2024-26886
- CVE-2024-39493
- CVE-2024-27398
- CVE-2024-36886
- CVE-2024-38633
- CVE-2024-36959
- CVE-2024-38634
- CVE-2024-38560
- CVE-2024-38558
- CVE-2023-52585
- CVE-2024-37356
- CVE-2024-35976
- CVE-2024-36919
- CVE-2024-36933
- CVE-2024-38596
- CVE-2024-39276
- CVE-2024-27399
- CVE-2024-38600
- CVE-2024-38578
- CVE-2024-36934
[USN-6961-1] BusyBox vulnerabilities
- 4 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-6962-1] LibreOffice vulnerability
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-6963-1] GNOME Shell vulnerability (01:03)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
- Captive portal detection would spawn an embedded webkit browser automatically to allow user to login etc
- But the page the user gets directed to is controlled by the attacker and can contain arbitrary javascript etc
- Upstream bug report claimed could then get a reverse shell etc - not clear this is the case since would still be constrained by the webkitgtk browser so would also need a sandbox escape etc.
- This update then includes a change to both not automatically open the captive portal page (instead it will show a notification and the user needs to click that) BUT to also disable the use of the webkitgtk-based embedded browser and instead use the users regular browser
[USN-6909-3] Bind vulnerabilities
- 2 CVEs addressed in Xenial ESM (16.04 ESM)
[USN-6964-1] ORC vulnerability
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-6837-2] Rack vulnerabilitie
- 3 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6966-1] Firefox vulnerabilities
- 13 CVEs addressed in Focal (20.04 LTS)
[USN-6966-2] Firefox regressions
- 13 CVEs addressed in Focal (20.04 LTS)
[USN-6951-3] Linux kernel (Azure) vulnerabilities
- 83 CVEs addressed in Bionic ESM (18.04 ESM)
- CVE-2022-48674
- CVE-2024-39471
- CVE-2024-39292
- CVE-2024-36270
- CVE-2024-36904
- CVE-2024-38618
- CVE-2024-36014
- CVE-2024-36941
- CVE-2024-38637
- CVE-2024-38613
- CVE-2024-36286
- CVE-2024-36902
- CVE-2024-38599
- CVE-2024-39301
- CVE-2024-39475
- CVE-2024-36954
- CVE-2024-33621
- CVE-2024-38552
- CVE-2024-36950
- CVE-2024-38582
- CVE-2024-36015
- CVE-2023-52434
- CVE-2024-38659
- CVE-2024-36940
- CVE-2024-38607
- CVE-2024-39480
- CVE-2024-38583
- CVE-2023-52882
- CVE-2024-39467
- CVE-2024-39489
- CVE-2024-38601
- CVE-2024-27019
- CVE-2023-52752
- CVE-2024-36960
- CVE-2024-38549
- CVE-2024-38567
- CVE-2024-38587
- CVE-2024-38635
- CVE-2024-38598
- CVE-2024-38612
- CVE-2024-38579
- CVE-2024-27401
- CVE-2024-36946
- CVE-2024-36017
- CVE-2022-48772
- CVE-2024-36905
- CVE-2024-35947
- CVE-2024-38381
- CVE-2024-38565
- CVE-2024-38589
- CVE-2024-36939
- CVE-2024-38661
- CVE-2024-39488
- CVE-2024-36883
- CVE-2024-38621
- CVE-2024-37353
- CVE-2024-38780
- CVE-2024-36964
- CVE-2024-38627
- CVE-2024-36971
- CVE-2024-38615
- CVE-2024-38559
- CVE-2024-31076
- CVE-2024-26886
- CVE-2024-39493
- CVE-2024-27398
- CVE-2024-36886
- CVE-2024-38633
- CVE-2024-36959
- CVE-2024-38634
- CVE-2024-38560
- CVE-2024-38558
- CVE-2023-52585
- CVE-2024-37356
- CVE-2024-35976
- CVE-2024-36919
- CVE-2024-36933
- CVE-2024-38596
- CVE-2024-39276
- CVE-2024-27399
- CVE-2024-38600
- CVE-2024-38578
- CVE-2024-36934
[USN-6968-1] PostgreSQL vulnerability
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-6967-1] Intel Microcode vulnerabilities
- 5 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[LSN-0106-1] Linux kernel vulnerability
- 3 CVEs addressed in
[USN-6969-1] Cacti vulnerabilities
- 10 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
[USN-6970-1] exfatprogs vulnerability
- 1 CVEs addressed in Jammy (22.04 LTS)
[USN-6944-2] curl vulnerability
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
[USN-6965-1] Vim vulnerabilities
- 5 CVEs addressed in Trusty ESM (14.04 ESM)
Goings on in Ubuntu Security Community
Reports of dual-boot Linux/Windows machines failing to boot (04:30)
- https://arstechnica.com/security/2024/08/a-patch-microsoft-spent-2-years-preparing-is-making-a-mess-for-some-linux-users/
- https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2022-2601
- https://discourse.ubuntu.com/t/sbat-self-check-failed-mitigating-the-impact-of-shim-15-7-revocation-on-the-ubuntu-boot-process-for-devices-running-windows/47378
- Microsoft released an update for Windows on 13th August 2024 - revoking old versions of grub that were susceptible to CVE-2022-2601
- How do you revoke grub?
- Secure Boot relies on each component in the boot chain verifying that the
next component is signed with a valid signature before it is then loaded
- UEFI BIOS validates shim
- shim validates grub
- grub validates kernel
- kernel validates kernel modules etc
- UEFI specification has effectively a CRL - list of hashes of binaries which shouldn’t be trusted
- BUT there is only limited space in the UEFI storage - after the original BootHole vulnerabilities revoked a huge number of grub binaries from many different distros, some devices failed to boot as the NVRAM was too full
- Microsoft and Red Hat and other maintainers of shim decided on a new scheme,
called SBAT - Secure Boot Advanced Targeting
- maintains a generation number for each component in the boot chain
- when say shim or grub gets updated to fix a bunch more security vulnerabilities, upstream bumps the generation number
- shim/grub then embeds the generation number within itself
- Signed UEFI variable then lists which generation numbers are acceptable
- shim checks the generation number of a binary (grub/fwupd etc) against this list and if it is too old refuses to load it
- Secure Boot relies on each component in the boot chain verifying that the
next component is signed with a valid signature before it is then loaded
- In Ubuntu this was patched back in Jan 2023 and was documented on the Ubuntu
Discourse - in this case we updated shim to a newer version which itself
revoked an older grub,
grub,1 - Now Microsoft’s update revokes
grub,2, ie sets the minimum generation number for grub to3 - You can inspect the SBAT policy by either directly reading the associated EFI
variable or using
mokutil --list-sbat-revocations
cat /sys/firmware/efi/efivars/SbatLevelRT-605dab50-e046-4300-abb6-3dd810dd8b23
mokutil --list-sbat-revocations
sbat,1,2023012900
shim,2
grub,3
grub.debian,4
objdump -j .sbat -s /boot/efi/EFI/ubuntu/grubx64.efi | xxd -r
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
grub,4,Free Software Foundation,grub,2.12,https://www.gnu.org/software/grub/
grub.ubuntu,2,Ubuntu,grub2,2.12-5ubuntu4,https://www.ubuntu.com/
grub.peimage,2,Canonical,grub2,2.12-5ubuntu4,https://salsa.debian.org/grub-team/grub/-/blob/master/debian/patches/secure-boot/efi-use-peimage-shim.patch
rm -rf grub2-signed
mkdir grub2-signed
pushd grub2-signed >/dev/null || exit
for rel in focal jammy noble; do
mkdir $rel
pushd $rel >/dev/null || exit
pull-lp-debs grub2-signed $rel-security 1>/dev/null 2>/dev/null || pull-lp-debs grub2-signed $rel-release 1>/dev/null 2>/dev/null
dpkg-deb -x grub-efi-amd64-signed*.deb grub2-signed
echo $rel
echo -----
find . -name grubx64.efi.signed -exec objdump -j .sbat -s {} \; | tail -n +5 | xxd -r
popd >/dev/null || exit
done
popd >/dev/null
focal
-----
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
grub,4,Free Software Foundation,grub,2.06,https://www.gnu.org/software/grub/
grub.ubuntu,1,Ubuntu,grub2,2.06-2ubuntu14.4,https://www.ubuntu.com/
jammy
-----
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
grub,4,Free Software Foundation,grub,2.06,https://www.gnu.org/software/grub/
grub.ubuntu,1,Ubuntu,grub2,2.06-2ubuntu14.4,https://www.ubuntu.com/
noble
-----
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
grub,4,Free Software Foundation,grub,2.12,https://www.gnu.org/software/grub/
grub.ubuntu,2,Ubuntu,grub2,2.12-1ubuntu7,https://www.ubuntu.com/
grub.peimage,2,Canonical,grub2,2.12-1ubuntu7,https://salsa.debian.org/grub-team/grub/-/blob/master/debian/patches/secure-boot/efi-use-peimage-shim.patch
- So if all the current LTS releases have a grub with a generation number higher
than this, why are so many machines failing to boot?
- It is not just grub that is the issue - shim itself also got revoked in the same update https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2023-40547 - so shim 15.8 (ie. 4th SBAT generation of shim) is now required
- Unfortunately, the related updates for this shim in Ubuntu are still in the process of being released - https://bugs.launchpad.net/ubuntu/+source/shim/+bug/2051151
rm -rf shim-signed
mkdir shim-signed
pushd shim-signed >/dev/null || exit
for rel in focal jammy noble; do
mkdir $rel
pushd $rel >/dev/null || exit
pull-lp-debs shim-signed $rel-security 1>/dev/null 2>/dev/null || pull-lp-debs shim-signed $rel-release 1>/dev/null 2>/dev/null
dpkg-deb -x shim-signed*.deb shim-signed
echo $rel
echo -----
find . -name shimx64.efi.signed.latest -exec objdump -j .sbat -s {} \; | tail -n +5 | xxd -r
popd >/dev/null || exit
done
popd >/dev/null
focal
-----
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
shim,3,UEFI shim,shim,1,https://github.com/rhboot/shim
shim.ubuntu,1,Ubuntu,shim,15.7-0ubuntu1,https://www.ubuntu.com/
jammy
-----
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
shim,3,UEFI shim,shim,1,https://github.com/rhboot/shim
shim.ubuntu,1,Ubuntu,shim,15.7-0ubuntu1,https://www.ubuntu.com/
noble
-----
sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md
shim,4,UEFI shim,shim,1,https://github.com/rhboot/shim
shim.ubuntu,1,Ubuntu,shim,15.8-0ubuntu1,https://www.ubuntu.com/
-
only noble has a new-enough shim in the security/release pocket - both focal and jammy have the older one - but the new 4th generation shim is currently undergoing testing in the -proposed pocket and will be released next week
-
until then, if affected, need to disable secure boot in BIOS then can either wait until the new shim is released OR just reboot twice in this mode and shim will automoatically reset the SBAT policy to the previous version, allowing the older shim to still be used
-
then can re-enable Secure Boot in BIOS
-
Once new shim is released it will reinstall the new SBAT policy to revoke its older version
-
One other thing, this also means the old ISOs won’t boot either
- 24.04.1 will be released on 29th August
- upcoming 22.04.5 release will also have this new shim too
- no further ISO spins planned for 20.04 - so if you really want to install this release on new hardware, would need to disable secure boot first, do the install, then install updates to get the new shim, and re-enable secure boot
Get in contact
Episode 234
9 augusti 2024 |
29 min
Overview
This week we take a deep dive behind-the-scenes look into how the team handled a
recent report from Snyk’s Security Lab of a local privilege escalation
vulnerability in wpa_supplicant plus we cover security updates in Prometheus
Alertmanager, OpenSSL, Exim, snapd, Gross, curl and more.
This week in Ubuntu Security Updates
185 unique CVEs addressed
[USN-6935-1] Prometheus Alertmanager vulnerability (01:08)
- 1 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- Stored XSS via the Alertmanager UI - alerts API allows to specify a URL which should be able to be called interactively by the user from the UI - an attacker instead could POST to this with arbitrary JavaScript which would then get included in the generated HTML and hence run on users when viewing the UI
- Fixed to validate this field is actually a URL before including in the generated UI page
[USN-6938-1] Linux kernel vulnerabilities (02:05)
- 31 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
- CVE-2024-35978
- CVE-2024-35984
- CVE-2024-35997
- CVE-2024-26840
- CVE-2024-27020
- CVE-2023-52752
- CVE-2021-47194
- CVE-2021-46960
- CVE-2024-26884
- CVE-2024-36016
- CVE-2023-52436
- CVE-2024-36902
- CVE-2024-26886
- CVE-2023-52469
- CVE-2024-26923
- CVE-2023-52444
- CVE-2023-52620
- CVE-2021-46933
- CVE-2024-35982
- CVE-2023-52449
- CVE-2024-26934
- CVE-2024-26882
- CVE-2024-26857
- CVE-2021-46932
- CVE-2024-26901
- CVE-2024-25739
- CVE-2024-24859
- CVE-2024-24858
- CVE-2024-24857
- CVE-2023-46343
- CVE-2022-48619
- 4.4 - generic, AWS, KVM, Low Latency, Virtual
[USN-6922-2] Linux kernel vulnerabilities
- 4 CVEs addressed in Jammy (22.04 LTS)
- 6.5 lowlatency
[USN-6926-2] Linux kernel vulnerabilities
- 30 CVEs addressed in Trusty ESM (14.04 ESM), Bionic ESM (18.04 ESM)
- CVE-2023-52620
- CVE-2023-52444
- CVE-2024-26901
- CVE-2023-52449
- CVE-2024-27013
- CVE-2024-26934
- CVE-2024-35978
- CVE-2024-27020
- CVE-2023-52469
- CVE-2024-35982
- CVE-2024-35997
- CVE-2023-52443
- CVE-2024-36902
- CVE-2024-26857
- CVE-2024-36016
- CVE-2023-52436
- CVE-2023-52752
- CVE-2024-26886
- CVE-2024-35984
- CVE-2023-52435
- CVE-2024-26840
- CVE-2024-26923
- CVE-2024-26882
- CVE-2024-26884
- CVE-2024-25744
- CVE-2024-25739
- CVE-2024-24859
- CVE-2024-24858
- CVE-2024-24857
- CVE-2023-46343
- 4.15 Azure
[USN-6895-4] Linux kernel vulnerabilities
- 100 CVEs addressed in Jammy (22.04 LTS)
- CVE-2024-26802
- CVE-2024-26664
- CVE-2023-52880
- CVE-2024-26695
- CVE-2024-27416
- CVE-2024-26714
- CVE-2024-26603
- CVE-2024-26920
- CVE-2024-26736
- CVE-2024-26593
- CVE-2024-26922
- CVE-2024-26600
- CVE-2024-26702
- CVE-2024-26782
- CVE-2024-26685
- CVE-2024-26691
- CVE-2024-26734
- CVE-2024-26822
- CVE-2024-35833
- CVE-2024-26792
- CVE-2024-26674
- CVE-2024-26889
- CVE-2024-26712
- CVE-2024-26917
- CVE-2024-26919
- CVE-2023-52637
- CVE-2024-26700
- CVE-2024-26661
- CVE-2024-26926
- CVE-2023-52631
- CVE-2024-26679
- CVE-2024-26798
- CVE-2024-26667
- CVE-2024-26689
- CVE-2024-26681
- CVE-2024-26910
- CVE-2024-26828
- CVE-2024-26790
- CVE-2024-26606
- CVE-2024-26825
- CVE-2024-26677
- CVE-2024-26722
- CVE-2024-26923
- CVE-2024-26803
- CVE-2024-26898
- CVE-2023-52642
- CVE-2024-26660
- CVE-2024-26716
- CVE-2023-52645
- CVE-2024-26602
- CVE-2024-26711
- CVE-2024-26826
- CVE-2024-26601
- CVE-2024-26890
- CVE-2024-26698
- CVE-2024-26693
- CVE-2024-26665
- CVE-2024-26676
- CVE-2024-26824
- CVE-2024-26838
- CVE-2024-26720
- CVE-2024-26666
- CVE-2024-26718
- CVE-2024-26723
- CVE-2024-26675
- CVE-2024-26680
- CVE-2024-26642
- CVE-2024-26710
- CVE-2024-26696
- CVE-2024-26748
- CVE-2024-26717
- CVE-2024-26735
- CVE-2024-26916
- CVE-2024-26697
- CVE-2024-26829
- CVE-2024-26715
- CVE-2024-26694
- CVE-2024-26830
- CVE-2024-26726
- CVE-2024-26719
- CVE-2024-26820
- CVE-2024-26707
- CVE-2024-26818
- CVE-2024-26733
- CVE-2024-26688
- CVE-2023-52643
- CVE-2024-26703
- CVE-2024-26831
- CVE-2024-26789
- CVE-2024-26662
- CVE-2024-26663
- CVE-2024-26708
- CVE-2024-26659
- CVE-2024-26684
- CVE-2023-52638
- CVE-2024-24861
- CVE-2024-23307
- CVE-2024-1151
- CVE-2024-0841
- CVE-2023-6270
- 6.5 OEM
[USN-6937-1] OpenSSL vulnerabilities (03:04)
- 4 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
- Four low priority issues
- Possible UAF in
SSL_free_buffersAPI - requires an application to directly call this function - across the entire Ubuntu package ecosystem there doesn’t appear to be any packages that do this so highly unlikely to be an issue in practice - Similarly, in another rarely used function
SSL_select_next_proto- if called with an empty buffer list would read other private memory - ie OOB read - and potentially then either crash or return private data- but again this is not expected to occur in practice
- CPU-based DoS when validating long / crafted DSA keys
- simply check if using to large a modulus and error in that case
- If had set the
SSL_OP_NO_TICKEToption would possibly get into a state where the session cache would not be flushed and so would grow unbounded - memory based DoS
- Possible UAF in
[USN-6913-2] phpCAS vulnerability (04:51)
- 1 CVEs addressed in Xenial ESM (16.04 ESM)
- [USN-6913-1] phpCAS vulnerability from Episode 233
[USN-6936-1] Apache Commons Collections vulnerability (05:03)
- 1 CVEs addressed in Trusty ESM (14.04 ESM)
- Unsafe deserialisation - could allow to overwrite an object with an attacker controlled version containing code to be executed - RCE
[USN-6939-1] Exim vulnerability (05:31)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
- Mishandles multiline filename header and so a crafted value could bypass the MIME type extension blocking mechanism - allowing executables etc to be delivered to users
[USN-6933-1] ClickHouse vulnerabilities (06:00)
- 5 CVEs addressed in Focal (20.04 LTS)
- real-time analytics DBMS
- Mostly written in C++ so not surprisingly has various memory safety issues
- All in the the LZ4 compression codec - uses an attacker controlled 16-bit unsiged value as the offset to read from the compressed data - then this value is also used when copying the data but there is no check on the upper bound so could index outside of the data
- Also a heap buffer overflow during this same data copy since doesn’t verify the size of the destination either
[USN-6940-1] snapd vulnerabilities (06:55)
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
- 2 quite similar issues discovered by one of the engineers on the snapd team - Zeyad Gouda
- snaps are squashfs images - in general they are just mounted but certain files from the squashfs get extracted by snapd and placed on the regular file-system (ie. desktop files and icons for launchers etc) - as such, snapd would read the contents of these files and then write them out - if the file was actually a named pipe, snapd would block forever - DoS
- similarly, if the file was a symlink that pointed to an existing file on the
file-system, when opening that file (which is a symlink) snapd would read
the contents of the other file and write it out - recall these are desktop
files etc so they get written to
/usr/share/applicationswhich is world-readable - so if the symlink pointed to/etc/shadowthen you would get a copy of this written out as world-readable - so an unprivileged user on the system could then possibly escalate their privileges
- 3rd issue was AppArmor sandbox
- home interface allows snaps to read/write to your home directory
- On Ubuntu, if the bin directory exists, it gets automatically added to your PATH
- AppArmor policy for snapd took this into account and would stop snaps from writing files into this directory (and hence say creating a shell script that you would then execute later, outside of the snap sandbox)
- BUT it did not prevent a snap from creating this directory if it didn’t already exist
[USN-6941-1] Python vulnerability (11:15)
- 1 CVEs addressed in Noble (24.04 LTS)
- [USN-6928-1] Python vulnerabilities from Episode 233
[USN-6909-2] Bind vulnerabilities (11:30)
- 2 CVEs addressed in Bionic ESM (18.04 ESM)
- 2 different CPU-based DoS
- Didn’t restrict the number of resource records
for a given hostname - if an attacker could arrange so a large number of RRs
then could degrade the performace of bind due to it having to perform
expensive lookups across all the records
- introduce a limit of 100 RRs for a given name
- Removed support DNSSEC SIG(0) transaction signatures since they could be abused to perform a CPU-based DoS
- Didn’t restrict the number of resource records
for a given hostname - if an attacker could arrange so a large number of RRs
then could degrade the performace of bind due to it having to perform
expensive lookups across all the records
[USN-6943-1] Tomcat vulnerabilities (12:26)
- 5 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6942-1] Gross vulnerability (12:33)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
- greylisting server used in MTA setup to minimise spam - uses DNS block lists to tag mails which come from these domains as possible spam
- stack buffer overflow through the use of
strncat()during logging- would concatenate a list of parameters as string into a fixed size buffer on the stack but would pass the entire buffer size as the length argument rather than accounting for the remaining space in the buffer
- as these parameters can be controlled by an attacker can be used to either crash grossd or get RCE
[USN-6944-1] curl vulnerability (13:55)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
- Possible OOB read through crafted ASN.1 Generalized Time field when parsing TLS certificate chain - would potentially use a negative length value and hence try calculate the length of a string but pointing to the wrong memory region - crash / info leak
- Need to specifically use the https://curl.se/libcurl/c/CURLINFO_CERTINFO.html option though to be vulnerable
[USN-6200-2] ImageMagick vulnerabilities (14:52)
- 20 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- [USN-6200-1] ImageMagick vulnerabilities from Episode 202
[USN-6946-1] Django vulnerabilities (15:04)
- 4 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
- SQL injection via crafted JSON in methods on the QuerySet class, and various DoS - one via very large inputs of Unicode characters in certain input fields, another through floatformat template filter - would use a large amount of memory if given a number in scientific notation with a large exponent
[USN-6945-1] wpa_supplicant and hostapd vulnerability (15:42)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
- Possible privilege escalation through abuse of DBus method to get
wpa_supplicantto load an attacker controlled shared object into memory
Goings on in Ubuntu Security Community
Discussion of CVE-2024-5290 in wpa_supplicant (16:10)
- Reported privately to us by Rory McNamara from Snyk as part of a larger disclosure of various security issues they had found
- Issue specific to Debian and Ubuntu - includes patch to the dbus policy for
wpa_supplicantto allow various methods to be called by users in the netdev group- historical hangover before we had network manager etc to do this
- nowadays, Network Manager allows the user who is logged in to control access to wireless networks etc
- historically though, Debian had the netdev group instead - so you would add your user to this group to allow them to configure network settings etc
- so makes sense to allow that group to control
wpa_supplicantvia its dbus interface
- DBus API includes a method called
CreateInterface- takes an argument called
ConfigFilewhich specifies the path to a configuration file using the format of wpa_supplicant.conf - config file includes a parameter for
opensc_engine_pathor similarly PKCS11 engine and module paths - these are shared object which then get dynamically loaded into memory by
wpa_supplicant
- takes an argument called
- hence could overwrite existing functions and therefore get code execution as
root - since
wpa_supplicantruns as root - upstream actually includes a patch to hard-code these values at compile-time and not allow them to be specified in the config file BUT we don’t use this in Ubuntu since it was only introduced recently (so not all Ubuntu releases include it) but regardless, we want to support setups where these modules may live in different locations
- Discussed how to possibly fix this in LP: #2067613
- Is not an issue for upstream since the upstream policy only allows root to use this dbus method so there is no privilege escalation
- Could allow-list various paths but was not clear which ones to use
- Lukas from Foundations team (and maintainer of Netplan) tried searching for any users of these config parameters but couldn’t find anything in the archive
- However, users may still be configuring things so don’t want to break their setups
- Or could tighten up the DBus policy for the netdev group to NOT include
access to this method - but this may break existing things that are using
the netdev group and this method
- Marc from our team then tried looking for anything in Ubuntu which used
the
wpa_supplicantDBus interface - none appear to make use of the netdev group - Considered dropping support entirely for this feature which allows the netdev group access since in general this should be done with NetworkManager or netplan nowadays anyway
- But this is such a long-standing piece of functionality it wasn’t clear what the possible regression potential would be
- Marc from our team then tried looking for anything in Ubuntu which used
the
- Or we could patch
wpa_supplicantto check that the specified module was owned by root - this should then stop an unprivileged user from creating their own module and specifying it as it wouldn’t be owned by root- This looked promising and a patch was drafted and tested against the proof-of-concept and was able to block it
- However, Rory came back with some excellent research showing it could be
bypassed by some quite creative use of a crafted FUSE filesystem in
combination with overlayfs inside an unprivileged user namespace
(ie. unpriv userns strikes again)
- create a FUSE which lies about the uid of a file to say it is 0 (root)
- mount this as an unprivileged user
- create a new user and mount namespace through unshare
- within that (since you are “root”) mount an overlay filesystem using the FUSE fs
- Specify the path to this file using the special
rootlink inside the proc filesystem - which points to the actual root directory of that process - and since the FUSE fs lies about the UID it looks like root owned
- So at this point we were running out of ideas - Luci from our team suggested
manually walking the path to the specified file akin to how
realpathworks (which should block the ability to read it via the proc symlink)- but this was considered too complicated and possibly prone to a TOCTOU race
- Finally Marc proposed to simply allow-list anything under
/usr/lib- since anything installed from the archive would live here - in this case we simply callrealpath()directly on the provided path name and if it doesn’t start with /usr/lib then deny loading of the module - No way to race against this and would seem to have the least chance of regression
- Yes if using a non-standard location like
/optwould now fail BUT if you can write to/optthen you can write to somewhere in/usr/lib- so is easy to fix as well
- Yes if using a non-standard location like
- Was tested significantly both with a dummy PKCS11 provider as well as a real one to ensure works as expected (both to prevent the exploit but also to work as intended)
- Eventual solution then was both secure but also would appear to minimise the
chance of regressions
- None reported so far anyway ;)
- Demonstrates the careful balance between security and possible regressions
- Also the team effort of both the security team and other Ubuntu teams
- Thanks to Marc, Luci, Mark E, and Sudhakar on our side, and Lukas from Foundations, but most importantly to Rory from Snyk for both reporting the vuln but also in their help evaluating the various proposed solutions
Get in contact
Episode 233
2 augusti 2024 |
24 min
Overview
This week we take a look at the recent Crowdstrike outage and what we can learn from it compared to the testing and release process for security updates in Ubuntu, plus we cover details of vulnerabilities in poppler, phpCAS, EDK II, Python, OpenJDK and one package with over 300 CVE fixes in a single update.
This week in Ubuntu Security Updates
462 unique CVEs addressed
[USN-6915-1] poppler vulnerability (01:35)
- 1 CVEs addressed in Jammy (22.04 LTS), Noble (24.04 LTS)
- Installed by default in Ubuntu due to use by cups
- PDF document format describes a Catalog which has a tree of destinations - essentially hyperlinks within the document. These can be either a page number etc or a named location within the document. If open a crafted document with a missing name property for a destination - name would then be NULL and would trigger a NULL ptr deref -> crash -> DoS
[USN-6913-1] phpCAS vulnerability (02:26)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- Authentication library for PHP to allow PHP applications to authenticates users against a Central Authentication Server (ie. SSO).
- When used for SSO, a client who is trying to use a web application gets directed to the CAS. The CAS then authenticates the user and returns a service ticket - the client then needs to validate this ticket with the CAS since it could have possibly been injected via the application. To do this, pass the ticket along with its own service identifier to CAS - and if this succeeds is provided with the details of which user was authenticated etc.
- For clients, previously would use HTTP headers to determine where the CAS server was to authenticate the ticket. Since these can be manipulated by a malicious application, could essentially redirect the client to send the ticket to the attacker who could then use that to impersonate the client and login as the user.
- Fix requires a refactor to include an additional API parameter which specifies either a fixed CAS server for the client to use, or a mechanism to auto-discover this in a secure way - either way, applications using phpCAS now need to be updated.
[USN-6914-1] OCS Inventory vulnerability
- 1 CVEs addressed in Jammy (22.04 LTS)
- Same as above since has an embedded copy of phpCAS
[USN-6916-1] Lua vulnerabilities (04:44)
- 2 CVEs addressed in Jammy (22.04 LTS)
- Heap buffer over-read and a possible heap buffer over-flow via recursive error handling - looks like both require to be interpreting malicious code
[USN-6920-1] EDK II vulnerabilities (05:04)
- 5 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- UEFI firmware implementation in qemu etc
- Various missing bounds checks -> stack and heap buffer overflows -> DoS or code execution in BIOS context -> privilege escalation within VM
[USN-6928-1] Python vulnerabilities (05:49)
- 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- Memory race in the ssl module - can call into various functions to get certificate information at the same time as certs are loaded if happening to be doing a TLS handshake with a certificate directory configured - all via different threads. Python would then possibly return inconsistent results leading to various issues
- Occurs since ssl module is implemented in C to interface with openssl and did not properly lock access to the certificate store
[USN-6929-1, USN-6930-1] OpenJDK 8 and OpenJDK 11 vulnerabilities (06:52)
- 6 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
- Latest upstream releases of OpenJDK 8 and 11
- 8u422-b05-1, 11.0.24+8
- Fixes various issues in the Hotspot and Concurrency components
[USN-6931-1, USN-6932-1] OpenJDK 17 and OpenJDK 21 vulnerabilities (07:11)
- 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
- Latest upstream releases of OpenJDK 17 and 21
- 17.0.12+7, 21.0.4+7
- Fixes the same issues in the Hotspot component
[USN-6934-1] MySQL vulnerabilities (07:29)
- 15 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Noble (24.04 LTS)
- Also latest upstream release
- 8.0.39
- Bug fixes, possible new features and incompatible changes - consult release notes:
[USN-6917-1] Linux kernel vulnerabilities (07:57)
- 156 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- CVE-2024-35933
- CVE-2024-35910
- CVE-2024-27393
- CVE-2024-27004
- CVE-2024-27396
- CVE-2024-36029
- CVE-2024-26955
- CVE-2024-35976
- CVE-2024-26966
- CVE-2024-26811
- CVE-2024-35871
- CVE-2023-52699
- CVE-2024-35796
- CVE-2024-35851
- CVE-2024-35885
- CVE-2024-35813
- CVE-2024-35789
- CVE-2024-35825
- CVE-2024-26994
- CVE-2024-35815
- CVE-2024-27395
- CVE-2024-26981
- CVE-2024-35886
- CVE-2024-26931
- CVE-2024-35791
- CVE-2024-35849
- CVE-2024-35978
- CVE-2024-35895
- CVE-2024-35918
- CVE-2024-35902
- CVE-2024-26926
- CVE-2024-35934
- CVE-2024-35807
- CVE-2024-35805
- CVE-2024-36008
- CVE-2024-26950
- CVE-2024-26973
- CVE-2024-35898
- CVE-2024-35955
- CVE-2024-36004
- CVE-2024-36006
- CVE-2024-35990
- CVE-2024-35944
- CVE-2024-36007
- CVE-2024-35896
- CVE-2024-35819
- CVE-2024-26988
- CVE-2024-35872
- CVE-2024-36025
- CVE-2024-26957
- CVE-2024-35897
- CVE-2024-27016
- CVE-2024-35806
- CVE-2024-35927
- CVE-2022-48808
- CVE-2024-35960
- CVE-2024-27001
- CVE-2024-35970
- CVE-2024-35988
- CVE-2024-36005
- CVE-2024-35821
- CVE-2024-35925
- CVE-2024-26961
- CVE-2024-35817
- CVE-2024-26922
- CVE-2024-26976
- CVE-2024-35899
- CVE-2024-35984
- CVE-2024-26929
- CVE-2024-27018
- CVE-2024-35907
- CVE-2024-35884
- CVE-2023-52488
- CVE-2024-35982
- CVE-2024-26934
- CVE-2024-26935
- CVE-2024-35973
- CVE-2024-26958
- CVE-2024-27008
- CVE-2024-35809
- CVE-2024-26951
- CVE-2024-35900
- CVE-2024-35888
- CVE-2024-26965
- CVE-2024-26828
- CVE-2024-35935
- CVE-2024-35857
- CVE-2024-26642
- CVE-2024-26989
- CVE-2024-35893
- CVE-2024-35877
- CVE-2024-27009
- CVE-2024-35785
- CVE-2024-35905
- CVE-2024-27020
- CVE-2024-35901
- CVE-2024-26956
- CVE-2024-26977
- CVE-2024-26969
- CVE-2024-26810
- CVE-2024-26813
- CVE-2024-35930
- CVE-2024-26970
- CVE-2024-26687
- CVE-2024-27015
- CVE-2024-35847
- CVE-2024-26999
- CVE-2024-35940
- CVE-2024-35890
- CVE-2024-26814
- CVE-2024-35958
- CVE-2024-35804
- CVE-2024-26629
- CVE-2024-26974
- CVE-2023-52880
- CVE-2024-26937
- CVE-2024-35922
- CVE-2024-35854
- CVE-2024-27013
- CVE-2024-35853
- CVE-2024-27000
- CVE-2024-35989
- CVE-2024-35852
- CVE-2024-35823
- CVE-2024-36020
- CVE-2024-36031
- CVE-2024-26923
- CVE-2024-26654
- CVE-2024-26925
- CVE-2024-35855
- CVE-2024-35997
- CVE-2024-35822
- CVE-2024-27019
- CVE-2024-35938
- CVE-2024-35915
- CVE-2024-35912
- CVE-2024-35936
- CVE-2024-35969
- CVE-2024-27059
- CVE-2024-26964
- CVE-2024-27437
- CVE-2024-26960
- CVE-2024-35950
- CVE-2024-26817
- CVE-2024-26984
- CVE-2024-26812
- CVE-2024-35879
- CVE-2024-26996
- CVE-2024-26993
- CVE-2024-25739
- CVE-2024-24861
- CVE-2024-24859
- CVE-2024-24858
- CVE-2024-24857
- CVE-2024-23307
- CVE-2022-38096
- 5.15 - Azure + FDE (CVM)
[USN-6918-1] Linux kernel vulnerabilities
- 180 CVEs addressed in Noble (24.04 LTS)
- CVE-2024-24859
- CVE-2024-24858
- CVE-2024-24857
- CVE-2024-35932
- CVE-2024-35937
- CVE-2024-27006
- CVE-2024-35960
- CVE-2024-27011
- CVE-2024-35924
- CVE-2024-35946
- CVE-2024-35942
- CVE-2024-35921
- CVE-2024-35908
- CVE-2024-26811
- CVE-2024-27008
- CVE-2024-35871
- CVE-2024-36019
- CVE-2024-35965
- CVE-2024-35973
- CVE-2024-26981
- CVE-2024-27009
- CVE-2024-27019
- CVE-2024-36022
- CVE-2024-35910
- CVE-2024-35907
- CVE-2024-35860
- CVE-2024-35951
- CVE-2024-26924
- CVE-2024-26921
- CVE-2024-35901
- CVE-2024-35972
- CVE-2024-35889
- CVE-2024-27017
- CVE-2024-35913
- CVE-2024-35936
- CVE-2024-36025
- CVE-2024-35961
- CVE-2024-35977
- CVE-2024-35902
- CVE-2024-26817
- CVE-2024-26994
- CVE-2023-52699
- CVE-2024-35868
- CVE-2024-35899
- CVE-2024-35888
- CVE-2024-26995
- CVE-2024-35865
- CVE-2024-26993
- CVE-2024-35863
- CVE-2024-35970
- CVE-2024-35943
- CVE-2024-35875
- CVE-2024-35978
- CVE-2024-27005
- CVE-2024-35909
- CVE-2024-35957
- CVE-2024-35950
- CVE-2024-26986
- CVE-2024-36020
- CVE-2024-35952
- CVE-2024-26928
- CVE-2024-35878
- CVE-2024-35954
- CVE-2024-26998
- CVE-2024-36024
- CVE-2024-26936
- CVE-2024-27018
- CVE-2024-35900
- CVE-2024-35940
- CVE-2024-35985
- CVE-2024-35944
- CVE-2024-35958
- CVE-2024-35864
- CVE-2024-35975
- CVE-2024-27002
- CVE-2024-36018
- CVE-2024-35974
- CVE-2024-26926
- CVE-2024-35877
- CVE-2024-35916
- CVE-2024-35934
- CVE-2024-35930
- CVE-2024-35898
- CVE-2024-35893
- CVE-2024-35887
- CVE-2024-35929
- CVE-2024-26923
- CVE-2024-35911
- CVE-2024-35919
- CVE-2024-26984
- CVE-2024-27016
- CVE-2024-35926
- CVE-2024-35872
- CVE-2024-35922
- CVE-2024-27007
- CVE-2024-35931
- CVE-2024-36021
- CVE-2024-35953
- CVE-2024-27004
- CVE-2024-27001
- CVE-2024-27014
- CVE-2024-35866
- CVE-2024-27021
- CVE-2024-35870
- CVE-2024-35925
- CVE-2024-35891
- CVE-2024-26982
- CVE-2024-35879
- CVE-2024-35979
- CVE-2024-35912
- CVE-2024-35982
- CVE-2024-27015
- CVE-2024-26985
- CVE-2024-35861
- CVE-2024-35939
- CVE-2024-27003
- CVE-2024-35945
- CVE-2024-35967
- CVE-2024-35966
- CVE-2024-26983
- CVE-2024-35894
- CVE-2024-35896
- CVE-2024-36027
- CVE-2024-35895
- CVE-2024-26987
- CVE-2024-35873
- CVE-2024-26996
- CVE-2024-26991
- CVE-2024-27013
- CVE-2024-36026
- CVE-2024-26922
- CVE-2024-35897
- CVE-2024-35917
- CVE-2024-35968
- CVE-2024-35890
- CVE-2024-35904
- CVE-2024-35867
- CVE-2024-35933
- CVE-2024-35918
- CVE-2024-35920
- CVE-2024-26997
- CVE-2024-35981
- CVE-2024-35963
- CVE-2024-26989
- CVE-2024-26999
- CVE-2024-35892
- CVE-2024-27010
- CVE-2024-26992
- CVE-2024-35935
- CVE-2024-27022
- CVE-2024-35971
- CVE-2024-35956
- CVE-2024-35862
- CVE-2024-35969
- CVE-2024-27012
- CVE-2024-26990
- CVE-2024-35885
- CVE-2024-26925
- CVE-2024-35905
- CVE-2024-35914
- CVE-2024-35884
- CVE-2024-35927
- CVE-2024-35882
- CVE-2024-26980
- CVE-2024-35964
- CVE-2024-35955
- CVE-2024-27020
- CVE-2024-35980
- CVE-2024-35903
- CVE-2024-35976
- CVE-2024-35886
- CVE-2024-35883
- CVE-2024-35959
- CVE-2024-35915
- CVE-2024-35880
- CVE-2024-27000
- CVE-2024-35938
- CVE-2024-35869
- CVE-2024-36023
- CVE-2024-26988
- 6.8 - Oracle
[USN-6919-1] Linux kernel vulnerabilities
- 304 CVEs addressed in Jammy (22.04 LTS)
- CVE-2024-35976
- CVE-2023-52880
- CVE-2024-35849
- CVE-2024-27073
- CVE-2024-35934
- CVE-2024-27038
- CVE-2024-26973
- CVE-2024-35853
- CVE-2024-27047
- CVE-2024-36007
- CVE-2024-27024
- CVE-2024-26750
- CVE-2024-26833
- CVE-2024-26960
- CVE-2024-26929
- CVE-2023-52488
- CVE-2024-27417
- CVE-2024-26922
- CVE-2024-26863
- CVE-2024-35890
- CVE-2024-27015
- CVE-2024-27395
- CVE-2024-26779
- CVE-2024-27419
- CVE-2024-27013
- CVE-2024-26981
- CVE-2024-26798
- CVE-2024-26895
- CVE-2024-35922
- CVE-2023-52699
- CVE-2024-26883
- CVE-2024-35871
- CVE-2024-27410
- CVE-2024-26884
- CVE-2024-26885
- CVE-2024-27074
- CVE-2024-26751
- CVE-2024-26857
- CVE-2024-26848
- CVE-2024-26901
- CVE-2024-35844
- CVE-2024-35809
- CVE-2024-26687
- CVE-2024-35988
- CVE-2024-26835
- CVE-2024-26764
- CVE-2024-27020
- CVE-2024-35907
- CVE-2024-35886
- CVE-2024-27077
- CVE-2024-26787
- CVE-2024-26950
- CVE-2024-26974
- CVE-2024-35905
- CVE-2024-27008
- CVE-2024-26744
- CVE-2024-35935
- CVE-2024-26988
- CVE-2024-26748
- CVE-2024-26776
- CVE-2024-26907
- CVE-2024-27053
- CVE-2024-35970
- CVE-2024-35950
- CVE-2024-35854
- CVE-2024-35822
- CVE-2024-26961
- CVE-2024-26733
- CVE-2024-26773
- CVE-2024-27390
- CVE-2024-35888
- CVE-2024-36029
- CVE-2024-26643
- CVE-2024-35821
- CVE-2024-35819
- CVE-2024-26809
- CVE-2024-35984
- CVE-2024-26851
- CVE-2024-35940
- CVE-2024-26654
- CVE-2024-35910
- CVE-2024-26891
- CVE-2024-26793
- CVE-2024-35938
- CVE-2024-26736
- CVE-2024-26583
- CVE-2024-26870
- CVE-2024-35828
- CVE-2024-35885
- CVE-2024-35958
- CVE-2024-26889
- CVE-2024-35899
- CVE-2024-26839
- CVE-2024-26894
- CVE-2024-26937
- CVE-2024-35925
- CVE-2024-35933
- CVE-2024-26771
- CVE-2024-26923
- CVE-2024-26852
- CVE-2024-26924
- CVE-2024-26872
- CVE-2024-26774
- CVE-2024-35930
- CVE-2024-27065
- CVE-2024-26993
- CVE-2024-27034
- CVE-2024-36020
- CVE-2024-26802
- CVE-2024-26976
- CVE-2022-48808
- CVE-2024-35847
- CVE-2024-26996
- CVE-2024-36025
- CVE-2023-52652
- CVE-2024-27403
- CVE-2023-52447
- CVE-2024-27037
- CVE-2024-27413
- CVE-2024-26749
- CVE-2024-26956
- CVE-2024-26958
- CVE-2024-26754
- CVE-2024-26812
- CVE-2024-26772
- CVE-2024-27436
- CVE-2024-27437
- CVE-2024-35912
- CVE-2024-35805
- CVE-2024-26845
- CVE-2024-35990
- CVE-2024-35791
- CVE-2024-26906
- CVE-2024-27039
- CVE-2024-26915
- CVE-2024-26970
- CVE-2024-26782
- CVE-2024-26813
- CVE-2023-52645
- CVE-2024-26935
- CVE-2024-27076
- CVE-2024-35823
- CVE-2024-26743
- CVE-2024-26846
- CVE-2024-26811
- CVE-2024-26989
- CVE-2024-26642
- CVE-2024-26659
- CVE-2024-26766
- CVE-2024-27393
- CVE-2024-26859
- CVE-2024-35898
- CVE-2024-35893
- CVE-2023-52640
- CVE-2024-26795
- CVE-2024-27009
- CVE-2024-26791
- CVE-2024-27043
- CVE-2024-26934
- CVE-2024-27051
- CVE-2024-26804
- CVE-2024-26878
- CVE-2024-27030
- CVE-2024-27000
- CVE-2024-26777
- CVE-2024-35825
- CVE-2024-27415
- CVE-2024-27001
- CVE-2024-27004
- CVE-2024-26769
- CVE-2024-26816
- CVE-2024-35807
- CVE-2024-35900
- CVE-2024-35851
- CVE-2024-27052
- CVE-2024-26805
- CVE-2024-35804
- CVE-2024-35944
- CVE-2024-35895
- CVE-2024-26897
- CVE-2024-27045
- CVE-2024-26814
- CVE-2024-26801
- CVE-2024-26874
- CVE-2024-35982
- CVE-2024-35915
- CVE-2024-26820
- CVE-2024-26603
- CVE-2024-35997
- CVE-2024-26688
- CVE-2024-27054
- CVE-2024-26828
- CVE-2024-35857
- CVE-2023-52662
- CVE-2024-35989
- CVE-2024-36005
- CVE-2024-35785
- CVE-2024-27396
- CVE-2024-35884
- CVE-2023-52650
- CVE-2024-26882
- CVE-2024-26879
- CVE-2024-26898
- CVE-2024-27388
- CVE-2024-35879
- CVE-2024-35918
- CVE-2024-35978
- CVE-2024-26585
- CVE-2024-35872
- CVE-2023-52497
- CVE-2024-26778
- CVE-2024-26999
- CVE-2024-27046
- CVE-2023-52434
- CVE-2024-26862
- CVE-2024-26810
- CVE-2024-35796
- CVE-2024-35960
- CVE-2024-35969
- CVE-2024-26966
- CVE-2024-26856
- CVE-2024-35936
- CVE-2024-35955
- CVE-2024-26763
- CVE-2024-35806
- CVE-2024-27059
- CVE-2024-35855
- CVE-2024-36008
- CVE-2024-27075
- CVE-2023-52620
- CVE-2024-26931
- CVE-2024-35813
- CVE-2024-26788
- CVE-2024-27412
- CVE-2024-26861
- CVE-2024-36004
- CVE-2024-26951
- CVE-2024-26903
- CVE-2024-26584
- CVE-2024-35877
- CVE-2024-26792
- CVE-2024-27416
- CVE-2024-27432
- CVE-2024-26651
- CVE-2024-35852
- CVE-2024-35973
- CVE-2023-52656
- CVE-2024-26965
- CVE-2024-26969
- CVE-2024-26840
- CVE-2024-26817
- CVE-2024-27028
- CVE-2024-26752
- CVE-2024-27016
- CVE-2023-52641
- CVE-2024-35789
- CVE-2024-27078
- CVE-2024-26994
- CVE-2024-26629
- CVE-2024-26803
- CVE-2024-26977
- CVE-2024-35830
- CVE-2024-27019
- CVE-2024-26957
- CVE-2024-36006
- CVE-2024-35817
- CVE-2024-26601
- CVE-2024-35845
- CVE-2024-35897
- CVE-2024-27414
- CVE-2024-26855
- CVE-2024-26877
- CVE-2024-35829
- CVE-2024-35896
- CVE-2024-26875
- CVE-2024-27405
- CVE-2024-26747
- CVE-2023-52644
- CVE-2024-26881
- CVE-2024-26735
- CVE-2024-26843
- CVE-2024-26926
- CVE-2024-26880
- CVE-2024-26964
- CVE-2024-27044
- CVE-2024-26737
- CVE-2024-27431
- CVE-2024-26955
- CVE-2024-26790
- CVE-2024-26925
- CVE-2024-26838
- CVE-2024-26984
- CVE-2024-25739
- CVE-2024-24861
- CVE-2024-24859
- CVE-2024-24858
- CVE-2024-24857
- CVE-2024-23307
- CVE-2024-22099
- CVE-2024-21823
- CVE-2024-0841
- CVE-2023-7042
- CVE-2023-6270
- CVE-2022-38096
- 5.15 - Raspi
[USN-6922-1] Linux kernel vulnerabilities
- 4 CVEs addressed in Jammy (22.04 LTS)
- 6.5 - NVIDIA
[USN-6923-1, USN-6923-2] Linux kernel vulnerabilities
- 6 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- 5.15 - generic, AWS, GCP, GKE, HWE, Intel-IOTG, KVM, LowLatency, NVIDIA, Oracle, IBM, Raspi
[USN-6921-1, USN-6921-2] Linux kernel vulnerabilities
- 7 CVEs addressed in Noble (24.04 LTS)
- 6.8 - generic, AWS, GCP, GKE, IBM, NVIDIA, OEM, Raspi, LowLatency
[USN-6924-1, USN-6924-2] Linux kernel vulnerabilities
- 7 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- 5.4 - generic, AWS, Azure, Bluefield, GCP, GKE, HWE, IBM, IOT, KVM, Raspi, Xilinx-ZynqMP
[USN-6925-1] Linux kernel vulnerability
- 1 CVEs addressed in Trusty ESM (14.04 ESM)
- 3.13 - generic, lowlatency, server, virtual
[USN-6926-1] Linux kernel vulnerabilities
- 30 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- CVE-2023-52752
- CVE-2023-52444
- CVE-2024-26882
- CVE-2023-52449
- CVE-2024-26934
- CVE-2024-26840
- CVE-2024-36016
- CVE-2024-27020
- CVE-2023-52443
- CVE-2024-26923
- CVE-2024-26857
- CVE-2024-36902
- CVE-2024-35982
- CVE-2024-26886
- CVE-2024-35978
- CVE-2023-52469
- CVE-2024-26901
- CVE-2024-26884
- CVE-2023-52436
- CVE-2024-35997
- CVE-2023-52620
- CVE-2024-35984
- CVE-2024-27013
- CVE-2023-52435
- CVE-2024-25744
- CVE-2024-25739
- CVE-2024-24859
- CVE-2024-24858
- CVE-2024-24857
- CVE-2023-46343
- 4.15 - generic, AWS, HWE, GCP, KVM, Oracle
[USN-6927-1] Linux kernel vulnerabilities
- 161 CVEs addressed in Focal (20.04 LTS)
- CVE-2024-27008
- CVE-2024-26951
- CVE-2024-26970
- CVE-2024-35815
- CVE-2024-26828
- CVE-2024-35898
- CVE-2024-26999
- CVE-2024-35938
- CVE-2024-27016
- CVE-2024-35825
- CVE-2024-35950
- CVE-2024-26969
- CVE-2024-26643
- CVE-2024-26924
- CVE-2024-36025
- CVE-2023-52752
- CVE-2024-35936
- CVE-2024-35847
- CVE-2024-26964
- CVE-2024-35857
- CVE-2024-35854
- CVE-2024-27437
- CVE-2024-35851
- CVE-2024-26654
- CVE-2024-26629
- CVE-2024-26988
- CVE-2024-27001
- CVE-2024-26956
- CVE-2024-35990
- CVE-2024-27020
- CVE-2024-26996
- CVE-2024-35817
- CVE-2024-26950
- CVE-2024-26810
- CVE-2024-35893
- CVE-2024-35852
- CVE-2024-35895
- CVE-2024-27009
- CVE-2024-26687
- CVE-2024-35821
- CVE-2024-35944
- CVE-2024-27015
- CVE-2024-35822
- CVE-2024-35823
- CVE-2024-35890
- CVE-2024-35973
- CVE-2024-27013
- CVE-2024-35912
- CVE-2024-26817
- CVE-2024-35935
- CVE-2024-26989
- CVE-2024-35877
- CVE-2024-26926
- CVE-2024-35849
- CVE-2024-26993
- CVE-2024-26974
- CVE-2024-35791
- CVE-2024-35910
- CVE-2024-36008
- CVE-2024-35988
- CVE-2024-26813
- CVE-2024-36006
- CVE-2024-35879
- CVE-2024-35789
- CVE-2024-35969
- CVE-2024-35925
- CVE-2024-26984
- CVE-2024-35871
- CVE-2024-35853
- CVE-2024-27004
- CVE-2024-35899
- CVE-2024-26931
- CVE-2024-35934
- CVE-2024-35796
- CVE-2024-36020
- CVE-2023-52699
- CVE-2024-35930
- CVE-2024-26957
- CVE-2024-35804
- CVE-2024-26922
- CVE-2024-26814
- CVE-2024-35900
- CVE-2024-27395
- CVE-2024-26642
- CVE-2024-26960
- CVE-2024-26935
- CVE-2024-36005
- CVE-2024-26981
- CVE-2024-26934
- CVE-2024-26976
- CVE-2024-35806
- CVE-2024-35915
- CVE-2024-35922
- CVE-2022-48808
- CVE-2024-26973
- CVE-2024-35933
- CVE-2024-35785
- CVE-2024-26937
- CVE-2024-35918
- CVE-2024-27000
- CVE-2024-26977
- CVE-2024-27393
- CVE-2024-35984
- CVE-2024-35970
- CVE-2024-27019
- CVE-2024-26955
- CVE-2024-35888
- CVE-2024-35976
- CVE-2024-35982
- CVE-2024-35805
- CVE-2024-35960
- CVE-2024-26812
- CVE-2024-27017
- CVE-2024-26966
- CVE-2023-52880
- CVE-2024-27396
- CVE-2024-35809
- CVE-2024-35997
- CVE-2024-26958
- CVE-2024-26961
- CVE-2024-26923
- CVE-2024-26811
- CVE-2024-35813
- CVE-2024-36029
- CVE-2024-35896
- CVE-2024-26965
- CVE-2024-35885
- CVE-2024-35855
- CVE-2024-36007
- CVE-2024-26929
- CVE-2024-35897
- CVE-2024-35905
- CVE-2024-27018
- CVE-2024-26886
- CVE-2024-35884
- CVE-2023-52488
- CVE-2024-36016
- CVE-2024-35872
- CVE-2024-35819
- CVE-2024-35907
- CVE-2024-26952
- CVE-2024-35940
- CVE-2024-35989
- CVE-2024-27059
- CVE-2024-26925
- CVE-2024-35955
- CVE-2024-36004
- CVE-2024-26994
- CVE-2024-35807
- CVE-2024-35886
- CVE-2024-35978
- CVE-2024-35958
- CVE-2024-35902
- CVE-2024-25742
- CVE-2024-25739
- CVE-2024-24861
- CVE-2024-24859
- CVE-2024-24858
- CVE-2024-24857
- CVE-2024-23307
- CVE-2022-38096
- 5.15 - GCP
Goings on in Ubuntu Security Community
Discussion of testing for security updates in light of CrowdStrike (11:20)
- Recent outage of over 8 million Windows machines running CrowdStrike Falcon
- Initially very little information on what happened - CS have now released more details about the apparent testing that was done but clearly were never actually testing the combination of Windows + Falcon + Rapid Response Content otherwise would have observed this failure immediately
- Also clearly didn’t have any kind of staged/phased update process in place either
- If you want to read a good analysis of the response from CS,
https://verse.systems/blog/post/2024-07-25-parsing-crowdstrikes-post/
- Toby Murray (full disclosure, my brother) - Associate Professor and Co-Lead of Computer Science Research Group at School of Computing and Information Systems, University of Melbourne, Director, Defence Science Institute (Vic & Tas)
- Future plans from CS now include gradual deployment of rules with “canaries” etc and then increased testing:
- Local dev testing, content update testing, stress, fuzz, fault-injection, stability and interface testing
- Toby (not surprisingly as an expert in formal software verification) advocates for a formal approach to validating rules and in-kernel code etc
- If you want to read a good analysis of the response from CS,
https://verse.systems/blog/post/2024-07-25-parsing-crowdstrikes-post/
- What can we learn from this for Ubuntu?
- Formal methods might be tractable for a large company like CS who is
developing a single, specific product like Falcon (particularly if they can
reduce the size of their kernel module), this is not the case for a Linux
distribution like Ubuntu which collates over 30,000 different open source
software projects
- over 4TB of source code across the various releases
- Formal methods might be tractable for a large company like CS who is
developing a single, specific product like Falcon (particularly if they can
reduce the size of their kernel module), this is not the case for a Linux
distribution like Ubuntu which collates over 30,000 different open source
software projects
- Instead have to take the pragmatic approach of thorough testing
- For regular SRUs - detailed review by SRU team including a thorough test plan, cross-package testing via Autopkgtest plus a minimum 7 day “soak” testing in the proposed pocket of the release before being pushed into the -updates pocket
- Once in -updates, Phased Updates implements the gradual deployment model -
you can check the progress of various updates at
https://ubuntu-archive-team.ubuntu.com/phased-updates.html
- Watches for increased error reports via errors.ubuntu.com (captured via apport/whoopsie) and if detected stops the release of the package to users
- Compare that to the process for Security updates
- Separate -security pocket in the archive which packages get published to
immediately
- No standardised review by separate team
- instead adhoc reviews within the security team
- No documented test plan per update
- instead thorough test procedures including:
- checking for any changes in the build log (e.g. new compiler warnings/errors) and comparing the difference between the generated binaries (e.g. new / changed / missing symbols - ABI breaks)
- testing of the patched code including stepping through it with a debugger
- running any existing PoC or creating one if none exists and is feasible
- running any existing unit/integration tests within the package (including dep8/autopkgtests)
- test apt upgrade of the package is smooth
- QA regression testing scripts - maintained by the security team, implement various regression tests and system-level tests for different packages to exercise them in various different configurations
- instead thorough test procedures including:
- Cross-package testing via security-britney - instance of the autopkgtest infrastructure that runs against the public Ubuntu Security Proposed PPA (and we have a similar internal instance for the different private PPAs we use for embargoed updates or ESM etc)
- No phased updates - instead immediate updates via specific
security.ubuntu.com archive, combined with unattended-upgrades
- designed to deliver security updates as soon as possible to remediate issues
- No standardised review by separate team
- Separate -security pocket in the archive which packages get published to
immediately
- In general, I would argue that the process we have in place results in more thorough testing for security updates - particularly checking for anything anomalous like new compiler warnings / symbols / unexpected changes in binaries etc as well as more thorough, standardised testing for packages through the QA Regression Testing repo scripts
- However, the lack of phased/progressive updates combined with the separate security.ubuntu.com archive and unattended-upgrades on by default, means any security update is delivered to Ubuntu users within 24 hours (on average) - BUT then any regression is also rolled out to all users in 24 hours as well
- As such, kicking off discussions around possible changes to our deployment strategy to potentially introduce some more guard rails on the deployment side
- If you have any thoughts, please let us know
Get in contact
Episode 232
5 juli 2024 |
29 min
Overview
This week we deep-dive into one of the best vulnerabilities we’ve seen in a long time regreSSHion - an unauthenticated, remote, root code-execution vulnerability in OpenSSH. Plus we cover updates for Plasma Workspace, Ruby, Netplan, FontForge, OpenVPN and a whole lot more.
This week in Ubuntu Security Updates
39 unique CVEs addressed
[USN-6843-1] Plasma Workspace vulnerability (01:23)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- KDE Session Manager - used for restoring previously running applications at next boot
- Provides ability to clients to connect to it via Inter-Client Exchange (ICE) protocol - protocol within X for allowing X clients to interact with one-another
- Since X supports remote clients, is important to authenticate connections - in this case KDE SM would authenticate to ensure the connection was coming from the local machine - but this could then allow any local user to connect to another users SM and hence use the session management features to set some arbitrary application to be run when the session is restored - as that other user
[USN-6852-1, USN-6852-2] Wget vulnerability (02:42)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- mishandled semicolons in userinfo of a URL - this is the
user@host:portcombination - so would possibly then use a different hostname than the one the user expected
[USN-6853-1] Ruby vulnerability (03:12)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Provides methods
ungetbyte()/ungetc()to push-back characters on an IO stream - would possibly read beyond the end of the buffer - OOB read
[USN-6851-1] Netplan vulnerabilities (03:37)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- Two different issues
- When configuring a Wireguard interface, would write the wireguard private key into the netplan interface configuration - but would then leave this with world-readable permissions
- This can either be specified as the filename to the private key OR the
private key itself - so if had chosen to specify the actual private key,
this is now world-readable to any other user
- Fixed to use restrictive permissions on the generated configuration files and to fixup any existing ones as well
- Failed to escape control characters in various backend files - a malicious application that is able to create a netplan configuration could then abuse this to get code execution as netplan
[USN-6851-2] Netplan regression
- Affecting Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- Failed to properly do the permissions fixup on already existing files
[USN-6854-1] OpenSSL vulnerability (05:10)
- 1 CVEs addressed in Jammy (22.04 LTS)
- Related to a historical vulnerability - https://dheatattack.gitlab.io/ - CVE-2002-20001
- DoS against Diffie-Hellman key exchange protocol - during key negotiation a client can trigger expensive CPU calculations -> CPU-based DoS
[USN-6856-1] FontForge vulnerabilities (05:50)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Uses various external utilities to do things like decompress archive files etc
- However, would do this via the
system()system-call - which spawns a shell - so if a filename contained any shell metacharacters, could then just easily get arbitrary code execution - Changed to use the utility functions from glib that do not spawn a shell and instead just exec() the expected command directly
[USN-6857-1] Squid vulnerabilities (06:48)
- 6 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
[USN-6566-2] SQLite vulnerability
- 1 CVEs addressed in Bionic ESM (18.04 ESM)
[USN-5615-3] SQLite vulnerability
- 3 CVEs addressed in Trusty ESM (14.04 ESM)
[USN-6855-1] libcdio vulnerability (06:58)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- ISO file parser - used strcpy() instead of strncpy() so could be made to quite easily achieve buffer overflow and hence possible code-execution
[USN-6858-1] eSpeak NG vulnerabilities (07:33)
- 5 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- speech synthesiser - pass file to it and it will read it aloud
- various buffer overflows when parsing different formats - found by a researcher via fuzzing
[USN-6844-2] CUPS regression (07:51)
- Affecting Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- [USN-6844-1] CUPS vulnerability from Episode 231
[USN-6860-1] OpenVPN vulnerabilities (07:57)
- 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- Client was able to keep the session alive even when the server had been instructed to disconnect the client
- Client was able to send junk/non-printable characters in the control channel since would then get logged and possibly allow to corrupt the log file or cause high CPU load
[USN-6862-1] Firefox vulnerabilities (08:27)
- 13 CVEs addressed in Focal (20.04 LTS)
- 127.0.2
[USN-6859-1] OpenSSH vulnerability
- 1 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
Goings on in Ubuntu Security Community
Deep-dive into regreSSHion - Remote Unauthenticated Code Execution Vulnerablity in OpenSSH
- https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server
- https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt
- https://ubuntu.com/blog/ubuntu-regresshion-security-fix
- First notified late last week by Qualys of a pending update for OpenSSH which
fixes a newly discovered unauthenticated remote code execution vulnerability -
as root - this is about as bad as it can get
- Exactly the kind of thing that “Jia Tan” spent all that time working on in xz-utils to try and achieve (xz-utils backdoor and Ubuntu from Episode 224)
- Qualys are quite specific to note that this only affects OpenSSH on glibc (so distros which use say musl are not affected) - due to the intricacies of the vulnerablity and how they exploit it
- Also OpenSSH is quite carefully designed - employs privilege separation to try keep the privileged part as minimal as possible - but in this case, the vuln is in this privielged part, hence why code execution as root
- OpenSSH developers released 9.8p1 on Monday this week which has some quite significant refactoring to help address this vuln - in particular it includes functionality similar to fail2ban to penalise clients that appear to be malicious AND it employs even more privilege separation than before
- Qualys are quite careful to say that they think OpenSSH is one of the most secure pieces of software in the world “near-flawless implementation” with inspirational defense-in-depth - but clearly bugs still slip through
- In this case is a signal handler race condition
- Diversion - what are signals?
- signal (7)
- simple, asynchronous form of IPC which allows sending a single piece of information - the type of signal
- many different types - e.g. SIGSEGV for invalid memory access, or SIGFPE for a math error - or can be sent by other processes - SIGTERM / SIGKILL / SIGINT
- process can then set itself up so that a particular signal handler function of its choosing is invoked for a given signal
- when a signal is sent to a process, it is queued up and then delivered to a process the next time the kernel returns from kernel space to that process - ie. when returning from a system-call or scheduling of that process
- to deliver it, kernel constructs an entirely new stack frame and passes execution to the signal handler function - this runs and then eventually returns control back to the original thread of the process
- simple, asynchronous form of IPC which allows sending a single piece of information - the type of signal
- Signal handlers are special - since they run on their own special stack
and outside of the normal thread of execution of the process, they can
potentially cause issues if they do things which modify the global state
of the process - many regular functions are off-limits within signal
handlers since they can inadvertently modify such global state
- only some functions are hence async-signal-safe (7)
- list contains a lot of functions BUT many which might ordinarily get
used are not included - in particular
malloc()/free()
- list contains a lot of functions BUT many which might ordinarily get
used are not included - in particular
- only some functions are hence async-signal-safe (7)
- This vuln was caused then by use of one of these async unsafe functions
- signal (7)
- OpenSSH has a functionality called LoginGraceTime which allows an admin to
configure how long OpenSSH will allow a client to take to login - if they
don’t log in in that time then it closes the connection
- Since this code is all single-threaded, can’t just have the code which is listening to the client connection bail out easily - so instead this is implemented via the SIGALARM signal - used by the alarm (2) system call to configure the SIGALARM signal to be delivered to a process some number of seconds later
- Unfortunately in the signal handler function for this SIGALARM, OpenSSH
can end up calling
syslog()when trying to which is one of those unsafe functions- in glibc
syslog()will potentially callmalloc()/free()which as we mentioned earlier is not async safe- it is possible that the original thread may be in the middle of a call
to
malloc() / free()and thenSIGALARMsignal is delivered (sincemalloc()/free()calls brk (2) system call under the hood and so a pending signalSIGALARMmay be delivered on return frombrk()) - both the original thread and the signal handler are then calling
malloc()at the same time - corrupting the global state of the heap etc - as we know, if can corrupt the heap state ‘correctly’ can get code execution
- but requires the ability to win this race
- it is possible that the original thread may be in the middle of a call
to
- in glibc
- In fact, this is a reoccurrence of historical CVE-2006-5051 - discovered by
Mark Dowd but subsequently fixed
- code in question was refactored in October 2020 and released in OpenSSH
8.5p1 which would then call
syslog()during theSIGALARMsignal handler
- code in question was refactored in October 2020 and released in OpenSSH
8.5p1 which would then call
- Diversion - what are signals?
- To exploit this, Qualys take inspiration from a 2001 paper by Michal Zalewski (aka lcamtuf previously Director of Information Security Engineering at Google and now VP Security Engineering at Snap (ie Snapchat etc))
- Even so, it is an incredibly difficult path to get to a working exploit - both
since this is a race-condition so it is very hard to get the right timing
conditions and second due to defence-in-depth measures like ASLR
- First develop an exploit for the original 2006 CVE against a couple older versions
- OpenSSH 3.4p1 on Debian Woody
- even on i386 which has much worse ASLR than amd64, takes 10,000 tries to win the race - even then with 10 concurrent connections and each with a LoginGraceTime of 5 minutes - ~1week to get a remote root shell
- OpenSSH 4.2p1 on Ubuntu 6.06 (Dapper Drake) - first LTS version of
Ubuntu - this vuln was patched during the lifetime of 6.06 release but
original install media still contains the unpatched version
- Similarly, takes ~10,000 tries to win the race - with LoginGraceTime of only 2 minutes can reduce the time to get a remote root shell to 1-2 days
- Finally, OpenSSH 9.2p1 from current Debian stable on i386
- 10,000 tries - now 100 connections with 2 minutes grace time - in practice still ~6-8 hours since still have to guess the address used by glibc and due to ASLR is only 50% accurate
- OpenSSH 3.4p1 on Debian Woody
- First develop an exploit for the original 2006 CVE against a couple older versions
- All of these are lab conditions - VMs with quite stable network - and only on i386 - but Qualys say they were starting on an exploit even for amd64 but didn’t continue after they noticed a related bug report about this async-unsafe signal handling - so decided that may draw attention to the issue and others may discover the vuln and start exploiting it - so best to disclose it in its current state
- For Ubuntu, since this only affects version since 8.5p1, only 22.04 LTS onwards were affected - we released patches on Monday - unattended-upgrades is enabled by default on all relases since 16.04 LTS anyway - checks for and installs security updates every 24 hours - so any affected Ubuntu users would likely have been automatically patched within ~24 of the vuln becoming public (and the restart logic in OpenSSH would have restarted the service when it got upgraded as well)
- Other thing which is more internal for Ubuntu is that Qualys explicitly called
out OpenSSH in 24.04 LTS as having a deficiency in the enablement of ASLR -
since we are using systemd socket activation we disable reexec support for
OpenSSH - so it never reexecutes itself for its child processes - so they
never get the benefit of ASLR - BUT by chance it also makes this unexploitable
since it changes the use of
syslog()within OpenSSH so thatsyslog()gets called early on in the use of OpenSSH and so then when it gets called in the SIGALARM signal handler it doesn’t do the same memory allocation and hence can’t be used to corrupt memory and get code execution
Get in contact
Episode 231
28 juni 2024 |
19 min
Overview
A look into CISA’s Known Exploited Vulnerability Catalogue is on our minds this week, plus we look at vulnerability updates for gdb, Ansible, CUPS, libheif, Roundcube, the Linux kernel and more.
This week in Ubuntu Security Updates
175 unique CVEs addressed
[USN-6842-1] gdb vulnerabilities (01:10)
- 6 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- a couple of these are inherited from binutils as they share that code - parsing of crafted ELF executables -> NULL ptr deref or possible heap based buffer overflow -> DoS/RCE
- other stack and heap buffer overflows as well - parsing of crafted ada files and crafted debug info files as well -> DoS/RCE
[USN-6845-1] Hibernate vulnerability (02:12)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- Object relational-mapping (ORM) library for Java
- SQL injection in the JPA Criteria API implementation - could allow unvalidated literals when they are used in the SQL comments of a query when logging is enabled - fixed by properly escaping comments in this case
[USN-6846-1] Ansible vulnerabilities (02:46)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- Possibly would leak the password into log file when using the AWS EC2 module
since failed to validate the
tower_callback(nowadays is calledaap_callback- Ansible Automation Platform) parameter appropriately - Allows to mark variables as
unsafe- in that they may come from an external, untrusted source - won’t get evaluated/expanded when used to avoid possible info leaks etc - various issues where ansible would fail to respect this and essentially forget they were tagged as unsafe and end up exposing secrets as a result
[USN-6844-1] CUPS vulnerability (04:08)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- When starting, cups would arbitrarily chmod the socket specified as the Listen
parameter to make it world-writable - if this was a symlink, would then make
the target of the symlink world-readable - in general the cups config file is
only writable by root so requires some other vuln to be able to exploit it
where you can get write access to the config file to exploit it OR be able to
replace the regular cups socket path with a user-controlled symlink - but if
you can, then you can even change the cups config itself to be world-writable
and hence modify other parameters like the user and group that cups should run
as, as well as a crafted
FoomaticRIPCommandLinethen can run arbitrary commands as root
[USN-6849-1] Salt vulnerabilities (06:20)
- 2 CVEs addressed in Trusty ESM (14.04 ESM)
- Failed to properly validate paths in some methods and also failed to restrict access to other methods, allowing them to be used without authentication - could then either allow arbitrary directory access or the ability to retrieve tokens from the master or run arbitrary commands on minions
[USN-6746-2] Google Guest Agent and Google OS Config Agent vulnerability (06:44)
- 1 CVEs addressed in Noble (24.04 LTS)
- A vuln in the embedded golang protobuf module - when parsing JSON could end up in an infinite loop -> DoS
[USN-6850-1] OpenVPN vulnerability (07:04)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
- [USN-5347-1] OpenVPN vulnerability from Episode 155 - possibly gets confused when using multiple authentication plugins and deferred authentication
[USN-6847-1] libheif vulnerabilities (07:36)
- 8 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- First time to mention libheif on the podcast - High Efficiency Image File Format - part of the MPEG-H standard - container format used to store images or sequences of images
- Commonly seen due to its use by Apple for images on iPhone
- C++ - usual types of issues
- UAF, buffer overflows, floating point exception etc
- most found through fuzzing
- UAF, buffer overflows, floating point exception etc
[USN-6848-1] Roundcube vulnerabilities (08:21)
- 4 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- webmail front-end for IMAP
- 2 different possible XSS issues due to mishandling of SVG - email containing an SVG could embed JS that then gets loaded when the email is viewed
- Also possible XSS through a crafted user preference value - similarly through a crafted Content-Type/Content-Disposition header which can be used for attachment preview/download
[USN-6819-4] Linux kernel (Oracle) vulnerabilities (09:21)
- 149 CVEs addressed in Jammy (22.04 LTS)
- CVE-2024-26631
- CVE-2023-52694
- CVE-2023-52685
- CVE-2023-52682
- CVE-2024-35835
- CVE-2023-52446
- CVE-2023-52487
- CVE-2023-52619
- CVE-2023-52627
- CVE-2023-52674
- CVE-2024-26598
- CVE-2023-52679
- CVE-2023-52455
- CVE-2024-26671
- CVE-2023-52444
- CVE-2023-52683
- CVE-2023-52690
- CVE-2024-35842
- CVE-2023-52610
- CVE-2024-26607
- CVE-2023-52445
- CVE-2023-52497
- CVE-2023-52488
- CVE-2024-26623
- CVE-2023-52607
- CVE-2023-52677
- CVE-2023-52457
- CVE-2024-26673
- CVE-2024-26594
- CVE-2024-26638
- CVE-2023-52621
- CVE-2023-52594
- CVE-2023-52468
- CVE-2024-26647
- CVE-2023-52492
- CVE-2023-52452
- CVE-2024-26615
- CVE-2023-52448
- CVE-2023-52698
- CVE-2023-52443
- CVE-2023-52614
- CVE-2023-52494
- CVE-2024-35837
- CVE-2024-26582
- CVE-2023-52632
- CVE-2023-52680
- CVE-2023-52595
- CVE-2023-52626
- CVE-2023-52495
- CVE-2023-52451
- CVE-2023-52583
- CVE-2023-52469
- CVE-2023-52584
- CVE-2023-52450
- CVE-2024-26608
- CVE-2023-52609
- CVE-2023-52464
- CVE-2023-52591
- CVE-2024-26645
- CVE-2024-35838
- CVE-2023-52470
- CVE-2023-52456
- CVE-2023-52589
- CVE-2024-26585
- CVE-2023-52696
- CVE-2023-52633
- CVE-2023-52462
- CVE-2023-52597
- CVE-2023-52587
- CVE-2024-26584
- CVE-2024-26636
- CVE-2023-52491
- CVE-2023-52493
- CVE-2024-26627
- CVE-2023-52465
- CVE-2023-52687
- CVE-2023-52593
- CVE-2024-26595
- CVE-2024-26629
- CVE-2024-35840
- CVE-2023-52666
- CVE-2024-26633
- CVE-2023-52686
- CVE-2023-52467
- CVE-2023-52667
- CVE-2023-52449
- CVE-2023-52473
- CVE-2023-52670
- CVE-2024-26649
- CVE-2023-52498
- CVE-2023-52693
- CVE-2024-26583
- CVE-2023-52678
- CVE-2023-52675
- CVE-2023-52489
- CVE-2024-26640
- CVE-2024-26618
- CVE-2023-52599
- CVE-2024-26634
- CVE-2023-52608
- CVE-2024-26625
- CVE-2023-52486
- CVE-2024-26632
- CVE-2023-52669
- CVE-2023-52676
- CVE-2023-52635
- CVE-2023-52664
- CVE-2024-35841
- CVE-2023-52598
- CVE-2023-52458
- CVE-2024-26644
- CVE-2023-52697
- CVE-2023-52617
- CVE-2024-26612
- CVE-2023-52672
- CVE-2023-52490
- CVE-2024-35839
- CVE-2024-26610
- CVE-2024-26616
- CVE-2023-52588
- CVE-2023-52623
- CVE-2024-26669
- CVE-2023-52692
- CVE-2024-26620
- CVE-2023-52606
- CVE-2024-26592
- CVE-2023-52616
- CVE-2024-26641
- CVE-2023-52622
- CVE-2023-52611
- CVE-2023-52453
- CVE-2023-52681
- CVE-2024-26586
- CVE-2023-52472
- CVE-2024-26646
- CVE-2024-26670
- CVE-2023-52454
- CVE-2024-26668
- CVE-2023-52447
- CVE-2023-52463
- CVE-2023-52618
- CVE-2023-52691
- CVE-2024-26808
- CVE-2023-52612
- CVE-2024-24860
- CVE-2024-23849
- CVE-2023-6536
- CVE-2023-6535
- CVE-2023-6356
- Of all these CVEs, 6 had a high priority rating
- many are due to bugs in the async handling of cryto operations in the
in-kernel TLS implementation
- CVE-2024-26582 and CVE-2024-26584 - both reported by Google kernelCTF program (talked about back in [USN-6766-2] Linux kernel vulnerabilities from Episode 228)
- first is UAF in TLS handling of scattter/gather arrays
- second is UAF when crypto requests get backlogged and the underlying crypto engine can’t process them all in time - can then end up having the async callback invoked twice
- CVE-2024-26585
- very similar - UAF in handling of crypto operations from TLS - thread which handles the socket could close this before all the operations had been scheduled
- CVE-2024-26583 - similarly, race between async notify event and socket close -> UAF
- CVE-2024-26582 and CVE-2024-26584 - both reported by Google kernelCTF program (talked about back in [USN-6766-2] Linux kernel vulnerabilities from Episode 228)
- UAF in BPF and a UAF in netfilter - also reported via Google kernelCTF - both able to be triggered via an unpriv userns
- many are due to bugs in the async handling of cryto operations in the
in-kernel TLS implementation
Goings on in Ubuntu Security Community
Discussion of CISA KEV
- US Gov Cybersecurity & Infrastructure Security Agency
- “America’s Cyber Defense Agency”
- National Coordinator for Critical Infrastructure Security and Resilience
- Publish various guidance for organisations around topics of cybersecurity
- for instance, recently published a report “Exploring Memory Safety in Critical Open Source Projects”
- Joint guidance (FBI, ASD / ACSC & Candadian CSC)
- Builds on the previous case for memory safe roadmaps by looking at the prevalence of memory unsafe languages in various critical open source projects
- for instance, recently published a report “Exploring Memory Safety in Critical Open Source Projects”
- Also maintain the KEV - Known Exploitable Vulnerabilities Catalog
- “authoritative source of vulnerabilities that have been exploited in the wild”
- Mandates for federal civilian agencies in the US to remediate KEV vulns within various timeframes
- Also recommend that anyone else monitors this list and immediately addresses these vulns as part of the vuln remediation plan
- List of vilns that are causing immediate harm based on observed adversarial activity
- Various requirements to be listed in the KEV:
- CVE ID assigned
- Evidence it has been or is being actively exploited
- reliable evidence that execution of malicious code was performed on a system by an unauthorised actor
- also includes both attempted and successful exploitation (e.g. includes honeypots as well as real systems)
- Clear remediation guidelines
- An update is available and should be applied OR
- Vulnerable component should be removed from networks etc if it is EOL and cannot be updated
- available as CSV or JSON
- Currently lists 1126 CVEs including:
- Accellion File Transfer Appliances
- Adobe Reader, Flash Player
- Apache HTTP Server, Struts (Solarwinds), Log4j
- Huge number of Apple iOS etc (WebKit and more)
- Atlassian Confluence
- Citrix Gateways
- Exim
- Fortinet
- Gitlab
- Google Chromium
- ImageMagick
- Microsoft Windows and Exchange
- Mozilla Firefox
- Ivanti Pulse Connect Security
- SaltStack
- VMWare
- WordPress
- Oldest CVEs are 2 against Windows from 2002 and 2004
- Newest include 26 2024 CVEs - various Chromium, Windows, Android Pixel, Ivanti and more
- interestingly includes ARM Mali GPU Driver CVE-2024-4610 - this affects the Bifrost and Valhall drivers - in Ubuntu we only ship the related Midgard driver back in bionic and focal so not affected by this one
- but as you may have noticed, lots that we potentially are affected by
- Apache HTTP Server, Exim, Firefox, Thunderbird - plus OpenJDK, GNU C
Library, Bash, Roundcube (mentioned earlier but not this particular vuln),
WinRAR (unrar), not to mention a number against the Linux kernel
- all for Linux kernel are privesc - most against either netfilter or
various other systems like perf,
AF_PACKET, tty, ptrace, futex and others
- all for Linux kernel are privesc - most against either netfilter or
various other systems like perf,
- Apache HTTP Server, Exim, Firefox, Thunderbird - plus OpenJDK, GNU C
Library, Bash, Roundcube (mentioned earlier but not this particular vuln),
WinRAR (unrar), not to mention a number against the Linux kernel
- For Ubuntu, not surprisingly, we prioritise these vulnerabilities in our patching process
Get in contact
Episode 230
20 juni 2024 |
21 min
Overview
This week we bring you a special edition of the podcast, featuring an interview between Ijlal Loutfi and Karen Horovitz who deep-dive into Confidential Computing. Ranging from a high-level discussion of the need for and the features provided by confidential computing, through to the specifics of how this is implemented in Ubuntu and a look at similar future security technologies that are on the horizon.
Confidential Computing with Ijlal Loutfi and Karen Horovitz (01:17)
Get in contact
Episode 229
31 maj 2024 |
13 min
Overview
As the podcast winds down for a break over the next month, this week we talk about RSA timing side-channel attacks and the recently announced DNSBomb vulnerability as we cover security updates in VLC, OpenSSL, Netatalk, WebKitGTK, amavisd-new, Unbound, Intel Microcode and more.
This week in Ubuntu Security Updates
152 unique CVEs addressed
[USN-6783-1] VLC vulnerabilities (00:54)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- integer underflow and a heap buffer overflow -> RCE
[USN-6663-3] OpenSSL update (01:40)
- Affecting Noble (24.04 LTS)
- [USN-6663-1] OpenSSL update from Episode 220 - hardening improvement to return deterministic random bytes instead of an error when an incorrect padding length is detected during PKCS#1 v1.5 RSA to avoid this being used for possible Bleichenbacher timing attacks
[USN-6673-3] python-cryptography vulnerability (02:32)
- 1 CVEs addressed in Noble (24.04 LTS)
- [USN-6673-1] python-cryptography vulnerabilities from Episode 220 - counterpart to the OpenSSL update mentioned earlier
[USN-6736-2] klibc vulnerabilities (02:43)
- 4 CVEs addressed in Noble (24.04 LTS)
- [USN-6736-1] klibc vulnerabilities from Episode 228
[USN-6784-1] cJSON vulnerabilities (02:58)
- 3 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- 2 different researchers fuzzing cJSON APIs
- all different NULL ptr deref - requires particular / “incorrect” or possible misuse use of the APIs (like passing in purposefully corrupted values) so unlikely to be an issue in practice
[USN-6785-1] GNOME Remote Desktop vulnerability (03:52)
- 1 CVEs addressed in Noble (24.04 LTS)
- Discovered by a member of the SUSE security team when reviewing g-r-d
- Exposed various DBus services that were able to be called by any unprivileged user which would then return the SSL private key used to encrypt the connection - so could allow a local user to possibly spy on the sessions of other users remotely connected to the system
[USN-6786-1] Netatalk vulnerabilities (04:45)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- Apple file sharing implementation for Linux
- If the same path was shared via both AFP and SMB then a remote attacker could combine various operations through both file-systems (like creating a crafted symlink, which would then be followed during a second operation where a file is renamed) to allow them to overwrite arbirary files and hence achieve arbitrary code execution on the host
[USN-6788-1] WebKitGTK vulnerabilities (05:48)
- 1 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- Possible pointer authentication bypass - used on arm64 in particular - demonstrated at Pwn2Own earlier this year by Manfred Paul - $60k
[USN-6789-1] LibreOffice vulnerability (06:28)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- Unchecked script execution triggered when clicking on a graphic - allows to run arbitrary scripts without the usual prompt
[USN-6790-1] amavisd-new vulnerability (07:09)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- MTA / AV interface - often used in conjunction with Postfix, not just for AV but also can be used to do DKIM verification and integration with spamassassin etc
- Misinterpreted MIME message boundaries in emails, allowing email parts to possibly bypass usual checks
[USN-6791-1] Unbound vulnerability (07:46)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- DNSBomb attack announced recently at IEEE S&P - affecting multiple different DNS implementations including BIND, Unbound, PowerDNS, Knot, DNSMasq and others
- Unbound itself was not necessarily vulnerable to such an attack specifically, but could be used to generate such an attack against others - in particular Unbound had the highest amplification factor of ~22k times - next highest was DNSMasq at ~3k times
- Fix involves introducing a number of timeout parameters for various operations and discarding operations if they take longer than this to avoid the ability to “store up” responses to be released at a later time
[USN-6793-1] Git vulnerabilities (09:31)
- 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
[USN-6792-1] Flask-Security vulnerability
- 1 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6794-1] FRR vulnerabilities
- 4 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
[USN-6777-4] Linux kernel (HWE) vulnerabilities (09:40)
- 17 CVEs addressed in Xenial ESM (16.04 ESM)
- [USN-6777-1] Linux kernel vulnerabilities from Episode 228
- AWS HWE kernel (4.15)
[USN-6795-1] Linux kernel (Intel IoTG) vulnerabilities (10:00)
- 95 CVEs addressed in Jammy (22.04 LTS)
- CVE-2023-52588
- CVE-2023-52622
- CVE-2024-26920
- CVE-2023-52607
- CVE-2023-52530
- CVE-2023-52435
- CVE-2023-52615
- CVE-2024-26684
- CVE-2024-26829
- CVE-2024-26614
- CVE-2023-52489
- CVE-2023-52642
- CVE-2023-52583
- CVE-2024-26696
- CVE-2024-26627
- CVE-2024-26636
- CVE-2024-26663
- CVE-2024-26702
- CVE-2024-26685
- CVE-2024-26715
- CVE-2024-26668
- CVE-2023-52492
- CVE-2023-52498
- CVE-2024-26825
- CVE-2023-52587
- CVE-2024-26615
- CVE-2023-52608
- CVE-2024-26660
- CVE-2023-52601
- CVE-2024-26910
- CVE-2024-26676
- CVE-2023-52493
- CVE-2024-26673
- CVE-2024-26707
- CVE-2024-26698
- CVE-2024-26641
- CVE-2023-52494
- CVE-2023-52595
- CVE-2024-26697
- CVE-2023-52617
- CVE-2024-26675
- CVE-2024-26610
- CVE-2024-26606
- CVE-2023-52614
- CVE-2024-26712
- CVE-2023-52635
- CVE-2024-26689
- CVE-2024-26916
- CVE-2024-26665
- CVE-2023-52623
- CVE-2024-26635
- CVE-2024-26602
- CVE-2023-52597
- CVE-2023-52619
- CVE-2024-26808
- CVE-2024-26600
- CVE-2024-26826
- CVE-2024-26644
- CVE-2024-26695
- CVE-2023-52604
- CVE-2024-26625
- CVE-2023-52618
- CVE-2024-26664
- CVE-2024-26593
- CVE-2023-52633
- CVE-2023-52606
- CVE-2024-26640
- CVE-2023-52486
- CVE-2023-52631
- CVE-2024-26720
- CVE-2023-52599
- CVE-2024-26671
- CVE-2024-26722
- CVE-2023-52602
- CVE-2024-26645
- CVE-2023-52637
- CVE-2024-26704
- CVE-2023-52638
- CVE-2024-26717
- CVE-2024-26592
- CVE-2023-52491
- CVE-2023-52627
- CVE-2023-52598
- CVE-2024-26594
- CVE-2023-52643
- CVE-2024-26622
- CVE-2023-52594
- CVE-2024-26608
- CVE-2024-26679
- CVE-2023-52616
- CVE-2024-23849
- CVE-2024-2201
- CVE-2022-0001
- CVE-2024-1151
- CVE-2023-47233
- Very similar to [USN-6766-2] Linux kernel vulnerabilities from Episode 228
- 5.15 Intel IOTG - optimisations for various Intel IOT platforms like NUCs and Atom-based devices - low power x86
[USN-6779-2] Firefox regressions (10:30)
- 14 CVEs addressed in Focal (20.04 LTS)
- 126.0.1 - drag-and-drop was broken in 126.0
[USN-6787-1] Jinja2 vulnerability (10:48)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- Incorrect handling of various HTML attributes - attacker could then possibly inject arbitrary HTML attrs/values and hence inject JS code to peform XSS attacks etc
[USN-6797-1] Intel Microcode vulnerabilities (11:22)
- 9 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- Latest release from upstream - mitigates against various hardware vulns
- A couple issues in SGX/TDX on different Intel Xeon processors:
- Invalid restrictions -> local root -> super-privesc
- Invalid input on TDX -> local root -> super-privesc
- Invalid SGX base key calculation -> info leak
- Transient execution attacks to read privileged information
- DoS through bus lock mishandling or through invalid instruction sequences
- A couple issues in SGX/TDX on different Intel Xeon processors:
Get in contact
Episode 228
24 maj 2024 |
16 min
Overview
The team is back from Madrid and this week we bring you some of our plans for the upcoming Ubuntu 24.10 release, plus we talk about Google’s kernelCTF project and Mozilla’s PDF.js sandbox when covering security updates for the Linux kernel, Firefox, Spreadsheet::ParseExcel, idna and more.
This week in Ubuntu Security Updates
121 unique CVEs addressed
[USN-6766-2] Linux kernel vulnerabilities (01:07)
- 92 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- CVE-2024-26697
- CVE-2023-52489
- CVE-2024-26644
- CVE-2024-26702
- CVE-2023-52492
- CVE-2023-52616
- CVE-2024-26808
- CVE-2024-26920
- CVE-2023-52494
- CVE-2024-26698
- CVE-2024-26695
- CVE-2023-52635
- CVE-2024-26707
- CVE-2024-26715
- CVE-2023-52597
- CVE-2023-52435
- CVE-2024-26668
- CVE-2023-52598
- CVE-2024-26593
- CVE-2023-52643
- CVE-2024-26717
- CVE-2023-52604
- CVE-2024-26602
- CVE-2024-26664
- CVE-2023-52491
- CVE-2024-26635
- CVE-2024-26640
- CVE-2024-26696
- CVE-2024-26627
- CVE-2023-52623
- CVE-2024-26641
- CVE-2024-26829
- CVE-2024-26679
- CVE-2024-26600
- CVE-2024-26916
- CVE-2024-26606
- CVE-2023-52614
- CVE-2024-26675
- CVE-2024-26712
- CVE-2023-52587
- CVE-2023-52642
- CVE-2024-26636
- CVE-2023-52615
- CVE-2024-26615
- CVE-2024-26722
- CVE-2023-52608
- CVE-2023-52607
- CVE-2023-52631
- CVE-2023-52486
- CVE-2024-26645
- CVE-2023-52617
- CVE-2024-26660
- CVE-2023-52595
- CVE-2023-52599
- CVE-2024-26592
- CVE-2024-26610
- CVE-2024-26608
- CVE-2024-26704
- CVE-2024-26671
- CVE-2024-26676
- CVE-2023-52583
- CVE-2024-26689
- CVE-2024-26910
- CVE-2023-52619
- CVE-2023-52498
- CVE-2023-52638
- CVE-2024-26685
- CVE-2024-26673
- CVE-2023-52602
- CVE-2023-52627
- CVE-2024-26614
- CVE-2024-26720
- CVE-2024-26625
- CVE-2024-26594
- CVE-2023-52606
- CVE-2024-26825
- CVE-2023-52637
- CVE-2023-52588
- CVE-2023-52618
- CVE-2024-26663
- CVE-2024-26684
- CVE-2023-52633
- CVE-2023-52493
- CVE-2024-26665
- CVE-2023-52622
- CVE-2024-26826
- CVE-2023-52601
- CVE-2023-52594
- CVE-2024-23849
- CVE-2024-2201
- CVE-2022-0001
- CVE-2024-1151
- 5.15 - raspi kernel on 22.04 and OEM or optional HWE on 20.04
- Linux kernel CNA has been quite busy assigning both historical and recent CVEs against the kernel
- As discussed previously Linux kernel becomes a CNA from Episode 219 Follow up to Linux kernel CNA from Episode 220, the impact of these CVEs is often not apparent so it makes it quite hard to assign a proper priority - even the kernel CNA themselves are not assigning a CVSS score - so for now we have little information which we can glean for each of these
- As such, the USNs contain quite little detail and are very generic - and for each we will be assigning just a medium priority unless we have some good evidence otherwise
- One example here is CVE-2024-26808 - UAF in netfilter - was reported via
Google’s kernelCTF (not to be confused with their kCTF which is their
kubernetes-based CTF hosting platform - but which also has a vulnerabilities
reward program (VRP)) - kernelCTF - program to offer rewards for exploits
against the kernel - but not just any exploits - can’t use
io_uringornftablessince they were disabled in their target kernel configuration due to high number of historical vulns in both subsystems- base reward of $21k, $10k bonus if is reliable more than 90% of the time, additional $20k bonus if works without using unprivileged user namespaces, and a final additional $20k bonus if it is 0-day (ie not patched in the mainline tree and not disclosed anywhere - including via syzkaller)
- So in this case, we rated this CVE with a high priority since it is known
exploitable
- can see it listed in their public spreadsheet
[USN-6766-3] Linux kernel (AWS) vulnerabilities (04:48)
- 92 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- CVE-2024-26697
- CVE-2023-52489
- CVE-2024-26644
- CVE-2024-26702
- CVE-2023-52492
- CVE-2023-52616
- CVE-2024-26808
- CVE-2024-26920
- CVE-2023-52494
- CVE-2024-26698
- CVE-2024-26695
- CVE-2023-52635
- CVE-2024-26707
- CVE-2024-26715
- CVE-2023-52597
- CVE-2023-52435
- CVE-2024-26668
- CVE-2023-52598
- CVE-2024-26593
- CVE-2023-52643
- CVE-2024-26717
- CVE-2023-52604
- CVE-2024-26602
- CVE-2024-26664
- CVE-2023-52491
- CVE-2024-26635
- CVE-2024-26640
- CVE-2024-26696
- CVE-2024-26627
- CVE-2023-52623
- CVE-2024-26641
- CVE-2024-26829
- CVE-2024-26679
- CVE-2024-26600
- CVE-2024-26916
- CVE-2024-26606
- CVE-2023-52614
- CVE-2024-26675
- CVE-2024-26712
- CVE-2023-52587
- CVE-2023-52642
- CVE-2024-26636
- CVE-2023-52615
- CVE-2024-26615
- CVE-2024-26722
- CVE-2023-52608
- CVE-2023-52607
- CVE-2023-52631
- CVE-2023-52486
- CVE-2024-26645
- CVE-2023-52617
- CVE-2024-26660
- CVE-2023-52595
- CVE-2023-52599
- CVE-2024-26592
- CVE-2024-26610
- CVE-2024-26608
- CVE-2024-26704
- CVE-2024-26671
- CVE-2024-26676
- CVE-2023-52583
- CVE-2024-26689
- CVE-2024-26910
- CVE-2023-52619
- CVE-2023-52498
- CVE-2023-52638
- CVE-2024-26685
- CVE-2024-26673
- CVE-2023-52602
- CVE-2023-52627
- CVE-2024-26614
- CVE-2024-26720
- CVE-2024-26625
- CVE-2024-26594
- CVE-2023-52606
- CVE-2024-26825
- CVE-2023-52637
- CVE-2023-52588
- CVE-2023-52618
- CVE-2024-26663
- CVE-2024-26684
- CVE-2023-52633
- CVE-2023-52493
- CVE-2024-26665
- CVE-2023-52622
- CVE-2024-26826
- CVE-2023-52601
- CVE-2023-52594
- CVE-2024-23849
- CVE-2024-2201
- CVE-2022-0001
- CVE-2024-1151
- 5.15 - AWS on both 22.04 and 20.04
[USN-6774-1] Linux kernel vulnerabilities (05:01)
- 13 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
- 6.5 - all on 23.10, HWE (all) on 22.04
[USN-6775-1] Linux kernel vulnerabilities
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- 5.15 all on 22.04, HWE (all) on 20.04
[USN-6775-2] Linux kernel vulnerabilities
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- 5.15 AWS/GKE
[USN-6776-1] Linux kernel vulnerabilities
- 4 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- 5.4 all on 20.04, HWE (all) on 18.04
[USN-6777-1] Linux kernel vulnerabilities
- 17 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- 4.15 - all on 18.04, HWE (all) on 16.04
[USN-6777-2] Linux kernel (Azure) vulnerabilities
- 17 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
- 4.15 - azure
[USN-6777-3] Linux kernel (GCP) vulnerabilities
- 17 CVEs addressed in Xenial ESM (16.04 ESM)
[USN-6778-1] Linux kernel vulnerabilities
- 14 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
- 4.4 - all on 16.04, HWE on 14.04
[USN-6773-1] .NET vulnerabilities (05:34)
- 2 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- dotnet 7 and 8
[USN-6779-1] Firefox vulnerabilities (05:54)
- 14 CVEs addressed in Focal (20.04 LTS)
- 126.0
- UAF due to multiple WebRTC threads trying to use an audio input device if it was just added
- type confusion bug in handling of missing fonts -> arbitrary JS execution via
PDF.js (this is in the context of PDF.js which uses the quickjs JS engine
inside the standard ComponentUtils.Sandbox implementation - which is the same
sandbox used to execute JS from websites etc in firefox) - unrelated to this
vuln but PDFs can contain JavaScript (e.g. in a form, to calculate values
based on user input)
- also PDF.js doesn’t implement the PDF APIs related to network or disk etc to avoid possible security issues
[USN-6782-1] Thunderbird vulnerabilities (07:29)
- 6 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- 115.11.0
- same PDF.js issues and others as above from Firefox
[USN-6781-1] Spreadsheet::ParseExcel vulnerability (07:51)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- RCE vuln via the use of
eval()on untrusted user input - high profile, disclosed by Mandiant - high profile since it affected Barracuda email gateway devices and was publicly reported as being exploited against these by a Chinese APT group
[USN-6780-1] idna vulnerability (08:59)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- Python module for handling internationalised domain names (RFC 5895)
- CPU-based DoS due to inefficient algorithm when encoding a domain name
Goings on in Ubuntu Security Community
Ubuntu Security Plans for 24.10 Development Cycle (09:33)
- Progressing the FIPS certification for 24.04 though NIST
- Implementation of OpenVEX and OSV data formats for machine readable vulnerability information
- Historically have generated OVAL data for this purpose
- XML-based format, existed for over 20 years
- more recently, OpenVEX and OSV have appeared which also serve the same purpose and have a more vibrant community around them
- Similarly, next version of the SPDX format will also support vulnerability descriptions too
- Finally, given the recent announcement that CIS has relinquished the role in sponsoring OVAL project and there doesn’t appear to be any other sponsor on the horizon, thought it was prudent to develop a “second-supplier” approach given this uncertain future for OVAL upstream
- likely will have more to say on this in the future
- Improvements to the process the team uses for working with the snap store and doing reviews etc
- AppArmor profile development across the 24.10 release
Get in contact
Episode 227
3 maj 2024 |
25 min
Overview
Ubuntu 24.04 LTS is finally released and we cover all the new security features it brings, plus we look at security vulnerabilities in, and updates for, FreeRDP, Zabbix, CryptoJS, cpio, less, JSON5 and a heap more.
This week in Ubuntu Security Updates
61 unique CVEs addressed
[USN-6749-1] FreeRDP vulnerabilities (00:45)
- 7 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Bunch of issues all reported by researcher from Kaspersky - usual sorts of issues in this package - written in C etc
- OOB reads, heap buffer overflow, integer overflow / underflow -> OOB write
[USN-6752-1] FreeRDP vulnerabilities (01:41)
- 4 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Not long after those - more CVEs announced
- OOB read, NULL ptr deref and memory exhaustion
[USN-6657-2] Dnsmasq vulnerabilities (01:54)
- 3 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- [USN-6657-1] Dnsmasq vulnerabilities from Episode 220
[USN-6743-3] Linux kernel (Azure) vulnerabilities (02:13)
- 5 CVEs addressed in Jammy (22.04 LTS)
[USN-6750-1] Thunderbird vulnerabilities (02:19)
- 8 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- 115.10.1
[USN-6751-1] Zabbix vulnerabilities (02:54)
- 2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- First time Zabbix has featured in the podcast!
- Fixes 2 reflected XSS issues - in newer versions both require the attacker to be able to specify the user’s specific CSRF token - but in older versions only there was only a session ID which is easier to guess
[USN-6753-1] CryptoJS vulnerability (03:38)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- Insecure default config - uses older parameters for the implementation of PBKDF2 - SHA1 with a single iteration - makes any passwords protected via PBKDF2 in crypto-js easier to brute-force from the hashed value - instead updated to use SHA256 with 250,000 rounds
[USN-6754-1] nghttp2 vulnerabilities (04:32)
- 4 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Fixes for most recent issue in HTTP/2 (plus a few older HTTP/2 issues for ESM releases - HTTP/2 Rapid Reset and 2 disclosed by Netflix back in 2019 which we covered back in [USN-4099-1] nginx vulnerabilities from Episode 49 - all DoS attacks)
- HTTP/2 continuation frames - no proper limit on the amount of these frames which can be sent in a single stream - attacker can send many to cause a DoS on the server either through CPU by lots of processing or memory by storing all these headers in memory
[USN-6755-1] GNU cpio vulnerabilities (05:42)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Path traversal vuln - possible to write outside of the target directory
- Specific to Debian/Ubuntu etc since reverted part of the fix for historic
CVE-2015-1197 - path traversal via inclusion of a malicious symlink in the
archive - since it broke the use of the
--no-absolute-filenamesCLI argument - Was reverted back in 2.13+dfsg-2 - this was included in all releases of Ubuntu since focal
- Now use more correct fix from upstream (April 2023)
[USN-6756-1] less vulnerability (07:10)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- Second vuln in less in the last 10 weeks or so - [USN-6664-1] less vulnerability from Episode 220
- Similar issue - this time in the use of
LESSOPENenvironment variable - failed to properly quote newlines embedded in a filename - could then allow for arbitrary code execution if ranlesson some untrusted file LESSOPENis automatically set in Debian/Ubuntu vialesspipe- allows to run less on say a gz compressed log file or even on a tar.gz tarball to list the files etc
[USN-6757-1] PHP vulnerabilities (08:41)
- 3 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- Incomplete fix for historic CVE-2022-31629 - ability for an attacker on the
same network/site could set a cookie via HTTP with one name, which then gets
used by sessions using HTTPS and when using a different cookie name - is a
problem since certain cookie names (like
__Host-and__Secure-) have specific meanings which in general should be allowed to be specified by the network but only by the browser itself - so can be used to bypass usual restrictions (apparently this issue was reported upstream by the original reported of the 2022 vuln but it got ignored by upstream till now…) password_verify()function would sometimes return true for wrong passwords - ie if the actual password started with a NUL byte and the specified a password was the empty string would verify as true (unlikely to be an issue in practice)- Heap buffer overflow due to a large
PHP_CLI_SERVER_WORKERSenv var value - integer overflow -> wraparound -> allocate small amount of memory for a large number of values -> buffer overflow (low priority since would need to be able to set this env var first)
[USN-6761-1] Anope vulnerability (11:15)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- Failed to deny ability to reset the password of a suspended account and hence gain access again
[USN-6758-1] JSON5 vulnerability (11:37)
- 1 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- NodeJS module for the JSON5 format - “JSON for humans” - much more similar to yaml, does away with a lot of the usual quotes etc
- Protoype pollution vuln - when parsing would fail to restrict use of the
__proto__key and hence would allow the ability to set arbitrary keys etc within the returned object -> RCE
[LSN-0103-1] Linux kernel vulnerability (12:46)
- 7 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
| Kernel type | 22.04 | 20.04 | 18.04 |
|---|---|---|---|
| aws | 103.3 | 103.3 | — |
| aws-5.15 | — | 103.3 | — |
| aws-5.4 | — | — | 103.3 |
| aws-6.5 | 103.1 | — | — |
| azure | 103.3 | 103.3 | — |
| azure-5.4 | — | — | 103.3 |
| azure-6.5 | 103.1 | — | — |
| gcp | 103.3 | 103.3 | — |
| gcp-5.15 | — | 103.3 | — |
| gcp-5.4 | — | — | 103.3 |
| gcp-6.5 | 103.1 | — | — |
| generic-5.15 | — | 103.3 | — |
| generic-5.4 | — | 103.3 | 103.3 |
| gke | 103.3 | 103.3 | — |
| hwe-6.5 | 103.1 | — | — |
| ibm | 103.3 | — | — |
| ibm-5.15 | — | 103.3 | — |
| linux | 103.3 | — | — |
| lowlatency-5.15 | — | 103.3 | — |
| lowlatency-5.4 | — | 103.3 | 103.3 |
canonical-livepatch status
[USN-6760-1] Gerbv vulnerability (13:01)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Vuln found by the Ubuntu Security team - David and (former member) Andrei - Andrei found this whilst patching Gerbv back in 2023 and doing a bunch of testing with ASan enabled - crafted filename -> crash
[USN-6759-1] FreeRDP vulnerabilities (13:41)
- 5 CVEs addressed in Noble (24.04 LTS)
[USN-6737-2] GNU C Library vulnerability
- 1 CVEs addressed in Noble (24.04 LTS)
[USN-6729-3] Apache HTTP Server vulnerabilities
- 3 CVEs addressed in Noble (24.04 LTS)
[USN-6718-3] curl vulnerabilities
- 2 CVEs addressed in Noble (24.04 LTS)
[USN-6733-2] GnuTLS vulnerabilities
- 2 CVEs addressed in Noble (24.04 LTS)
[USN-6734-2] libvirt vulnerabilities
- 2 CVEs addressed in Noble (24.04 LTS)
[USN-6744-3] Pillow vulnerability
- 1 CVEs addressed in Noble (24.04 LTS)
Goings on in Ubuntu Security Community
Ubuntu 24.04 LTS (Noble Numbat) released (14:27)
- https://ubuntu.com/blog/canonical-releases-ubuntu-24-04-noble-numbat
- https://ubuntu.com/blog/ubuntu-desktop-24-04-noble-numbat-deep-dive
- https://ubuntu.com/blog/whats-new-in-security-for-ubuntu-24-04-lts
- Up to 12 years of support via Ubuntu Pro + Legacy Support Add-on
- New security features / improvements:
- Unprivileged user namespace restrictions
- Binary hardening
- AppArmor 4
- Disabling of old TLS versions
- Upstream Kernel Security Features
- Intel shadow stack support
- Secure virtualisation with AMD SEV-SNP and Intel TDX
- Strict compile-time bounds checking
Get in contact
Episode 226
19 april 2024 |
24 min
Overview
John and Georgia are at the Linux Security Summit presenting on some long awaited developments in AppArmor and we give you all the details in a sneak peek preview as well as some of the other talks to look out for, plus we cover security updates for NSS, Squid, Apache, libvirt and more and we put out a call for testing of a pending AppArmor security fix too.
This week in Ubuntu Security Updates
86 unique CVEs addressed
[USN-6727-1, USN-6727-2] NSS vulnerabilities + regression (01:02)
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- All various different timing side channels - two were effectively the same since the original fix was incomplete - mishandling of padding in PKCS#1 (RSA) certificate checks - possible to infer the length of the encrypted message and other properties to eventually infer secret key by sending a large number of attacker-chosen ciphertexts, the other when using various NIST curves (elliptic curve cryptography)
- Original fix caused some issues with loading NSS security modules so published a second update to fix that on focal+jammy
[USN-6728-1, USN-6728-2] Squid vulnerabilities + regression (02:05)
- 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- All found by the same researcher (Joshua Rogers) who performed a security audit of Squid back in 2021 - https://megamansec.github.io/Squid-Security-Audit/ - first mentioned by us in [USN-6500-1] Squid vulnerabilities in Episode 214 back in December 2023
- Then we mentioned how squid was under-resourced and so hadn’t be able to fix all the identified issues - over time upstream has published fixes for more issues and we are now incorporating those into squid in Ubuntu
- All of these were various DoS issues where could either cause squid to crash or stop responding
- One of these fixes was problematic and caused squid to crash itself so was reverted
[USN-6729-1] Apache HTTP Server vulnerabilities (03:01)
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- 2 different issues that could result in HTTP request splitting attacks - similar to HTTP request smuggling which is a more specific version of this attack, relies on different parsing/interpretation of HTTP request messages by an intermediate (load balancer/proxy/WAF etc.) to split a single HTTP request into multiple HTTP requests at the backend - allowing to bypass restrictions along the way - usually involves the use of injected CR/LF/TAB/SPC etc in headers
- Plus memory-based DoS in handling of HTTP/2 - client could just keep sending
more headers, buffered by the server so it can generate an informative
response, until it exhausts memory
- limit to just 100 headers before bailing with such an error
[USN-6730-1] Apache Maven Shared Utils vulnerability
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6731-1] YARD vulnerabilities
- 3 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
[USN-6732-1] WebKitGTK vulnerabilities
- 8 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
[USN-6733-1] GnuTLS vulnerabilities (04:57)
- 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Timing side-channel in ECDSA
- Crash when verifying crafted PEM bundles -> DoS
[USN-6734-1] libvirt vulnerabilities (05:13)
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- off-by-one in handling of udev interface names - unpriv client could then abuse this to send crafted udev data to the libvirt daemon, triggering a crash -> DoS
- NULL ptr deref in same code - race condition, need to detach a host interface whilst calling into the function
- Crash in RPC handling - pass a negative length value, would then try and
allocate a negative number of array indices - uses underlying
g_new0()from glib which expects an unsigned value -> tries to allocate an extremely large amount of memory -> crash
[USN-6735-1] Node.js vulnerabilities
- 3 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
[USN-6736-1] klibc vulnerabilities (06:33)
- 4 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- All old memory corruption issues in zlib - vendored within klibc
[USN-6724-2] Linux kernel vulnerabilities
- 12 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
[USN-6725-2] Linux kernel (AWS) vulnerabilities
- 46 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- CVE-2023-52470
- CVE-2023-52469
- CVE-2023-52451
- CVE-2023-52610
- CVE-2023-52441
- CVE-2023-52467
- CVE-2023-52449
- CVE-2024-26591
- CVE-2023-52458
- CVE-2024-26597
- CVE-2024-26633
- CVE-2023-52436
- CVE-2023-52444
- CVE-2024-26589
- CVE-2024-26586
- CVE-2024-26598
- CVE-2023-52612
- CVE-2023-52439
- CVE-2024-26631
- CVE-2023-52442
- CVE-2023-52443
- CVE-2023-52480
- CVE-2023-52438
- CVE-2023-52454
- CVE-2023-52456
- CVE-2023-52464
- CVE-2023-52457
- CVE-2023-52448
- CVE-2023-52609
- CVE-2023-52462
- CVE-2023-52445
- CVE-2023-52463
- CVE-2024-24860
- CVE-2024-23850
- CVE-2024-22705
- CVE-2024-23851
- CVE-2023-52429
- CVE-2023-52340
- CVE-2023-46838
- CVE-2023-3867
- CVE-2023-38431
- CVE-2023-38430
- CVE-2023-38427
- CVE-2023-32258
- CVE-2023-32254
- CVE-2023-1194
[USN-6726-2] Linux kernel (IoT) vulnerabilities
- 23 CVEs addressed in Focal (20.04 LTS)
- CVE-2023-52438
- CVE-2023-52436
- CVE-2023-52454
- CVE-2023-52470
- CVE-2023-52451
- CVE-2023-52445
- CVE-2023-52469
- CVE-2023-52609
- CVE-2023-52444
- CVE-2023-52449
- CVE-2024-26597
- CVE-2024-26633
- CVE-2023-52612
- CVE-2023-52439
- CVE-2023-52443
- CVE-2023-52457
- CVE-2023-52448
- CVE-2023-52464
- CVE-2024-0607
- CVE-2024-23851
- CVE-2023-52429
- CVE-2023-52340
- CVE-2023-46838
[USN-6726-3] Linux kernel (Xilinx ZynqMP) vulnerabilities
- 23 CVEs addressed in Focal (20.04 LTS)
- CVE-2023-52438
- CVE-2023-52436
- CVE-2023-52454
- CVE-2023-52470
- CVE-2023-52451
- CVE-2023-52445
- CVE-2023-52469
- CVE-2023-52609
- CVE-2023-52444
- CVE-2023-52449
- CVE-2024-26597
- CVE-2024-26633
- CVE-2023-52612
- CVE-2023-52439
- CVE-2023-52443
- CVE-2023-52457
- CVE-2023-52448
- CVE-2023-52464
- CVE-2024-0607
- CVE-2024-23851
- CVE-2023-52429
- CVE-2023-52340
- CVE-2023-46838
Goings on in Ubuntu Security Community
Linux Security Summit NA 2024 (07:22)
- https://events.linuxfoundation.org/linux-security-summit-north-america/
- Unprivileged Access Control in AppArmor - John Johansen & Georgia Garcia, Canonical
- https://static.sched.com/hosted_files/lssna24/97/AppArmor%20-%20Unprivileged%20Application%20Policy.pdf
- Friday 19th @ 9.15am PDT - live stream at https://www.youtube.com/watch?v=S-RQZGRoQFY
- AppArmor - MAC - sysadmin defines policy
- Allowing applications to define and load their own policy
- APIs in libapparmor to allow this to be done from static policy OR to build up policy over time
- policy is compiled in userspace and loaded into the kernel as usual
- To then stop a compromised application from unloading its policy, can mark it immutable so it can’t be further modified / removed
- Any further restrictions though can then be stacked against the immutable policy to say allow it to be confined futher
- On kernel side
- sysctl to allow/deny applications to load their own policy
- checks on the amount of memory able to be used to avoid apps DoSing system
- verification of compiled policy by kernel state machine
- policy only applies to the task and its children
- Various complexities in handling credentials/labels across tasks (ie. processes) and how these interact with the userspace processes/threads etc
- Also still have to resolve whether to use prctl vs syscall as the
interface since we can’t use the LSM syscalls
- May result in an AppArmor specific syscall
- But for now just using a prctl
- Application profiles then stack against any relevant system policy
- ie. if there is system policy, and policy loaded by the application itself is bounded by the system policy
- Demo of implementing
pledge()andunveil()from OpenBSD- pledge is similar to seccomp() on linux - allows an application to
restrict what it can do by declaring what subsystems it should be allowed
access to “promises”
- stdio, inet, bpf, unix, audio, video and many others
- map these to equivalent AppArmor permissions (although this is not a perfect mapping but WIP)
- also since this is at the LSM layer, we are not necessarily blocking syscalls as is done by pledge (since it is more akin to seccomp)
- but can use seccomp to plug any gaps
- to fully emulate this also need to emulate the return value - since on OpenBSD if the application violates the promise, deliver a SIGABRT - whereas LSMs return EACCES
- can do this via a new profile flag called
killalong with the associated signal to deliver - further complications to this since not always SIGABRT, sometimes is an errno (ENOSYS/EACCES) too
- extend apparmor policy to allow to specify priorities of what action should be taken in various cases
- can use the aforementioned immutable profile flag and stacking to then implement the promise reduction feature of
pledge()
- unveil is used to remove visibility of parts of the file-system
- maps quite cleanly to apparmor file rules
- pledge is similar to seccomp() on linux - allows an application to
restrict what it can do by declaring what subsystems it should be allowed
access to “promises”
- Full video of the session should be available soon
- Lots of other interesting talks:
- Stacked LSMs and User Space - Casey Schaufler, The Smack Project
- LSM syscalls and associated liblsm to provide an easier API plus emulation for older systems
- https://static.sched.com/hosted_files/lssna24/1a/2024-04-LSSNA-liblsm.pdf
- Mitigating Integer Overflow in C - Kees Cook, Google
- LKSPP - latest efforts to mitigate integer overflows within the kernel through the use of compiler sanitizers
- https://static.sched.com/hosted_files/lssna24/fb/Mitigating%20Integer%20Overflow%20in%20C.pdf
- Enhancing Kernel Bug Discovery with Large Language Models - Zahra Tarkhani, Microsoft
- SandBox Mode (SBM) - New Execution Mode Between Kernel and User Space - Petr Tesarik, Self-employed
- Stacked LSMs and User Space - Casey Schaufler, The Smack Project
Upcoming AppArmor Security update for CVE-2016-1585
- https://discourse.ubuntu.com/t/upcoming-apparmor-security-update-for-cve-2016-1585/44268/1
- https://bugs.launchpad.net/apparmor/+bug/1597017
Get in contact
Episode 225
12 april 2024 |
20 min
Overview
This week we cover the recent reports of a new local privilege escalation exploit against the Linux kernel, follow-up on the xz-utils backdoor from last week and it’s the beta release of Ubuntu 24.04 LTS - plus we talk security vulnerabilities in the X Server, Django, util-linux and more.
This week in Ubuntu Security Updates
76 unique CVEs addressed
[LSN-0102-1] Linux kernel vulnerability (00:53)
- 6 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- All covered in previous episodes
- netfilter UAF ([USN-6700-1] Linux kernel vulnerabilities from Episode 223)
- OOB write in KTLS ([USN-6648-1] Linux kernel vulnerabilities from Episode 220)
- UAF in AppleTalk network driver ([USN-6648-1] Linux kernel vulnerabilities from Episode 220)
- NULL ptr deref in TLS impl ([LSN-0100-1] Linux kernel vulnerability from Episode 219)
- Memory leak in netfilter ([USN-6383-1] Linux kernel vulnerabilities from Episode 210)
| Kernel type | 22.04 | 20.04 | 18.04 | 16.04 | 14.04 |
|---|---|---|---|---|---|
| aws | 102.1 | 102.1 | 102.1 | 102.1 | — |
| aws-5.15 | — | 102.1 | — | — | — |
| aws-5.4 | — | — | 102.1 | — | — |
| aws-6.5 | 102.1 | — | — | — | — |
| aws-hwe | — | — | — | 102.1 | — |
| azure | 102.1 | 102.1 | — | 102.1 | — |
| azure-4.15 | — | — | 102.1 | — | — |
| azure-5.4 | — | — | 102.1 | — | — |
| azure-6.5 | 102.1 | — | — | — | — |
| gcp | 102.1 | 102.1 | — | 102.1 | — |
| gcp-4.15 | — | — | 102.1 | — | — |
| gcp-5.15 | — | 102.1 | — | — | — |
| gcp-5.4 | — | — | 102.1 | — | — |
| gcp-6.5 | 102.1 | — | — | — | — |
| generic-4.15 | — | — | 102.1 | 102.1 | — |
| generic-4.4 | — | — | — | 102.1 | 102.1 |
| generic-5.15 | — | 102.1 | — | — | — |
| generic-5.4 | — | 102.1 | 102.1 | — | — |
| gke | 102.1 | 102.1 | — | — | — |
| gke-5.15 | — | 102.1 | — | — | — |
| gkeop | — | 102.1 | — | — | — |
| hwe-6.5 | 102.1 | — | — | — | — |
| ibm | 102.1 | 102.1 | — | — | — |
| ibm-5.15 | — | 102.1 | — | — | — |
| linux | 102.1 | — | — | — | — |
| lowlatency | 102.1 | — | — | — | — |
| lowlatency-4.15 | — | — | 102.1 | 102.1 | — |
| lowlatency-4.4 | — | — | — | 102.1 | 102.1 |
| lowlatency-5.15 | — | 102.1 | — | — | — |
| lowlatency-5.4 | — | 102.1 | 102.1 | — | — |
canonical-livepatch status
[USN-6710-2] Firefox regressions (01:54)
- 2 CVEs addressed in Focal (20.04 LTS)
- 124.0.2
- In particular fixes to allow firefox when installed directly from Mozilla to work under 24.04 LTS with the new AppArmor userns restrictions
- As discussed in previous episodes, default profile allows to use userns but
then to be blocked on getting additional capabilities - Firefox would
previously try and do both a new userns and a new PID NS in one call - which
would be blocked - now split this into two separate calls so the userns can
succeed but pidns will be denied (since requires
CAP_SYS_ADMIN) - but then firefox correctly detects this and falls back to the correct behaviour
[USN-6721-1] X.Org X Server vulnerabilities (04:11)
- 4 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Various OOB reads -> crash / info leaks when handling byte-swapped length values - able to be easily triggered by a client who is using a different endianness than the X server
- UAF in glyph handling -> crash / RCE
[USN-6721-2] X.Org X Server regression
- 4 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
[USN-6722-1] Django vulnerability (05:19)
- 1 CVEs addressed in Trusty ESM (14.04 ESM)
- Possible account takeover - would use a case transformation on unicode of the email address - so if an attacker can register an email address that is the same as the intended targets email address after this case transformation - fix simply just discards the transformed email address and sends to the one registered by the user
[USN-6723-1] Bind vulnerabilities (06:11)
- 2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- [USN-6633-1] Bind vulnerabilities from Episode 219
[USN-6724-1] Linux kernel vulnerabilities (06:27)
- 12 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
[USN-6725-1] Linux kernel vulnerabilities
- 46 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- CVE-2023-52470
- CVE-2023-52469
- CVE-2023-52451
- CVE-2023-52610
- CVE-2023-52441
- CVE-2023-52467
- CVE-2023-52449
- CVE-2024-26591
- CVE-2023-52458
- CVE-2024-26597
- CVE-2024-26633
- CVE-2023-52436
- CVE-2023-52444
- CVE-2024-26589
- CVE-2024-26586
- CVE-2024-26598
- CVE-2023-52612
- CVE-2023-52439
- CVE-2024-26631
- CVE-2023-52442
- CVE-2023-52443
- CVE-2023-52480
- CVE-2023-52438
- CVE-2023-52454
- CVE-2023-52456
- CVE-2023-52464
- CVE-2023-52457
- CVE-2023-52448
- CVE-2023-52609
- CVE-2023-52462
- CVE-2023-52445
- CVE-2023-52463
- CVE-2024-24860
- CVE-2024-23850
- CVE-2024-22705
- CVE-2024-23851
- CVE-2023-52429
- CVE-2023-52340
- CVE-2023-46838
- CVE-2023-3867
- CVE-2023-38431
- CVE-2023-38430
- CVE-2023-38427
- CVE-2023-32258
- CVE-2023-32254
- CVE-2023-1194
[USN-6726-1] Linux kernel vulnerabilities
- 23 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- CVE-2023-52438
- CVE-2023-52436
- CVE-2023-52454
- CVE-2023-52470
- CVE-2023-52451
- CVE-2023-52445
- CVE-2023-52469
- CVE-2023-52609
- CVE-2023-52444
- CVE-2023-52449
- CVE-2024-26597
- CVE-2024-26633
- CVE-2023-52612
- CVE-2023-52439
- CVE-2023-52443
- CVE-2023-52457
- CVE-2023-52448
- CVE-2023-52464
- CVE-2024-0607
- CVE-2024-23851
- CVE-2023-52429
- CVE-2023-52340
- CVE-2023-46838
[USN-6701-4] Linux kernel (Azure) vulnerabilities
- 12 CVEs addressed in Trusty ESM (14.04 ESM)
[USN-6719-2] util-linux vulnerability (07:08)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Initial fix in [USN-6719-1] util-linux vulnerability from Episode 224 tried to escape output to avoid shell command injection - as is often the case, turned out to be insufficient, so instead have now just removed the setgid permission from the wall/write binaries - can then only send to yourself rather than all users
Goings on in Ubuntu Security Community
Reports of a new local root privilege escalation exploit against Linux kernel (08:32)
- https://github.com/YuriiCrimson/ExploitGMStr
- Ukrainian hacker YuriiCrimson
- Has generated a lot of interest since whilst there are always vulns / CVEs in the kernel we don’t always see full PoCs much anymore
- Originally developed an exploit against the
n_gsmdriver in the 6.4 and and 6.5 kernels - Says they were contacted by another hacker
jmpeax(Jammes) - who wanted to purchase the exploit - After selling it to them, seems they tried to pass it off as their own
- https://github.com/jmpe4x/GSM_Linux_Kernel_LPE_Nday_Exploit
- https://jmpeax.dev/The-tale-of-a-GSM-Kernel-LPE.html
- commit timestamps of the purported copy by Jammes are all dated over 3 weeks ago
- but the original is only is only 1 week ago
- so on the surface would appear the other way around
- however, Yurii posted a video of their interaction with Jammes on Telegram to try and prove their side
- looking at repo metadata https://api.github.com/repos/jmpe4x/GSM_Linux_Kernel_LPE_Nday_Exploit shows the so-called copy was created on 22nd March
- whereas the Yurii’s is 6th April - so would appear that perhaps Jammes is the original author
- also can compare the two exploits and see they are almost identical - but
Jammes has an extra target for the 6.5.0-26-generic kernel from mantic
diff -w <(curl https://raw.githubusercontent.com/jmpe4x/GSM_Linux_Kernel_LPE_Nday_Exploit/main/main.c) <(curl https://raw.githubusercontent.com/YuriiCrimson/ExploitGSM/main/ExploitGSM_6_5/main.c) - who the actual author is remains unclear (also I don’t have telegram so couldn’t check the video)…
- Regarding the actual vulnerability - turns out there is at least 2 if not 3 in this module
- Old CVE-2023-6546 - written up https://github.com/Nassim-Asrir/ZDI-24-020/
- Fixed in 6.5-rc7
- Yurii / Jammes
- Additional exploit by Yurii apparently targeting 5.15-6.1 - also in
n_gsm - Mixed reports about this last exploit but report the one from Yurii/Jammes does work even on the latest upstream kernel
- Waiting on a fix from upstream to then integrate in Ubuntu kernels
- Interesting these exploits all used the same basic info leak from xen via
/sys/kernel/noteswhich leaks the symbol of thexen_startupfunction and allows to break KASLR - Reports this was known since at least 2020
- Many eyes…?
Ubuntu 24.04 LTS (Noble Numbat) Beta released (14:01)
- https://lists.ubuntu.com/archives/ubuntu-announce/2024-April/000300.html
- https://discourse.ubuntu.com/t/noble-numbat-release-notes/
- Also releases for all the flavours
- Edubuntu, Kubuntu, Lubuntu, Ubuntu Budgie, Ubuntu Cinnamon, UbuntuKylin, Ubuntu MATE, Ubuntu Studio, Ubuntu Unity, Xubuntu
- Final release scheduled for 25th April (just under 2 weeks)
Update on xz-utils (15:18)
- When we talked about xz-utils last week, didn’t really talk much about the main upstream developer Lasse Collin
- Thought it could be interesting to dive into how they essentially got compromised by this actor - but that is perhaps done better by others - go listen to the latest episode of Between Two Nerds from Tom Uren and The Grugq (https://risky.biz/BTN74/) talking about the tradecraft used to infiltrate the project and comparing this against the more traditional HUMINT elements
- Lasse Collin’s github account and the Github project for xz was reinstated
- Backdoor removed
- Great sense of humour:
The executable payloads were embedded as binary blobs in the test files. This was a blatant violation of the Debian Free Software Guidelines.
On machines that see lots bots poking at the SSH port, the backdoor noticeably increased CPU load, resulting in degraded user experience and thus overwhelmingly negative user feedback.
The maintainer who added the backdoor has disappeared.
Backdoors are bad for security.
- Also removed the ifunc (indirect function) support - ostensibly used to allow a
developer to create multiple implementations of a given function and select
between then at runtime - in this case was for an optimised version of CRC
calculation - but abused by the backdoor to be able to hook into and replace
functions in the global symbol table before it gets made read-only by the
dynamic loader
- Says this was not for security reasons but since it makes the code harder to maintain but is clearly a good win for security
- Lasse still plans to make to write an article on the backdoor etc but is more focused on cleaning up the upstream repo first - next version is likely to be 5.8.0
- Watch this space…
Get in contact
Episode 224
5 april 2024 |
29 min
Overview
It’s been an absolutely manic week in the Linux security community as the news and reaction to the recent announcement of a backdoor in the xz-utils project was announced late last week, so we dive deep into this issue and discuss how it impacts Ubuntu and give some insights for what this means for the open source and Linux communities in the future.
This week in Ubuntu Security Updates
20 unique CVEs addressed
[USN-6718-2] curl vulnerability
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
[USN-6719-1] util-linux vulnerability
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
[USN-6686-5] Linux kernel (Intel IoTG) vulnerabilities
- 9 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6715-1] unixODBC vulnerability
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
[USN-6704-4] Linux kernel (Intel IoTG) vulnerabilities
- 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6707-4] Linux kernel (Azure) vulnerabilities
- 4 CVEs addressed in Jammy (22.04 LTS)
[USN-6720-1] Cacti vulnerability
- 1 CVEs addressed in Jammy (22.04 LTS)
Goings on in Ubuntu Security Community
xz-utils backdoor and Ubuntu
- https://www.openwall.com/lists/oss-security/2024/03/29/4
- Late last week, 28th / 29th March backdoor in liblzma from xz-utils was disclosed to the open source community via oss-security mailing list - this was in the recent 5.6.0/5.6.1 releases from late Feb/early March this year
- initially the impact was not entirely clear - assumed initially that it may impact only xz-utils and so only in handling of xz compressed data / files - but even with that assumption that perhaps it could then infect anything that got compressed/decompressed
- within a few hours though became clear that the primary target was not xz-utils/liblzma itself but openssh - and the affect was to provide a backdoor into openssh that would allow the attacker to get remote access to any machine running ssh server with this backdoor liblzma installed
- To paint a picture - this was all unfolding on late Thursday / Friday of the Easter break, so lots of folks were either EOD or on leave etc - and trying to grapple with a threat that we knew could possibly impact the impedending 24.04 LTS release
- Good news:
- TL;DR for Ubuntu, this version was only ever in the -proposed pocket for the currently in-development 24.04 release - not in any other Ubuntu versions - and was removed as soon as we became aware, so unless you are running the devel release AND you had manually opted to install this version from the -proposed pocket, you would not be affected - very lucky
- https://discourse.ubuntu.com/t/xz-liblzma-security-update/43714
- What do we know about this? A lot - there has been significant investigation (and speculation) since it was announced, both at the social side of things and the technical aspects of the backdoor itself
- For the purpose of the podcast, we won’t go too deep into either but will try and cover the salient details
- Regarding the inclusion of the backdoor itself - looks to have been a very long and patient campaign by the attacker, who slowly gained the trust of the upstream project over the last 2 years and likely pressured the maintainer via sock-puppet accounts to then get themselves added as an additional maintainer
- Since then they seemed to be quite a good maintainer themselves - diligently adding new features and bug fixes etc over the past 2 years, but then suddenly introduced the backdoor into the most recent 2 releases
- The method of introducing the backdoor was also interesting, in that it
required 2 parts - the binary containing the backdoor and the code to get this
compiled into the liblzma library at build time
- The binary was committed into the upstream git repo disguised as an xz archive itself used as part of the test suite
- The code to inject this into the build was NOT part of the git repo, but instead was just in the tarball prepared by the maintainer for the official release
- And it used many levels of obfuscation to hide this backdoor within that fake test xz archive
- So the attacker was not just patient but also very technically skilled - and
not just multiple levels of obfuscation in the build process but the backdoor
code itself contained many elements to try and make it harder to recognise and
reverse engineer, presumably to allow it to hide in plain sight
- although as we will see, this runtime obfuscation within the backdoor binary was what gave it away eventually
- It’s often said that one of the advantages of Open Source is the huge community, which is summarised as Linus’ Law - with enough eyeballs all bugs are shallow - but sadly this wasn’t proven out in this case
- Backdoor was not found by anyone doing review of the changes upstream or by the various distros like Debian / Fedora / OpenSUSE / Arch or even Ubuntu when incorporating this new version into their repos - but instead was found by Andres Freund, one of the maintainers of PostgreSQL, when they were looking to benchmark some new changes scheduled for the next PostgreSQL release
- Luckily decided to use Debian unstable for this, and Debian had incorporated this new version into unstable a few weeks ago, and wanted to get the performance noise floor of the system as low as possible before doing benchmarking of PostgreSQL - noticed large transient CPU spikes in sshd and then eventually weird memory errors in sshd due to bugs in the initial version of the backdoor
- After a lot of painstaking work was able to determine that liblzma was the culprit and appeared to contain some very strange code to hook into the authentication process of sshd when it was launched via systemd
- Was able to trace that back to the aforementioned manually prepared tarballs of xz-utils on Github
- The CPU spikes Andres observed were due to the use of things like a trie to
lookup symbol names at runtime, rather than directly encoding them in the
exploit binary, presumably to try and make reverse engineering of the binary
harder (since you can’t just run
stringson it and get any real sensible output) - Some excellent writeups have been done regarding both the technical aspects of the backdoor itself, as well as the process taken by the attacker to incorporate this into the xz-utils project - both from a community point of view and a technical point of view
- From a technical point of view, the impact of this backdoor was to allow an
attacker to get pre-authentication remote-code execution in sshd via a
specific private key when connecting to the server - NOBUS
- Hooked into the RSA certificate validation process in sshd, looking for a particular matching private key from the client - and if found would then proceed to execute arbitrary commands specified by the client without requiring usual authentication
- By using this mechanism, nobody but the attacker can use the backdoor since they don’t have the matching private key - so the impact of the backdoor is somewhat limited
- BUT the fact they targeted such a widely used and deployed package across a huge number of distros, means they essentially wanted a backdoor into any Linux machine in the future that only they could use
- Interesting to try and speculate who the attacker could be (nation state?) and what their intended purpose was especially given this wide reaching goal of getting this into all the major Linux distros - but it would be just speculation
- So rather than speculate, for the purpose of this podcast episode, interesting to look at the timeline as it concerned Ubuntu
- The publishing history of the package is all visible in Launchpad
- Packages in Ubuntu get inherited from Debian who also publish history
- Upstream published the first backdoored version 5.6.0 via GitHub tarball on 24th Feb 2024
- Debian incorporated this into unstable on 26th Feb
- On 27th Feb, the Ubuntu Archive Auto-Sync bot copied this version into noble-proposed
- Due to the ongoing time_t transition, sat it noble-proposed for the next month
- Security team heard whispers of the possible backdoor just hours before it was publicly disclosed, and as soon as we heard of the possible backdoor, and realised that it only affected the version in-development noble-proposed we quickly notified the Archive Admin team who then deleted it from noble-proposed on 29th March, neutralising the main threat
- Most important thing to know for Ubuntu, we have taken a very conservative approach - not only have we removed this version from noble-proposed as soon as we became aware, we are then rebuilding every binary package that got built since that compromised version was in noble-proposed originally - out of an abundance of caution - we don’t have any information that says this backdoor was doing anything other than what the various writeups have found so far, BUT we also can’t be certain that it didn’t have other functionality either - so being very cautious and rebuilding everything that was itself built since 27th Feb
- As such, delayed the development of 24.04 so beta release is slipping by one week
- One of the most interesting parts is the sheer luck that this was found - not by security researchers or maintainers but by a developer from Microsoft who happened to be looking for the right things at the right time and decided to be curious
- Also for Ubuntu, luck that the time_t transition in Debian/Ubuntu caused many packages to be stuck in noble-proposed and not in the release pocket, else many Ubuntu users and developers would have been impacted if this had migrated to the noble release pocket
- Also interesting that the attacker appears to have had quite a good grasp on
OSS development practices and was quite persistent in trying to get this
incorporated into distros - even urging for this new version to be synced to
Ubuntu so that it would land in the upcoming noble release as recently as
Thursday last week, just hours before the public disclosure
- Not only could they do all the original social engineering work upstream, and technical work to develop and hide the backdoor, but could then interface with distros via their established practices to try and get them to incorporate their new backdoored version faster than they may have otherwise
- Huge amount of work has been done to detail both the timeline of the attack as well as the technical details of both the code used to incorporate the backdoored code into the final liblzma binary during the build process, as well as the details of the backdoor itself and how it operates at runtime
- In the end highlights both the challenges and strengths of OSS - lots of OSS projects have long dependency chains - in this case openssh when integrated with libsystemd which in turn used liblzma - and it is unclear who the maintainers and authors are or what procedures are in place for vetting and transferring ownership of OSS projects - all present significant challenges for OSS
- However, significant strength of OSS is the visibility and ability for anyone to get involved, which is what we saw in the aftermath - despite all the advanced obfuscation techniques employed was able to be analysed in a matter of days by the community working together - and to analyse it in a huge amount of depth and in such an open way that it leaves little room for questioning the validity of the assessment - anyone can double check the work and come to the same conclusions
- This isn’t the first software supply chain attack and likely isn’t even the first against an OSS project but it is a wake-up call to the OSS and Linux ecosystem
Get in contact
Episode 223
22 mars 2024 |
17 min
Overview
This week we bring you a sneak peak of how Ubuntu 23.10 fared at Pwn2Own Vancouver 2024, plus news of malicious themes in the KDE Store and we cover security updates for the Linux kernel, X.Org X Server, TeX Live, Expat, Bash and more.
This week in Ubuntu Security Updates
61 unique CVEs addressed
[USN-6681-3] Linux kernel vulnerabilities (00:54)
- 8 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- 5.4 - IBM, Oracle
- UAF due to a race-condition in netfilter - underflow a reference counter -> UAF
[USN-6686-2] Linux kernel vulnerabilities (01:42)
- 9 CVEs addressed in Jammy (22.04 LTS)
- 5.15 - Raspi, Lowlatency
[USN-6699-1] Linux kernel vulnerabilities (01:52)
- 3 CVEs addressed in Trusty ESM (14.04 ESM)
- 3.13 - generic, lowlatency, server, virtual
- KVM mishandling of control registers for nested guest VMs
- UAF in Quick Fair Queuing network packet scheduler
- Local privesc, reported to Google’s kCTF
[USN-6700-1] Linux kernel vulnerabilities (02:40)
- 7 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
- 4.4 - generic, kvm, lowlatency, virtual, aws (14.04 only)
- UAF in nftables - also originally reported to kCTF
[USN-6701-1] Linux kernel vulnerabilities
- 12 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- 4.15 - oracle, kvm, aws, generic, lowlatency
- UAF in nftables from above and UAF in AppleTalk network driver - [USN-6648-1] Linux kernel vulnerabilities from Episode 220
[USN-6680-3] Linux kernel (AWS) vulnerabilities
- 7 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
- 6.5 - aws
[USN-6681-4] Linux kernel (AWS) vulnerabilities
- 8 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- 5.4 - aws
- UAF in netfilter discussed earlier
[USN-6686-3] Linux kernel (Oracle) vulnerabilities
- 9 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- 5.15 - oracle
[USN-6702-1] Linux kernel vulnerabilities
- 4 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- 5.4 - iot, ibm, bluefield, gkeop, kvm, oracle, gcp, generic, lowlatency, oem
- Second netfilter UAF above
[USN-6587-5] X.Org X Server vulnerabilities (03:34)
- 7 CVEs addressed in Trusty ESM (14.04 ESM)
- Previous updates for X now available in 14.04 ESM
- Most issues either OOB R/W - impact is then can crash X Server or potentially get code execution - nowadays X runs unprivileged but in 14.04 still runs as root so these vulns are more severe in the older releases
[USN-6673-2] python-cryptography vulnerability (04:21)
- 1 CVEs addressed in Xenial ESM (16.04 ESM)
- [USN-6673-1] python-cryptography vulnerabilities from Episode 220
[USN-6695-1] TeX Live vulnerabilities (04:28)
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Heap buffer overflow via a crafted TTF file
- LuaTeX specific issue - allowed a document to make arbitrary network requests since it didn’t disable access to the underlying lua socket library
- Misused sprint() resulting in a buffer overflow in the axohelp - helper program for the LaTeX axodraw2 package when used with pdflatex
[USN-6694-1] Expat vulnerabilities (05:24)
- 2 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
- C library for parsing xml
- used by many other applications like gdb, dbus, audacity, git, python, polkit, squid and more
- CPU/memory-based DoS since would do many full reparsings of a document in some cases
- XML Entity Expansion attack
- billion laughs attack / XML bomb - 10 entities which each comprise 10 of the previous entity with the document containing a single instance of the largest entity - 1 billion copies of the original entity
[USN-6696-1] OpenJDK 8 vulnerabilities (06:40)
- 6 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- [USN-6660-1, USN-6661-1] OpenJDK 11 & 17 vulnerabilities from Episode 220
[USN-6697-1] Bash vulnerability (07:01)
- 1 CVEs addressed in Jammy (22.04 LTS)
- Heap buffer overflow on a valid parameter transformation - can then unexpectedly lead to possible code execution
[USN-6698-1] Vim vulnerability (07:30)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- stack buffer overflow when parsing a crafted command file - ie. the user has to load a crafted file to be sourced by vim
[USN-6703-1] Firefox vulnerabilities (07:48)
- 11 CVEs addressed in Focal (20.04 LTS)
- 124.0
Goings on in Ubuntu Security Community
Summary of Pwn2Own Vancouver 2024 results against Ubuntu 23.10 (08:05)
- https://www.zerodayinitiative.com/blog/2024/3/20/pwn2own-vancouver-2024-day-one-results
- The DEVCORE Team was able to execute their LPE attack against Ubuntu Linux. However, the bug they used was previously known. They still earn $10,000 and 1 Master of Pwn points.
- Kyle Zeng from ASU SEFCOM used an ever tricky race condition to escalate privileges on Ubuntu Linux desktop. This earns him him $20,000 and 20 Master of Pwn points.
- https://www.zerodayinitiative.com/blog/2024/3/21/pwn2own-vancouver-2024-day-two-results
- STAR Labs SG successfully demonstrated their privilege escalation on Ubuntu desktop. However, they used a bug that was previously reported. They still earn $5,000 and 1 Master of Pwn point.
- The final entry of Pwn2Own Vancouver 2024 ends as a collision as Theori used a bug that was previously know to escalate privileges on Ubuntu desktop. He still wins $5,000 and 1 Master of Pwn point.
Reports of malicious themes in KDE Store (10:27)
- https://www.bleepingcomputer.com/news/linux/kde-advises-extreme-caution-after-theme-wipes-linux-users-files/
- https://floss.social/@kde/112128243960545659
- https://www.reddit.com/r/kde/comments/1bixmbx/do_not_install_global_themes_some_wipe_out_all/
Get in contact
Episode 222
18 mars 2024 |
24 min
Overview
We cover recent Linux malware from the Magnet Goblin threat actor, plus the news of Ubuntu 23.10 as a target in Pwn2Own Vancouver 2024 and we detail vulnerabilities in Puma, AccountsService, Open vSwitch, OVN, and more.
This week in Ubuntu Security Updates
102 unique CVEs addressed
[USN-6679-1] FRR vulnerability (01:11)
- 1 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
- OOB read when parsing a malformed OSPF LSA packet - would try and access attributes fields even if none where present
[LSN-0101-1] Linux kernel vulnerability (01:50)
- 5 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- [USN-6648-1] Linux kernel vulnerabilities from Episode 220
- [USN-6606-1] Linux kernel (OEM) vulnerabilities from Episode 217
- [USN-6647-1] Linux kernel vulnerabilities from Episode 220
- [USN-6601-1] Linux kernel vulnerability from Episode 217
| Kernel type | 22.04 | 20.04 | 18.04 | 16.04 | 14.04 |
|---|---|---|---|---|---|
| aws | 101.1 | 101.1 | 101.1 | 101.1 | — |
| aws-5.15 | — | 101.1 | — | — | — |
| aws-5.4 | — | — | 101.1 | — | — |
| aws-6.5 | 101.1 | — | — | — | — |
| aws-hwe | — | — | — | 101.1 | — |
| azure | 101.1 | 101.1 | — | 101.1 | — |
| azure-4.15 | — | — | 101.1 | — | — |
| azure-5.4 | — | — | 101.1 | — | — |
| azure-6.5 | 101.1 | — | — | — | — |
| gcp | 101.1 | 101.1 | — | 101.1 | — |
| gcp-4.15 | — | — | 101.1 | — | — |
| gcp-5.15 | — | 101.1 | — | — | — |
| gcp-5.4 | — | — | 101.1 | — | — |
| gcp-6.5 | 101.1 | — | — | — | — |
| generic-4.15 | — | — | 101.1 | 101.1 | — |
| generic-4.4 | — | — | — | 101.1 | 101.1 |
| generic-5.15 | — | 101.2 | — | — | — |
| generic-5.4 | — | 101.1 | 101.1 | — | — |
| gke | 101.1 | — | — | — | — |
| gke-5.15 | — | 101.1 | — | — | — |
| gkeop | — | 101.1 | — | — | — |
| hwe-6.5 | 101.1 | — | — | — | — |
| ibm | 101.1 | 101.1 | — | — | — |
| ibm-5.15 | — | 101.1 | — | — | — |
| linux | 101.2 | — | — | — | — |
| lowlatency-4.15 | — | — | 101.1 | 101.1 | — |
| lowlatency-4.4 | — | — | — | 101.1 | 101.1 |
| lowlatency-5.15 | — | 101.2 | — | — | — |
| lowlatency-5.4 | — | 101.1 | 101.1 | — | — |
To check your kernel type and Livepatch version, enter this command:
canonical-livepatch status
[USN-6680-1] Linux kernel vulnerabilities (02:47)
- 7 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
[USN-6681-1] Linux kernel vulnerabilities
- 8 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
[USN-6686-1] Linux kernel vulnerabilities
- 9 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6680-2] Linux kernel vulnerabilities
- 7 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
[USN-6681-2] Linux kernel vulnerabilities
- 8 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
[USN-6688-1] Linux kernel (OEM) vulnerabilities (03:32)
- 63 CVEs addressed in Jammy (22.04 LTS)
- CVE-2024-26600
- CVE-2023-52467
- CVE-2023-52588
- CVE-2023-52594
- CVE-2023-52470
- CVE-2024-26598
- CVE-2023-52589
- CVE-2023-52583
- CVE-2023-52444
- CVE-2023-52449
- CVE-2024-26591
- CVE-2023-52598
- CVE-2023-52448
- CVE-2024-26597
- CVE-2023-52605
- CVE-2023-52451
- CVE-2023-52454
- CVE-2023-52445
- CVE-2023-52587
- CVE-2023-52447
- CVE-2023-52436
- CVE-2023-52593
- CVE-2023-52601
- CVE-2024-26594
- CVE-2024-26592
- CVE-2024-26589
- CVE-2023-52462
- CVE-2023-52469
- CVE-2023-52438
- CVE-2023-52457
- CVE-2023-52458
- CVE-2023-52595
- CVE-2023-52597
- CVE-2023-52464
- CVE-2023-52463
- CVE-2023-52606
- CVE-2024-26625
- CVE-2023-52584
- CVE-2024-26624
- CVE-2023-52600
- CVE-2024-26581
- CVE-2024-26588
- CVE-2023-52603
- CVE-2023-52599
- CVE-2023-52443
- CVE-2023-52602
- CVE-2023-52456
- CVE-2023-52607
- CVE-2024-26628
- CVE-2024-26601
- CVE-2024-26627
- CVE-2023-52439
- CVE-2023-52604
- CVE-2024-26599
- CVE-2024-24860
- CVE-2024-23849
- CVE-2024-1086
- CVE-2024-1085
- CVE-2024-0340
- CVE-2023-6610
- CVE-2023-5633
- CVE-2023-50431
- CVE-2023-46838
[USN-6682-1] Puma vulnerabilities (05:00)
- 6 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- HTTP server for Ruby/Rack applications that uses threading for improved performance
- [USN-6597-1] Puma vulnerability from Episode 217 - HTTP request smuggling attack - fixed for mantic and lunar - now for older releases, plus a bunch of other older HTTP request smuggling issues as well
[USN-6683-1] HtmlCleaner vulnerability (05:45)
- 1 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- Java library for parsing HTML
- DoS through crafted objects with cyclic dependencies
[USN-6684-1] ncurses vulnerability (06:01)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- Possible issue when parsing terminfo files - these are generally trusted, and since the previous update for CVE-2023-29491 in [USN-6099-1] ncurses vulnerabilities from Episode 196 untrusted terminfo files are not parsed when the application is setuid root. So has no real security impact.
[USN-6685-1] mqtt-client vulnerability ()
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- Java MQTT Client library
- Unmarshalling a crafted MQTT frame could lead to a OOM exception -> DoS
[USN-6687-1] AccountsService vulnerability (07:25)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- Oldest CVE this week?
- Only fixed 1 year ago by upstream
- To change the user’s password, Would invoke usermod with -p option and the new
encrypted/salted password - as such any user on the system would be able to
see that via inspection of
/proc/<pid>/cmdline- very low risk since the process only exists for a very small time AND it is encrypted already - so instead now invokeschpasswdand specifies the new encrypted password over standard input - would then need to be able to ptrace to see it which with YAMAptrace_scopeenabled in Ubuntu means you need to be root (or a parent process of accountsservice, which is started by dbus for the current user) - so then an attacker would have to be able to cause the existing accountservice to stop and then start their own to see the new encrypted password
[USN-6658-2] libxml2 vulnerability (09:41)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- [USN-6658-1] libxml2 vulnerability from Episode 220
- UAF if using DTD validation with XInclude expansion enabled
[USN-6690-1] Open vSwitch vulnerabilities (10:01)
- 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- [USN-6514-1] Open vSwitch vulnerability from Episode 214
- Original fix was incomplete - required additional fixes
- OOB read in hardware offload of Geneve packets (protocol for generic network virtualisation encapsulation) - can mitigate by disabling this option in config
[USN-6689-1] Rack vulnerabilities (10:41)
- 3 CVEs addressed in Mantic (23.10)
- Modular Ruby web server
- Possible reflected DoS - crafted Range header can result in unexpectedly large responses - can request ranges for a file which ends up being larger than the file itself - so now just return nothing
- ReDoS in header parsing - used a regex to split options and strip - now just splits on a comma directly then strip each separately
[USN-6656-2] PostgreSQL vulnerability (11:51)
- 1 CVEs addressed in Xenial ESM (16.04 ESM)
- [USN-6656-1] PostgreSQL vulnerability from Episode 220
[USN-6691-1] OVN vulnerability (12:00)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Enabled bidirectional forwarding detection on logical ports - this is used to monitor the health of remote nodes and the tunnels between them - BFD packets are then transmitted in-band in these tunnels along with other traffic - OVN would then process any BFD packet received on a tunnel where it was enabled - as such a remote attacker within a container/VM connected to a OVN logical switch port of such a tunnel could craft BFD packets which would then get tunnelled to and processed by another node and then change the BFD state of the tunnel and hence affect future forwarding decisions - ie. could essentially cause a DoS to future traffic along the tunnel
[USN-6692-1] Gson vulnerability (13:04)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- Java library for JSON serialisation/deserialisation to/from Java objects
- Only affected Java Serialisation - and then only if you were not careful when deserialising to not include circular references between objects
[USN-6693-1] .NET vulnerability (13:27)
- 1 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
- Patch Tuesday for dotnet7/8 - no real details from MS
[USN-6663-2] OpenSSL update (13:55)
- Affecting Xenial ESM (16.04 ESM)
- [USN-6663-1] OpenSSL update from Episode 220
- Hardening update to return output instead of an exception when wrong padding was used - removes a timing side-channel for inferring secret key
Goings on in Ubuntu Security Community
Ubuntu 23.10 to be a target in Pwn2Own Vancouver 2024 (14:26)
- Part of CanSecWest in Vancouver March 20-22 2024
- Ubuntu Desktop 23.10 target in Local Escalation of Privilege Category - must leverage a kernel vuln to escalate privs
- Unfortunately the userns restrictions are not enabled by default in 23.10 (Mantic) so will be interesting to see what kinds of vulns get turned up
- Will report back on findings in later episodes
Check Point Research report on Magnet Goblin’s Linux Malware Variants (15:42)
- https://research.checkpoint.com/2024/magnet-goblin-targets-publicly-facing-servers-using-1-day-vulnerabilities/
- Check Point Research reported on recent attacks targeting Ivanti Connect
Secure VPN by a threat actor they call Magnet Goblin
- Ivanti Connect Secure VPN CVEs were made public in January and have been exploited in the wild
- CPR decided to investigate a cluster of attacks
- In doing so cover the details of MGs Nerbian family of malware
- Report from Eclypsium suggests running an old version of Linux
- CentOS 6.4; which was released in 2013 and officially end of life in 2020
- Linux kernel 2.6.32 (EOL Feb 2016)
- openssl 1.0.2n (EOL Dec 2017)
- Perl 5.6.1 (EOL April 2001)
- Clear then that the malware not only exploits Ivanti Connect but also Linux in general
- CentOS 6.4; which was released in 2013 and officially end of life in 2020
- CPR report includes details on what TTPs to look for - IP addresses / domains etc
- Then details the NerbianRAT malware
- First disclosed in 2022 by ProofPoint when detailing the Windows variant
- Earliest sample of this Linux variant is in an upload to VT from May 2022
- But unlike the Windows variant, the Linux one does not include any hardening measures - even has DWARF debugging info present so can easily decompile
- Only anti-debug/analysis trick is to check there are no other variants of
itself running by trying to allocate a static shared memory segment - if
this succeeds then assumes it is not running and proceeds to:
- collect basic info like current time, $USER, machine name etc
- loads a public RSA key which is later used to encrypt network comms back to a hardcoded IP address used for C2
- then loads config which allows to configure things like when to start / end, other C2 hosts to use, time to sleep during file transfers and more
- for C2 uses raw TCP sockets and encrypts using the RSA key
- waits for magic string which contains the command to run from C2
- Also detail the MiniNerbian which is a simplified form for just command
execution but which used HTTP and sends POST requests to a
/dashboard/endpoint - likely to try and hide its network traffic in plain-sight (rather than the raw TCP sockets with custom encrypted protocol employed by NerbianRAT)
- For initial access, details are less clear but appears to exploit vulns in Ivanti, Magento, Qlink Sense and possibly Apache ActiveMQ - dubbed 1-day exploits
- What do we learn?
- Device makers who use OSS need to keep it up-to-date (or build on top of systems like Ubuntu Core which come with OTA etc OOTB)
- End-users of devices need to keep them up-to-date and deploy usual defence-in-depth practices (but this is hard when the device is intended to be deployed on the edge of a network - hard to add additional DiD to a VPN concentrator)
Get in contact
Episode 221
8 mars 2024 |
23 min
Overview
Andrei is back to discuss recent academic research into malware within the Python/PyPI ecosystem and whether it is possible to effectively combat it with open source tooling, plus we cover security updates for Unbound, libuv, node.js, the Linux kernel, libgit2 and more.
This week in Ubuntu Security Updates
56 unique CVEs addressed
[USN-6665-1] Unbound vulnerabilities (00:50)
- 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Another update for recent vulns discovered in DNSSEC standard - [USN-6633-1] Bind vulnerabilities from Episode 219 and [USN-6657-1] Dnsmasq vulnerabilities from Episode 220
[USN-6666-1] libuv vulnerability (01:16)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Async event handling library - used by nodejs and others - supports async handling TCP/UDP sockets, DNS resolution, file system operations etc
- Would truncate hostnames to 256 characters before calling
getaddrinfo()- but would then fail to NUL-terminate the string - as such,getaddrinfo()would read past the end of the buffer and the address that got resolved may not be the intended one - so then a remote attacker who could influence this could end up causing the application to contact a different address than expected and so perhaps access internal services etc
[USN-6667-1] Cpanel-JSON-XS vulnerability (02:21)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- Perl module for JSON serialisation
- OOB read on crafted JSON - when parsing in relaxed mode, if JSON was malformed and missing a colon would read beyond the end of the data and so potentially could result in an info-leak or a crash
[USN-6668-1] python-openstackclient vulnerability (02:55)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- When deleting an access rule, would search for it by name - if it didn’t exist may end up returning a different rule which would then get deleted instead - changes the semantics to only allow rules to be deleted via their ID which is unique
[USN-6648-2] Linux kernel (Azure) vulnerabilities (03:23)
- 4 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- [USN-6648-1] Linux kernel vulnerabilities from Episode 220
- OOB write in KTLS
- UAF in AppleTalk network driver
[USN-6651-2, USN-6651-3] Linux kernel (including StarFive) vulnerabilities (03:52)
- 6 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
[USN-6653-2, USN-6653-3, USN-6653-4] Linux kernel (AWS, Low Latency & GKE) vulnerabilities (04:07)
- 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6647-2] Linux kernel (Azure) vulnerabilities (04:15)
- 3 CVEs addressed in Trusty ESM (14.04 ESM)
- [USN-6647-1] Linux kernel vulnerabilities from Episode 220
- Memory leak in netfilter able to be abused via an unprivileged user namespace - DoS via exhausting system memory
[USN-6670-1] php-guzzlehttp-psr7 vulnerabilities (04:36)
- 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- HTTP message library conforming the the PSR-7 specification - failed to properly account for embedded newlines in HTTP headers - classic HTTP smuggling attack vuln
- Original fix from 2022 was found to be incomplete so additional CVE assigned for the follow-up fix
[USN-6671-1] php-nyholm-psr7 vulnerability (05:15)
- 1 CVEs addressed in Jammy (22.04 LTS)
- Alternative PSR-7 implementation which also suffered from the same issue
[USN-6669-1] Thunderbird vulnerabilities (05:35)
- 17 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- 115.8.1
[USN-6672-1] Node.js vulnerabilities (06:03)
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Leverages OpenSSL for cryptographic related work - failed to clear the OpenSSL error stack in when calling various routines - as such, may get false-positive errors on subsequent calls to OpenSSL from the same thread and hence DoS - so a remote attacker could provide an invalid cert which would then set this error and subsequent routines to validate certs would also appear to fail even if they were valid
- Uses ICU for unicode handling - allows a user to specify their own ICU data via an environment variable - but node.js can run in different privilege contexts so a user could then force it to load data under their control when running with elevated privileges
- ASN.1 encoding issue inherited from OpenSSL
[USN-6673-1] python-cryptography vulnerabilities (07:30)
- 2 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Another issue of mishandling the OpenSSL API - in this case would not properly handle errors returned from OpenSSL when processing certificates that had incorrect padding (talked about this last week in [USN-6663-1] OpenSSL update)
- Mishandled error case when a PKCS+12 key and certificate did not match one-another - would trigger an exception at runtime
[USN-6674-1, USN-6674-2] Django vulnerability (08:22)
- 1 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- ReDoS in Truncator template filter - if supplied an input string of all
opening angle brackets
<<<<<<....then would cause exponential performance degredation
[USN-6675-1] ImageProcessing vulnerability (08:52)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- Image processing library for ruby based on ImageMagick
- If an application allowed the user to specify the set of operations to be
performed, could then be abused to get arbitrary shell command execution -
internally used
send()rather thanpublic_send()which allowed access to private methods to directly execute system calls
[USN-6677-1] libde265 vulnerabilities (09:23)
- 7 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Next lot of libde265 vulns after discussed previously in both [USN-6659-1] libde265 vulnerabilities from Episode 221 and [USN-6627-1] libde265 vulnerabilities from Episode 219 - more fuzzing related fixes for usual sorts of issues - this time includes a couple from our own David (aka @litios)
[USN-6678-1] libgit2 vulnerabilities (09:50)
- 5 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Used by various tools like cargo, gnome-builder etc
- Fix for a possible infinite loop (CPU-based DoS) when parsing a crafted
revision named simply
@ - Use-after free when handling crafted input to
git_index_add - Mishandles equivalent filenames due to NTFS Data Streams (similar to CVE-2019-1352 - [USN-4220-1] Git vulnerabilities from Episode 56)
- Failed to perform certificate checking when using an SSH remote via the optional libssh2 backend - which we do in Ubuntu
[USN-6649-2] Firefox regressions (10:47)
- 12 CVEs addressed in Focal (20.04 LTS)
- 123.0.1
[USN-6676-1] c-ares vulnerability (10:55)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- async DNS lookup library
- Failed to properly handle embedded NUL characters when parsing
/erc/resolv.conf/etc/hosts,/etc/nsswitch.confor anything specifed via theHOSTALIASESenvironment variable - if has an embedded NUL as the first character in a new line, would then attempt to read memory prior to the start of the buffer and hence an OOB read -> crash
Goings on in Ubuntu Security Community
Andrei discusses malware detection with the Python and PyPi ecosystem (11:46)
Hey, Alex!
We will continue our journey today beyond the scope of the previous episodes. We’ve delved into the realms of network security, federated infrastructures, and vulnerability detection and assessment.
Today’s paper
Last year, the Ubuntu Security Team participated in the Linux Security Summit in Bilbao. At that time, I managed to have a discussion with Zach, who hosted a presentation at the Supply Chain Security Con entitled “Will Large-Scale Automated Scanning Stop Malware on OSS Repositories?”. I later discovered that his talk was backed by a paper that he and his colleagues from Chainguard had published.
With this in mind, today we will be examining “Bad Snakes: Understanding and Improving Python Package Index Malware Scanning”, which was published last year in ACM’s International Conference on Software Engineering.
The aim of the paper is to highlight the current state of the Python and PyPi ecosystems from a malware detection standpoint, identify the requirements for a mature malware scanner that can be integrated into PyPi, and ascertain whether the existing open-source tools meet these objectives.
Repositories. PyPi
With this in mind, let’s start by understanding the context.
Applications can be distributed through repositories. This means that the applications are packaged into a generic format and published in either managed or unmanaged repositories. Users can then install the application by querying the repositories, downloading the application in a format that they can unpack through a client, and subsequently run on their hosts.
There are numerous repositories out there. Some target specific operating systems, as is the case with Debian repositories, the Snap Store, Google Play, or the Microsoft Store. Others are designed to store packages for a specific programming language, such as PyPi, npm, and RubyGems. Firefox Add-ons and the Chrome extension store target a specific platform, namely the browser.
Another relevant characteristic when discussing repositories is the level of curation. The Ubuntu Archive is considered a curated repository of software packages because there are several trustworthy contributors able to publish software within the repository. Conversely, npm is unmanaged because any member of the open-source community can publish anything in it.
We will discuss the Python Package Index extensively, which is the de facto unmanaged repository for the Python programming language. As of the 7th of March 2024, there were 5.4 million releases for 520 thousand projects and nearly 800 thousand users. It is governed by a non-profit organisation and run by volunteers worldwide.
Supply chain attacks
Software repositories foster the dependencies of software on other pieces of software, controlled by different parties. As seen in campaigns such as the SolarWinds SUNBURST attack, this can go awry. Attackers can gain control over software in a company’s supply chain, gain initial access to their infrastructure, and exploit this advantage.
Multiple attack vectors are possible. Accounts can be hijacked. Attackers may publish packages with similar names (in a tactic known as typosquatting). They can also leverage shrink-wrapped clones, which are duplicates of existing packages, where malicious code is injected after gaining users’ trust. While covering all attack vectors is beyond the scope of this podcast episode, you can find a comprehensive taxonomy in a paper called “Taxonomy of Attacks on Open-Source Software Supply Chains”, which lists over 100 unique attack vectors.
From 2017 to 2022, the number of unique projects removed from PyPi increased rapidly: 38 in the first year, followed by 130, 60, 500, 27 thousands, and finally 12 thousands in the last year. Despite the fact that most of these were reported as malware, it’s worth noting that the impact of some of them is limited due to the lack of organic usage.
Malware analysis
These attacks can be mitigated by implementing techniques such as multi-factor authentication, software signing, update frameworks, or reproducible builds, but the most widespread method is malware analysis.
Some engines check for anomalies via static and dynamic heuristics, while others rely on signatures due to their simplicity. Once a piece of software is detected as malicious, its hash is added to a deny list that is embedded in the anti-malware engine. Each file is then hashed and the result is checked against the deny list. If the heuristics or the hash comparison identifies the file as malicious, it is either reported, blocked, or deleted depending on the strategy implemented by the anti-malware engine.
Malware analysis in PyPi
These solutions are already implemented in software repositories. In the case of PyPi, malware scanning was introduced in February 2022 with the assistance of a malware check feature in Warehouse, the application serving PyPi. However, it was disabled by the administrators two years later and ultimately removed in May 2023 due to an overload of alerts.
In addition to this technical solution, PyPi also capitalises on a form of social symbiosis. Software security companies and individuals conduct security research, reporting any discovered malware to the PyPi administrators via email. The administrators typically allocate 20 minutes per week to review these malware reports and remove any packages that can be verified as true positives. Ultimately, the reporting companies and individuals gain reputation or attention for their brands, products, and services.
Requirements
In addition to information about software repositories, supply chain attacks, malware analysis, and PyPi, the researchers also interviewed administrators from PyPi to understand their requirements for a malware analysis tool that could assist them. The three interviews, each lasting one hour, were conducted in July and August 2022 and involved only three individuals. This limited number of interviews is due to the focus on the PyPi ecosystem, where only ten people are directly involved in malware scanning activities.
When discussing requirements, the administrators desired tools with a binary outcome, which could be determined by checking if a numerical score exceeds a threshold or not. The decision should also be supported by arguments. While administrators can tolerate false negatives, they aim to reduce the rate of false positives to zero. The tool should also operate on limited resources and be easy to adopt, use and maintain.
Current tooling
But do the current solutions tick these boxes?
The researchers selected tools based on a set of criteria: analysing the code of the packages, having public detection techniques, and detection rules. Upon examining the available solutions, they found that only three could be used for evaluation in the context of their research: PyPi’s malware checks, Bandit4Mal, and OSSGadget’s OSS Detect Backdoor.
Regarding the former, it should be noted that the researchers did not match the YARA rules only against the setup files, but also against all files in the Python package. The second, Bandit4Mal, is an open-source version of Bandit that has been adapted to include multiple rules for detecting malicious patterns in the AST generated from a program’s codebase. The last, OSSGadget’s OSS Detect Backdoor, is a tool developed by Microsoft in June 2020 to perform rule-based malware detection on each file in a package.
These tools were tested against both malicious and benign Python packages. The researchers used two datasets containing 168 manually-selected malicious packages. For the benign packages, they selected 1,400 popular packages and one thousand randomly-selected benign Python packages.
For the evaluation process, they considered an alert in a malicious package to be a true positive and an alert in a benign package to be a false positive.
The true positive rate was 85% for the PyPi checks, the same for OSS Detect Backdoor and 90% for Bandit4Mal. The false positive rates ranged from 15% for the PyPi checks over the random packages, to 80% for Bandit4Mal on popular packages.
The tools ran in a time-effective manner, with a median time of around two seconds per package across all datasets. The maximum runtime was recorded for Ansible’s package, which was scanned in 26 minutes.
Despite their efficient run times, we can infer from these results that the tools are not accurate enough to meet the demands of PyPi’s administrators. The analysts may be overwhelmed by alerts for benign packages, which could interfere with their other operations.
Conclusions
And with this, we can conclude the episode of the Ubuntu Security Podcast, which details the paper “Bad Snakes: Understanding and Improving Python Package Index Malware Scanning”. We have discussed software repositories, malware analysis, and malware-related operations within PyPi. We’ve also explored the requirements that would make a new open-source Python malware scanner suitable for the PyPi administrators and evaluated how the current solutions perform.
If you come across any interesting topics that you believe should be discussed, please email us at [email protected].
Over to you, Alex!
Resources
- Bad Snakes: Understanding and Improving Python Package Index Malware Scanning
- Taxonomy of Attacks on Open-Source Software Supply Chains
- Bandit4Mal
- OSS Detect Backdoor
- PyPi’s malware checks
Get in contact
Episode 220
1 mars 2024 |
19 min
Overview
The Linux kernel.org CNA has assigned their first CVEs so we revisit this topic to assess the initial impact on Ubuntu and the CVE ecosystem, plus we cover security updates for Roundcube Webmail, less, GNU binutils and the Linux kernel itself.
This week in Ubuntu Security Updates
64 unique CVEs addressed
[USN-6647-1] Linux kernel vulnerabilities (01:14)
- 3 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- 4.15 - AWS/Azure/GCP/HWE/KVM/Oracle
- Memory leak in netfilter able to be abused via an unprivileged user namespace - DoS via exhausting system memory
[USN-6648-1] Linux kernel vulnerabilities (02:00)
- 4 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- 5.4 - IOT/Xilinx ZynqMP/IBM/Bluefield/GKEOP/Raspi/KVM/Oracle/AWS/GCP/Generic/LowLatency/OEM
- OOB write in KTLS reported by Jann Horn - if a user can get the kernel to splice a ktls socket can possibly escalate privileges
- UAF in AppleTalk network driver - could be abused by a local unprivileged
user - can be mitigated by blocklisting in
/etc/modprobe.d/blacklist-rare-network.conf# appletalk alias net-pf-5 off
[USN-6650-1] Linux kernel (OEM) vulnerability (03:30)
- 1 CVEs addressed in Jammy (22.04 LTS)
- NULL ptr deref in generic ID allocator
[USN-6651-1] Linux kernel vulnerabilities (03:38)
- 6 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
- ktls + appletalk
[USN-6653-1] Linux kernel vulnerabilities
- 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- ktls + appletalk
[USN-6652-1] Linux kernel (Azure) vulnerabilities (03:47)
- 15 CVEs addressed in Mantic (23.10)
- ktls + appletalk + NULL ptr deref in TLS impl ([LSN-0100-1] Linux kernel vulnerability from Episode 219)
[USN-6649-1] Firefox vulnerabilities (04:14)
- 12 CVEs addressed in Focal (20.04 LTS)
- 123.0
[USN-6654-1] Roundcube Webmail vulnerability (04:35)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- XSS able to abused by simple text/plain emails with crafted links - included
the ability to detect link references like
[1]and linkify them to the source - if an attacker used a form like[<script>evil</script>]this would be included in the generated HTML without escaping and so could get arbitrary XSS - Since is in universe, this update is available via Ubuntu Pro
[USN-6655-1] GNU binutils vulnerabilities (05:54)
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- 3 instances of DoS via excessive memory consumption, one of NULL ptr deref - in general upstream does not consider binutils safe for analysing untrusted inputs
[USN-6656-1] PostgreSQL vulnerability (06:31)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Failed to properly drop privileges when handling
REFRESH MATERIALIZED VIEW CONCURRENTLYcommands - should drop privileges so that the SQL is executed as the owner of the materialized view - as such, if an attacker could get a user or automated system to run such a command they could possibly execute arbitrary SQL as the user rather than as the owner of the view as expected
[USN-6657-1] Dnsmasq vulnerabilities (07:10)
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- KeyTrap and NSEC3 proof related vuln in DNSSEC - [USN-6633-1] Bind vulnerabilities from Episode 219
[USN-6658-1] libxml2 vulnerability (07:33)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- UAF if using DTD validation with XInclude expansion enabled
[USN-6659-1] libde265 vulnerabilities (07:52)
- 13 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- Next lot of libde265 vulns after discussed previously in [USN-6627-1] libde265 vulnerabilities from Episode 219 - more fuzzing related fixes for usual sorts of issues
[USN-6660-1, USN-6661-1] OpenJDK 11 & 17 vulnerabilities (08:17)
- 6 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- 11.0.22; 17.0.10
[USN-6662-1] OpenJDK 21 vulnerabilities
- 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- 21.0.2
[USN-6305-2] PHP vulnerabilities (08:37)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
[USN-6663-1] OpenSSL update (08:40)
- Affecting Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Hardening update for openssl 3.0 / 1.0 - OpenSSL 3.2.0 introduced a change to return random output instead of an exception when it detected wrong padding for PKCS#1 v1.5 encryption - without this there is a timing side-channel which can be used to infer the secret key and hence break confidentiality
[USN-6664-1] less vulnerability (09:40)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Failed to quote filenames when using
LESSCLOSE- could then get arbitrary shell commands - env var that tells less to invoke a particular command as an input post-processor (this is used in conjunction withLESSOPENto pre-processor the file before it is displayed by less - for instance, if you wanted to use less to page through a HTML file you might perhaps use this to run it viahtml2textfirst - then useLESSCLOSEto do any cleanup)
[USN-6644-2] LibTIFF vulnerabilities (10:51)
- 3 CVEs addressed in Jammy (22.04 LTS)
- Heap buffer overflow in libtiff itself, plus a heap buffer overflow in the tiffcp tool (used to combine multiple TIFF files into a single one) and finally a possible OOM issue in libtiff if an input file specified a very large size but then failed to actually contain such data (ie the headers specify a certain size but the file itself doesn’t contain that amount of data)
Goings on in Ubuntu Security Community
Follow up to Linux kernel CNA (11:40)
- Since announcing kernel.org has now started assigning CVEs
- First CVE assigned
- https://lore.kernel.org/linux-cve-announce/2024022058-outsell-equator-e1c5@gregkh/T/#u
CVE-2023-52433: netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction- CVE-2023-52433
- Assigned on 2024-02-20 12:53 UTC
- Both historical and recent
- 40 from 2024
- 66 from 2023
- 1 from 2022
- 165 from 2021
- 13 from 2020
- 3 from 2019
- As of
Fri 01 Mar 2024 04:04:26 UTChave assigned 288 CVEs- 9 days, 15 hours and 11 minutes or so
- 231 hours
- Currently assigning more than 1 CVE per hour
- Looking at these, 8 appear to be due to reported issues from Coverity -
popular static analysis tool which is not infallible. Others appear to come
directly from the GSD project (Global Security Database)
- e.g. CVE-2019-25160 (https://lore.kernel.org/linux-cve-announce/2024022657-CVE-2019-25160-e487@gregkh/T/#u) is the same as GSD-2022-1001715
- As I mentioned in Episode 219, GSD has over 13573 Linux kernel issues
- Whilst I also said that I hoped that the kernel CNA wouldn’t be so much of a firehose, currently it seems to be quite significant
- On a personal note - I have been doing the CVE Triage role on our team this week - in past weeks, I would normally spend about 30-minutes to 1 hour each day doing this - and this week it has been at least 2 hours each day, mostly due to the large influx of kernel CVEs
- Perhaps the only way to solve this is better tooling - on our side, mdeslaur added support for automatically extracting the required git commits from the CVE notifications and the kernel team already has tooling which checks if the required commits are in the git trees of the various Ubuntu kernels
- Hopefully that helps - but it doesn’t help to assign priorities to each CVE
- The kernel CNA is not assigning CVSS scores and they don’t intend to - although my understanding is this is required - and so we can’t use this to help
- So then we need to try and manually assess the impact of each CVE - but even the kernel CNA says this is not obvious - so then perhaps the solution is to just assign them all to medium and deal with them as part of the usual kernel SRU cycle
Get in contact
Episode 219
16 februari 2024 |
21 min
Overview
This week the Linux kernel project announced they will be assigning their own CVEs so we discuss the possible implications and fallout from such a shift, plus we cover vulnerabilities in the kernel, Glance_store, WebKitGTK, Bind and more.
This week in Ubuntu Security Updates
64 unique CVEs addressed
[LSN-0100-1] Linux kernel vulnerability (00:56)
- 5 CVEs addressed in Jammy (22.04 LTS), Focal (20.04 LTS), Bionic ESM (18.04 ESM), Xenial ESM (16.04 ESM), Trusty ESM (14.04 ESM)
- UAF in IGMP protocol ([USN-6601-1] Linux kernel vulnerability from Episode 217)
- UAF in netfilter ([USN-6606-1] Linux kernel (OEM) vulnerabilities from Episode 217)
- UAF in SMB client implementation - local crash / privesc ([USN-6607-1] Linux kernel (Azure) vulnerabilities from Episode 217)
- NULL ptr deref in kernel TLS offload implementation - allows a userspace
application to request that the kernel do TLS by providing it the key etc -
internally the kernel then takes the data to be sent from userspace and frames
it into a scatter list (describes the regions in memory containing the data to
be sent) - uses the kernel crypto API which is asynchronous
- userspace can construct an invalid initial sequence number to trigger the kernel to enter a code path where the network packet is freed before it has finished being processed by the crypto API -> UAF
| Kernel type | 22.04 | 20.04 | 18.04 | 16.04 | 14.04 |
|---|---|---|---|---|---|
| aws | 100.1 | 100.1 | 100.1 | 100.1 | — |
| aws-5.15 | — | 100.1 | — | — | — |
| aws-5.4 | — | — | 100.1 | — | — |
| aws-6.2 | 100.1 | — | — | — | — |
| aws-hwe | — | — | — | 100.1 | — |
| azure | 100.1 | 100.1 | — | 100.1 | — |
| azure-4.15 | — | — | 100.1 | — | — |
| azure-5.4 | — | — | 100.1 | — | — |
| azure-6.2 | 100.1 | — | — | — | — |
| gcp | 100.1 | 100.1 | — | 100.1 | — |
| gcp-4.15 | — | — | 100.1 | — | — |
| gcp-5.15 | — | 100.1 | — | — | — |
| gcp-5.4 | — | — | 100.1 | — | — |
| gcp-6.2 | 100.1 | — | — | — | — |
| generic-4.15 | — | — | 100.1 | 100.1 | — |
| generic-4.4 | — | — | — | 100.1 | 100.1 |
| generic-5.15 | — | 100.1 | — | — | — |
| generic-5.4 | — | 100.1 | 100.1 | — | — |
| gke | 100.1 | 100.1 | — | — | — |
| gke-5.15 | — | 100.1 | — | — | — |
| gkeop | — | 100.1 | — | — | — |
| hwe-6.2 | 100.1 | — | — | — | — |
| ibm | 100.1 | 100.1 | — | — | — |
| ibm-5.15 | — | 100.1 | — | — | — |
| linux | 100.1 | — | — | — | — |
| lowlatency-4.15 | — | — | 100.1 | 100.1 | — |
| lowlatency-4.4 | — | — | — | 100.1 | 100.1 |
| lowlatency-5.15 | — | 100.1 | — | — | — |
| lowlatency-5.4 | — | 100.1 | 100.1 | — | — |
To check your kernel type and Livepatch version, enter this command:
canonical-livepatch status
[USN-6624-1] Linux kernel vulnerabilities
- 9 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
[USN-6625-1] Linux kernel vulnerabilities
- 4 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
[USN-6626-1] Linux kernel vulnerabilities
- 10 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6625-2] Linux kernel (GCP) vulnerabilities
- 4 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
[USN-6628-1] Linux kernel (Intel IoTG) vulnerabilities
- 16 CVEs addressed in Jammy (22.04 LTS)
[USN-6626-2] Linux kernel vulnerabilities
- 10 CVEs addressed in Jammy (22.04 LTS)
[USN-6608-2] Linux kernel (NVIDIA) vulnerabilities
- 5 CVEs addressed in Jammy (22.04 LTS)
[USN-6635-1] Linux kernel (GCP) vulnerabilities
- 13 CVEs addressed in Jammy (22.04 LTS)
[USN-6627-1] libde265 vulnerabilities (04:10)
- 18 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- Open H.265 video codec implementation - used by gstreamer and hence Videos (totem) in particular
- Lots of the usual sorts of issues - a lot appear to have been found by a couple different researchers fuzzing - assertion failure, NULL ptr derefs, OOB reads, UAF, OOB writes etc - impact then ranging from DoS to possible code execution
[USN-6630-1] Glance_store vulnerability (05:26)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- OpenStack Image Service store library - library for interacting with assets (images) via different storage technologies (local file-system, HTTP, RBD, Swift, S3 and others)
- S3 backend would log the
access_keyif logging configured at DEBUG level - any user then able to read the logs could see the access key and hence potentially get access to the S3 bucket (would also need the secret key too and this was never logged so impact minimal)
[USN-6631-1] WebKitGTK vulnerabilities (06:26)
- 3 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
- Minimal info as with all webkit issues
- “improved memory handling to fix possible arbitrary code execution when processing crafted web content”
- “improved access restrictions to fix user fingerprinting from a crafted web page”
- “improved checks to fix a type confusion issue able to be triggered from crafted web content - possibly exploited in the wild”
[USN-6632-1] OpenSSL vulnerabilities (07:13)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- [USN-6622-1] OpenSSL vulnerabilities from Episode 218
[USN-6633-1] Bind vulnerabilities (07:33)
- 5 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
- Range of issues including 2 different CPU-based DoS - one in handling of regular DNS queries / responses, the other in DNSSEC - “KeyTrap” - also affects resolvers not just servers (so any client system as well that is doing lookups) - affects the DNSSEC standard itself and hence affects various other implementations as well
- Attack works by having an attacker create a DNS zone with many RRSIG and DNSKEY records - these contain a cryptographic signature and public key respectively - so when trying to validate the DNSSEC record need both - and so will end up trying every possible RRSIG with every possible DNSKEY to find a match - with no bound on the computation time (and if implemented in a single threaded manner) - can completely DoS the server / client etc.
- Plus a similar issue in the NSEC3 proof of non-existence in DNSSEC
[USN-6634-1] .NET vulnerabilities (09:47)
- 2 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
- Updates for dotnet 6, 7 and 8
- DoS when parsing X509 certificates if using OpenSSL (as is the case in Ubuntu) and a DoS in the SignalR library (allows a server to send asynchronous notifications to client-side web applications) able to be triggered by a malicious client
[USN-6629-1, USN-6629-2] UltraJSON vulnerabilities (10:34)
- 3 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- Fast JSON encoder/decoder for Python
- Is actually implemented in C with Python bindings - so has usual issues - UAF, memory corruption, stack buffer overflow
Goings on in Ubuntu Security Community
Linux kernel becomes a CNA (11:25)
-
Earlier this week, Greg Kroah-Hartman (one of the more famous Linux kernel developers - responsible for the various stable kernel trees / releases plus various subsystems within the kernel - also wrote one of the most popular books on Linux Kernel Driver development - even if it is woefully outdated nowadays) announced that the Linux kernel project itself has been accepted as a CNA by MITRE and would start issues CVEs for the vulnerabilities found within the kernel itself
-
Historically the upstream kernel developers and Greg himself have been quite disparaging of the CVE process / ecosystem and essentially saying that CVEs for the kernel are meaningless since that all bugs are potentially security issues and there are so many fixes that go into the kernel of which the security impact is not clear, that the only way to stay secure is to track one of the supported upstream stable kernel trees - otherwise CVEs would be issued for basically every commit that goes into one of the stable trees
- Whilst in Ubuntu we tend to agree that the only way to maintain a kernel is to use the stable trees (and hence the Ubuntu Kernel team continuously incorporates all the fixes from the upstream stable kernel trees into the different Ubuntu kernels) we still see a lot of value in the CVE ecosystem - and also we do not agree that all fix commits warrant a CVE
-
It was not then surprising to see that in the initial announcement there was a statement that:
Note, due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel, but the possibility of exploitation is often not evident when the bug is fixed. Because of this, the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify.
-
This led many (including us) to fear that the kernel CNA would be issuing an extremely high volume of CVEs which would effectively overwhelm the CVE process and make it unworkable - for instance, LWN calculated that for the 6.1 stable kernel has had over 12,000 fixes applied to it over the past year. So this leaves a huge scope for many CVEs to be possibly assigned - and as a comparison in total across all software / hardware devices etc in 2023 there was 29,000 CVEs assigned. So that could mean the kernel itself would possibly become responsible for at least a quarter of all CVEs in the future.
-
Greg has some prior form in this space as well since in 2019 he gave a talk where he suggested one way the kernel community could help fix the issue of CVEs being erroneously assigned against the kernel would be to start doing exactly this and assigning a CVE for every fix applied to the kernel and hence overwhelm the CVE ecosystem to (in his words) “burn it down”.
-
Also the GSD project (Global Security Database - set up as an alternate / competitor to CVE) was doing exactly this - tracking a huge number of fixes for the stable trees and assigning them GSD IDs - as per https://osv.dev/list?ecosystem=Linux it tracks 13573 issues
-
Thankfully though, this plan seems to have moderated over the past few days - after Greg posted a patch set to the LKML documenting the process, he clarified in a follow-up email that this would not be the case, and instead that CVEs will only be assigned for commits which appear to have a security relevant impact. How they actually do that remains to be seen, and his comment that “we (will) know it when we see it” doesn’t exactly put me at ease (since it is very easy to miss the security implications of any particular commit) at least this helps allay the fears that there would be a tidal wave of CVEs being assigned.
-
One outstanding issue which I directly asked Greg about is how they are actually tracking fixes for CVEs - since in their model, a CVE is equivalent to the commit which fixes the issue - however for lots of existing kernel CVEs that get assigned by other CNAs like Canonical or Red Hat etc, the fix comprises multiple commits
-
Greg says the whole process is quite complex and whilst their existing scripts want a one-to-one mapping from CVEs to commits they do plan to fix this in the future.
-
So will be interesting to see what things they will end up assigning CVEs. Also will be interesting to see how the interaction with security researchers plays out. Since their process is heavily skewed to the CVE corresponding to the fix commit AND they state that this must be in one of the stable trees for a CVE to be assigned, it doesn’t leave a lot of room for responsible disclosure. They do say they can assign a CVE for an issue before it is resolved with a commit to one of the stable trees, but ideally these details would get disclosed to distros and others ahead of the CVE details being released to the public. I also asked Greg about this but am awaiting a response.
Get in contact
Episode 218
9 februari 2024 |
18 min
Overview
AppArmor unprivileged user namespace restrictions are back on the agenda this week as we survey the latest improvements to this hardening feature in the upcoming Ubuntu 24.04 LTS, plus we discuss SMTP smuggling in Postfix, runC container escapes and Qualys’ recent disclosure of a privilege escalation exploit for GNU libc and more.
This week in Ubuntu Security Updates
39 unique CVEs addressed
[USN-6591-2] Postfix update (00:48)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- On 18th December (during the holiday break), SEC Consult published a report
about a new technique for email spoofing, which they dubbed SMTP Smuggling
- Similar to HTTP Request Smuggling - relies on exploiting differences in how
SMTP protocol is interpreted by outbound (originating) vs inbound
(receiving) SMTP servers. In particular the end-of-data sequence
<CR><LF>.<CR><LF>gets interpreted loosely so that it is possible to include extra SMTP commands within the message data which would then go on to be interpreted as an additional SMTP commands to be executed by the receiving server and to cause it to receive two emails when only one was sent in the first place, and where the usual SPF checks get bypassed for this second email - so can bypass SPF/DMARC policies to spoof emails from various domains
- Similar to HTTP Request Smuggling - relies on exploiting differences in how
SMTP protocol is interpreted by outbound (originating) vs inbound
(receiving) SMTP servers. In particular the end-of-data sequence
- Affected a number of projects including postfix - Upstream postfix released version 3.8.4 with an initial fix on 22nd December
- We then released USN-6591-1 with that fix
- Then on 21st January released a more robust fix with an additional config option to increase interoperability whilst still preventing SMTP smuggling
- This second update includes the reworked fix
[USN-6619-1] runC vulnerability (03:22)
- 1 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- “Internal file descriptor leak” - using a specially crafted container image, allows an attacker to cause a newly spawned container to have a working directory within the host filesystem namespace which in turn can allow the attacker to escape the container - various ways this can be attacked, full details on the upstream advisory https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv
[USN-6620-1] GNU C Library vulnerabilities (04:17)
- 3 CVEs addressed in Mantic (23.10)
- Latest round of vulnerabilities from Qualys
- Affect the
syslog()system call - Heap buffer overflow, off-by-one buffer overflow and integer overflow
- Of these the heap buffer overflow is the most severe - Qualys were able to
demonstrate they could exploit and up-to-date default install of Fedora 38 to
escalate privileges from a local unprivileged user to root.
- uses the value of
argv[0]in a call to snprintf() into a fixed size buffer allocated on the stack - snprintf() won’t overflow this but will return a value larger than the fixed size buffer - as a result a heap buffer to then contain this string would only get allocated with a size of 1 byte but then the full expected data would get copied into it - and since the attacker controls this value they can write arbitrary data to the heap by just using a crafted program name (which is easy to do via the theexeccommand built in to bash etc)
- uses the value of
- Various setuid binaries like
/usr/bin/sucallsyslog()internally and so can be abused in this way
[USN-6587-4] X.Org X Server regression (07:14)
- 6 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
[USN-6621-1] ImageMagick vulnerability (07:28)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- ImageMagick is in universe, so these updates are available via Ubuntu Pro
- Heap UAF in BMP decoder - likely DoS but possible code-execution via a crafted BMP file
[USN-6622-1] OpenSSL vulnerabilities (08:07)
- 4 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Two CPU-based DoS issues where OpenSSL would spend an excessive amount of time trying to check an invalid RSA or X9.42 DH keys
- NULL ptr deref when parsing a malicious PKCS12 file
- Issue specific to PowerPC (ppc64el arch in Ubuntu) - possible to corrupt
application state since the POLY1305 MAC implementation (hand-coded assembly)
saves the contents of the vector registers in a different order than when they
get restored - so some registers will be corrupted when returning to the
caller
- Only relevant on newer PowerPC processors which support the PowerISA 2.07 instructions
[USN-6592-2] libssh vulnerabilities (09:27)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- Recent libssh update now also available for Ubuntu Pro users on older releases
[USN-6623-1] Django vulnerability (09:34)
- 1 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- ReDoS when using the
intcommatemplate
[USN-6609-3] Linux kernel (Oracle) vulnerabilities (09:45)
- 6 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- Refer back to Episode 217 for most recent kernel vulns
[USN-6610-2] Firefox regressions (09:57)
- 14 CVEs addressed in Focal (20.04 LTS)
- Similarly, last week I mentioned [USN-6610-1] Firefox vulnerabilities - upstream 122.0 release has various minor regressions now fixed in this 122.0.1 release - including an issue if you happened to be using the Yaru-Remix theme in Ubuntu
Goings on in Ubuntu Security Community
Updates for unprivileged user namespace restrictions in Ubuntu 24.04 LTS (10:32)
- Previously mentioned this work a few times on the podcast (Call for testing of Unprivileged User Namespace Restrictions on Mantic in Episode 211 and Unprivileged user namespace restrictions via AppArmor in Ubuntu in Episode 205)
- Both those times was about user namespace restrictions in Ubuntu 23.10 (the current interim release)
- For those not familiar - user namespaces provide a mechanism for operating as
a different UID on a Linux system - in particular, can operate as uid 0 within
a namespace which is then constrained by the original parent namespace -
ie. as a normal unprivileged user, I could create a new user namespace and map
my UID to 0 within that namespace, which can then allow me to have say
CAP_NET_ADMINwithin that namespace and so create firewall rules etc that only affect applications within that namespace and not the host system- Can also be used for isolation etc
- However, since within the namespace my unprivieleged user now has extra privileges, exposes additional kernel attack surface - various bugs have been found in differetn kernel subsystems that allow an unprivileged user to exploit the kernel as a result
- Want a way to provide fine grained controls over unprivileged user namespaces
- Previously, used AppArmor to deny the ability to create a new user namespace unless an application was explicitly tagged via an associated AppArmor profile
- John and Georgia from the AppArmor team have made a number of enhancements, in particular adding a new default functionality where you can define in AppArmor policy a different AppArmor profile which an application should transition into when it creates a user namespace
- In particular, we can now do this even for the “unconfined” profile - and then ship a default “unconfined_userns” profile which allows an application to create a userns but to not gain any additional capabilities within that by default
- Various sandboxing frameworks behave much more sensibly with this - so instead
of just failing when they try and create the userns, they instead are able to
create one but then if they try and gain additional capabilities (like
CAP_NET_ADMINetc as mentioned before) this is then denied - This also matches the semantics which we want to achieve since it is not really the user namespace itself that is the original issue, it is the ability to gain additional capabilities within that which the unprivileged user did not have originally
- In addition, Georgia has been busy testing various applications within the archive and across the Linux ecosystem to ensure we ship any required profiles for them out-of-the-box so as many pieces of software continue to work as expected with these restrictions in place
- AppArmor in noble is already enabling this restriction and these updates are
now in the
apparmorpackage in noble-proposed pocket- Expect to be available in noble within the next few days once automated testing completes
- Requires some additional kernel support - Kernel Team has merged this into their current linux-unstable kernel (available via the Kernel Team’s unstable PPA) which will land eventually land in 24.04 proper
- On track to have this additional security hardening feature enabled by default for 24.04 LTS at release so we can close off one of the more prevalent sources of kernel privilege escalation bugs in the past few years
Get in contact
Episode 217
2 februari 2024 |
15 min
Overview
For the first episode of 2024 we take a look at the case of a raft of bogus FOSS CVEs reported on full-disclosure as well as AppSec tools in Ubuntu and the EOL announcement for 23.04, plus we cover vulnerabilities in the Linux kernel, Puma, Paramiko and more.
This week in Ubuntu Security Updates
81 unique CVEs addressed
[USN-6601-1] Linux kernel vulnerability (01:16)
- 1 CVEs addressed in Trusty ESM (14.04 ESM)
- UAF in IGMP protocol (allows multiple devices to share the same IPv4 address and hence all receive the same data via multicasting - often used for things like video streaming) - race condition between two different threads in the handling of a timer which could cause the timer to be registered on an object that is then later freed by another thread - when the timer then fires the thread will try and access the object which has now been freed
- Can be exploited by an unprivileged local user in a user namespace
[USN-6602-1] Linux kernel vulnerabilities (02:23)
- 5 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
- IGMP UAF
- OOB write in perf - didn’t properly check the size of all events when processing them - direct memory corruption able to be triggered by a local user - and on older kernels like the 4.4 kernel shipped in Ubuntu 16.04 this can be done from userspace directly
- Divide-by-zero error on some AMD processors could return speculative data -> info leak ([USN-6383-1] Linux kernel vulnerabilities from Episode 210)
[USN-6603-1] Linux kernel (AWS) vulnerabilities
- 3 CVEs addressed in Xenial ESM (16.04 ESM)
[USN-6604-1] Linux kernel vulnerabilities
- 6 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
[USN-6604-2] Linux kernel (Azure) vulnerabilities
- 6 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
[USN-6605-1] Linux kernel vulnerabilities
- 4 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
[USN-6605-2] Linux kernel (KVM) vulnerabilities
- 4 CVEs addressed in Focal (20.04 LTS)
[USN-6606-1] Linux kernel (OEM) vulnerabilities (03:04)
- 5 CVEs addressed in Jammy (22.04 LTS)
- perf OOB write
- 2 very similar UAFs in netfilter - both require
CAP_NET_ADMINto be able to exploit (ie to create a netfilter chain etc) but this can easily be obtained in an unprivileged user namespace -> privesc for unprivileged local user
[USN-6608-1] Linux kernel vulnerabilities
- 5 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
[USN-6609-1] Linux kernel vulnerabilities
- 6 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6609-2] Linux kernel (NVIDIA) vulnerabilities
- 6 CVEs addressed in Jammy (22.04 LTS)
[USN-6607-1] Linux kernel (Azure) vulnerabilities (03:32)
- 7 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- 2 netfilter UAFs, IGMP UAF, perf OOB write
- UAF in SMB client implementation - local crash / privesc
[USN-6596-1] Apache::Session::LDAP vulnerability (03:45)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- Would not check the validity of an X.509 certificate since uses the Net::LDAPS Perl module which by default doesn’t do this and requires applications to explicitly instruct it to do so
[USN-6597-1] Puma vulnerability (04:24)
- 1 CVEs addressed in Lunar (23.04), Mantic (23.10)
- HTTP server for Ruby/Rack applications that uses threading for improved performance
- Vulnerable to a HTTP request smuggling attack since it would fail to properly parse packets with chunked transfer encoding
- Also failed to set a limit on the size of chunk extensions which could then allow a CPU or network-bandwidth based DoS attack
[USN-6598-1] Paramiko vulnerability (04:58)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Fix for Terrapin attack disclosed back in December - flaw in SSH protocol
itself which allows an attacker who can interpose on the connection to drop
the
EXT_INFOmessage which is sent during the handshake to negotiate various protocol extensions in a way that neither the client or server will notice (since they can just send an empty ignored packet with the same sequence number). This can be done quite easily by an attacker since during this stage of the connection there is no encryption in place. End result is the attacker can cause either a loss of integrity (since this won’t be detected by the other party) or potentially to compromise the key exchange itself and hence cause a loss of confidentiality as well
[USN-6599-1] Jinja2 vulnerabilities
- 2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
[USN-6600-1] MariaDB vulnerabilities
- 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
[USN-6611-1] Exim vulnerability
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
[USN-6610-1] Firefox vulnerabilities
- 14 CVEs addressed in Focal (20.04 LTS)
[USN-6613-1] Ceph vulnerability
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
[USN-6612-1] TinyXML vulnerability
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
[USN-6614-1] amanda vulnerability
- 1 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
[USN-6615-1] MySQL vulnerabilities
- 22 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- CVE-2024-20985
- CVE-2024-20984
- CVE-2024-20983
- CVE-2024-20982
- CVE-2024-20981
- CVE-2024-20978
- CVE-2024-20977
- CVE-2024-20976
- CVE-2024-20974
- CVE-2024-20973
- CVE-2024-20972
- CVE-2024-20971
- CVE-2024-20970
- CVE-2024-20969
- CVE-2024-20967
- CVE-2024-20966
- CVE-2024-20965
- CVE-2024-20964
- CVE-2024-20963
- CVE-2024-20962
- CVE-2024-20961
- CVE-2024-20960
[USN-6616-1] OpenLDAP vulnerability
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6587-3] X.Org X Server regression
- 6 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
[USN-6618-1] Pillow vulnerabilities
- 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
[USN-6617-1] libde265 vulnerabilities
- 14 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
Goings on in Ubuntu Security Community
Ubuntu 23.04 (Lunar Lobster) EOL (06:48)
- Released back in April 2023 - like all interim releases, supported for 9 months
- Reached EOL on 25th January - won’t receive any package updates (security or bug fix) and will be archived to old-releases.ubuntu.com in the coming weeks
- Urge to upgrade to the currently supported interim release 23.10 ASAP as once it does get archived the process to upgrade becomes harder (since you have to manually update your apt sources to refer to the old-releases server first)
- 23.10 (Mantic Minotaur) will then be supported for about 5 more months until July this year
Awesome AppSec in Ubuntu (08:22)
- https://discourse.ubuntu.com/t/awesome-appsec-in-ubuntu/41922/1
- Andrei has compiled a list of tools available in Ubuntu which can be used by security researchers
- Includes tools for:
- Coordinated Vulnerability Disclosure
- Fuzzing
- License scanning
- Reverse engineering
- Runtime process analysis
- Security linting
- Symbolic execution
- Threat modelling
- Scanning for vulnerable dependencies
- Web scanning
- Runtime application isolation (sandboxing)
- Whether you are an software engineer looking to make your software more secure or a security researcher trying to find vulns or even a security engineer wanting tools to help with vulnerabililty management, there is likely something in the list for you
- If you find anything missing, send Andrei a PR as the list is hosted on Github
full-disclosure spammed with zombie CVEs (09:52)
- full-disclosure mailing list slowly declining in popularity but was once the go-to place to discuss and disclose vulnerabilities
- In January, saw a large increase in the number of messages posted (75 compared to 15-30 which was the usual number posted for any month in 2023)
- Meng Ruijie from National University in Singapore posted 36 different CVE reports across a large range of OSS projects, including Redis Raft, TinyDTLS, Mesa, ncurses, vim, GTK and more - and almost all of them were described as NULL pointer dereferences or buffer overflows etc
- Alan Coppersmith raised this on the oss-security mailing list, since none of these issues had been raised privately with any of these projects but also that most of the CVE descriptions appeared to be quite bogus - e.g. for a CVE in Mesa, where Meng describes them as a NULL pointer deref the associated issue that the CVE points to in the upstream mesa gitlab describes a possible OOB read but where there is no good evidence that this is able to be influenced by the caller and hence there is no evidence that there is a security issue here at all
- They appear to have been assigned by just looking for either reports in
upstream issue trackers that mention possible security issues OR upstream
commits that mention words like NULL pointer dereference but without any
consideration as to whether these are actual vulnerabilities
- For example - just because some code may potentially dereference a NULL pointer, if the caller cannot influence that to occur then there is no way to trigger it and so it is not an actual vulnerability
- Likely almost all of these CVEs will get disputed and so provide no real value - also they waste the time of OSS developers to respond to these reports as well as distros and others to investigate them etc
Get in contact
Episode 216
15 december 2023 |
21 min
Overview
For the final episode of 2023 we discuss creating PoCs for vulns in tar and the looming EOL for Ubuntu 23.04, plus we look into security updates for curl, BlueZ, Netatalk, GNOME Settings and a heap more.
This week in Ubuntu Security Updates
57 unique CVEs addressed
[USN-6535-1] curl vulnerabilities (00:54)
- 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- Mishandled cookies from domains with mixed case - allowing an attacker to
create so called “super cookies” that would then get passed back to more
domains that what is normally allowed - ie a site can set a cookie which is
then sent to different / unrelated sites. Depends on a feature called the
Public Suffix List which is a community initiative (led by Mozilla) to provide
an accurate list of domain name suffixes - ie.
.com/.orgbut also.co.uketc - since there is no good algorithmic way of determining the highest level at which a domain may be registered for a particular TLD as each registrar is different- so could set a cookie with
domain=co.UKwith a URL of saycurl.co.ukand this would then get sent to every other.co.ukdomain contrary to the expectations of the PSL which lists.co.ukas a PSL domain
- so could set a cookie with
[USN-6463-2] Open VM Tools vulnerabilities (02:56)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- SAML token signature bypass - allows an attacker who already has Guest Operation Privileges within a guest VM to elevate their privileges if the VM has been assigned a more privileged Guest Alias
- File descriptor hijack vulnerability within the
vmware-user-suidwrapper - a local user with non-root privileges that is able to hijack the/dev/uinputfile descriptor may be able to simulate user inputs
[USN-6538-1] PostgreSQL vulnerabilities (03:48)
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- Upgrades to the latest upstream point releases - includes both security and
bug fixes etc
- 15.5 (23.10, 23.04)
- 14.10 (22.04 LTS)
- 12.17 (20.04 LTS)
[USN-6539-1] python-cryptography vulnerabilities (04:14)
- 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- NULL pointer dereference / segfault on loading of crafted PKCS7 certificates
[USN-6540-1] BlueZ vulnerability (04:57)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- Whilst bluetooth discoverable, possible for an attacker to pair a HID device and inject keystrokes etc without any intervention
- Fixed by enabling the existing configuration
ClassicBondedOnly=true- this may break some legacy input devices like PS3 controller - in which case, should edit/etc/bluetooth/input.confand set this back tofalsebut then beware that you may be vulnerable to attack from anyone within bluetooth range when your machines is discoverable - ie. bluetooth settings panel is open
[USN-6541-1] GNU C Library vulnerabilities (06:30)
- 3 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Previous fix for CVE-2023-4806 was not sufficient - UAF in
getaddrinfo()- possible to still trigger
[USN-6522-2] FreeRDP vulnerabilities (07:00)
- 3 CVEs addressed in Bionic ESM (18.04 ESM)
- [USN-6522-1] FreeRDP vulnerabilities from Episode 215
[USN-6542-1] TinyXML vulnerability (07:08)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- Infinite loop able to be triggered by a crafted XML document - CPU-based DoS
[USN-6543-1] GNU Tar vulnerability (07:18)
-
1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
-
Stack buffer overflow on parsing a tar archive with an extremely large extended attribute name/value -
PAXarchive format allows to store extended attributes - on the kernel’s VFS layer these are limited to 255 bytes for the name and 64kB for the value - but in a tar these can be basically arbitrary -
When processing the archive, tar would allocate space for these on the stack - BUT the stack is limited to a maximum size of 8MB normally - so if can specify an xattr name of more than 8MB can overflow the entire stack memory region - then into guard pages or even beyond, triggering a segfault or at worst a heap corruption and hence possible RCE -> but in Ubuntu we have enabled stack clash protection since 19.10 - which turns this into a DoS only
- Reminiscent of the original Stack Clash “System Down” vulnerability in systemd
$ hardening-check $(which tar) /usr/bin/tar: Position Independent Executable: yes Stack protected: yes Fortify Source functions: yes (some protected functions found) Read-only relocations: yes Immediate binding: yes Stack clash protection: yes Control flow integrity: yes -
Speaking from experience, it is not easy to create such an archive - either through a real xattr on disk or through specifying one on the command-line (since you can specify arbitrary attributes be stored for files when adding them to an archive but then you hit the maximum limit of command-line arguments) BUT it is possible - in my case I did this though using sed to replace the contents of a xattr name in an existing archive with a crafted one and then doing a bunch of other hacks to fixup all the metadata of the tar archive to match - helpfully, all these attributes in the archive are stored as NUL-terminated strings, so can simply used sed to fix them all up assuming you can calculate the correct values
-
Fixed by instead allocating these on the heap which does not have the same arbitrary limitation as the stack
[USN-6500-2] Squid vulnerabilities (11:35)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- [USN-6500-1] Squid vulnerabilities from Episode 214
[USN-6544-1] GNU binutils vulnerabilities (11:44)
- 5 CVEs addressed in Trusty ESM (14.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- Didn’t do bounds checking properly in various places - leading to heap buffer
overflows / OOB reads etc in various things like
objdumpetc
[USN-6545-1] WebKitGTK vulnerabilities (12:08)
- 2 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- Both issues that come from upstream webkit
- OOB read -> info leak
- Memory corruption that Apple said was being exploited in the wild against various versions of iOS
[USN-6546-1] LibreOffice vulnerabilities (12:45)
- 2 CVEs addressed in Lunar (23.04), Mantic (23.10)
- Uses gstreamer to play embedded videos (presumably in presentations etc) - to do this, creates a gstreamer pipeline including the filename of the video itself - this was not adequetely escaped, so could allow arbitrary code execution if it contained shell meta characters etc
- Link targets allow arbitrary script execution - similar to historic CVE-2023-2255 from [USN-6144-1] LibreOffice vulnerabilities in Episode 198
[USN-6547-1] Python vulnerability (13:46)
- 1 CVEs addressed in Lunar (23.04)
- Issue specific to Python 3.11 where if a path contained an embedded NUL byte
and was passed to
os.path.normpath()it would get truncated at the NUL byte - fixed to remove this behaviour
[USN-6550-1] PostfixAdmin vulnerabilities (14:19)
- 3 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- Issues in various embedded modules - Smarty and Moment.js - allowing possible arbitrary code execution, XSS or DoS
[USN-6551-1] Ghostscript vulnerability (14:37)
- 1 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- UAF on file object on error path
[USN-6552-1] Netatalk vulnerability (14:43)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Apple Filing Protocol (AFP) service - similar to SMB for Windows - allows a Ubuntu machine to share files with MacOS
- Also implements support for Spotlight to search - using tracker as the indexer, metadata store and search engine under-the-hood
- Parser for spotlight RPC packets failed to properly do type checking, resulting in a type confusion bug and possible RCE via memory corruption - similar to CVE-2023-34967 for Samba since the code in netatalk originated from that code from Samba ([USN-6238-1] Samba vulnerabilities from Episode 204)
[USN-6554-1] GNOME Settings vulnerability (15:57)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- GNOME settings allows the ability to turn on / off remote SSH access from the sharing panel within the main settings application in Ubuntu
- Since moving to socket activated SSHd in 22.10, GNOME Settings was never updated in Ubuntu to support this as well
- Would mean that it would always show the machine was not accessible / sharing via SSH even when it was (since it would only check the status of the ssh.service, not ssh.socket)
- Ubuntu specific issue - fixed by extending GNOME settings to check both the service and the socket (since it is still a legitimate configuration to use the service over the socket in recent Ubuntu releases)
- Also backported to older releases since it is also a supported configuration there to use socket activation (although the sysadmin has to set this up themselves)
[USN-6553-1] Pydantic vulnerability (17:49)
- 1 CVEs addressed in Focal (20.04 LTS)
- Python data validation library
- CPU-based DoS since if passed the value of “infinity” to the validator to be parsed as a date/datetime, would result in an infinite loop
[USN-6536-1] Linux kernel vulnerabilities (18:10)
- 6 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
[USN-6537-1] Linux kernel (GCP) vulnerabilities
- 11 CVEs addressed in Mantic (23.10)
[USN-6548-1] Linux kernel vulnerabilities
- 10 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
[USN-6549-1] Linux kernel vulnerabilities
- 11 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6534-2] Linux kernel vulnerabilities
- 12 CVEs addressed in Lunar (23.04)
[USN-6549-2] Linux kernel (GKE) vulnerabilities
- 11 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6548-2] Linux kernel vulnerabilities
- 10 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
Goings on in Ubuntu Security Community
Ubuntu 23.04 (Lunar Lobster) approaching EOL (18:48)
- https://lists.ubuntu.com/archives/ubuntu-security-announce/2023-December/007974.html
- Interim releases receive 9 months of support
- Lunar reaches EOL on 25th January
- Good opportunity over the holiday break to upgrade to 23.10 (Mantic)
Ubuntu Security team (and rest of Canonical) on break till early January 2024 (19:33)
- Various members of the team will be checking in each day to look for any serious issues
- Not planning any new security update releases during this time unless something major happens (we are still wincing from Log4Shell - Log4Shell explodes the internet from Episode 142 in late December 2022)
- As usual, contact us via the normal means if something is particularly urgent and someone should respond
Get in contact
Episode 215
8 december 2023 |
31 min
Overview
Mark Esler is our special guest on the podcast this week to discuss the OpenSSF’s Compiler Options Hardening Guide for C/C++ plus we cover vulnerabilities and updates for GIMP, FreeRDP, GStreamer, HAProxy and more.
This week in Ubuntu Security Updates
65 unique CVEs addressed
[USN-6521-1] GIMP vulnerabilities (00:50)
- 6 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- Includes 4 recent issues disclosed via Trend’s ZDI - all found by the same researcher - 2 heap buffer overflows in DDS and PSD parsers, ab integer overflow and a separate off-by-one error in the PSP parser which could apparently lead to remote code execution plus a couple DoS related issues (unhandled exception and an excessive memory allocation) - both leading to a crash
[USN-6522-1] FreeRDP vulnerabilities (01:39)
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- Windows RDP client
- Malicious server could send a crafted drive redirect to the client - triggering an OOB read, causing the client to disclose memory contents and therefore possibly sensitive info to the server
- Plus an OOB write and an OOB read on crafted image data - both also likely leading to a crash
[USN-6523-1] u-boot-nezha vulnerability (02:19)
- 3 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04)
- u-boot for the Allwinner Nezha RISC-V board
- Missing length checks in DFU parser -> heap buffer overflow
- 2 other buffer overflows when handling fragmented IP packets
[USN-6524-1] PyPy vulnerability (03:06)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- Integer overflow leading to a buffer overflow in SHA3 - comes from the original reference implementation of SHA3
- Has affected a range of packages in Ubuntu
- PHP, Python itself and now PyPy
[USN-6525-1] pysha3 vulnerability (03:06)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- Same as above
[USN-6519-2] EC2 hibagent update
- Affecting Xenial ESM (16.04 ESM)
[USN-6526-1] GStreamer Bad Plugins vulnerabilities (03:16)
- 6 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- Heap overflow in PGS subtitle overlay decoder
- Various integer overflows -> heap buffer overflows in MXF container handler (Material Exchange Format) - apparently used for delivering advertisements to TV stations and for movies in commercial theatres - specifically in handling of files using AES3 audio
- MXF demuxer UAF
- AV1 buffer overflow
- Integer overflow -> stack overflow in H.256 parser
[USN-6527-1] OpenJDK vulnerabilities (04:09)
- 2 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- 11.0.21 + 17.0.9
[USN-6528-1] OpenJDK 8 vulnerabilities (04:25)
- 4 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- 8u392
[USN-6509-2] Firefox regressions (04:34)
- 10 CVEs addressed in Focal (20.04 LTS)
- 120.0.1 - in particular includes a fix where Firefox would crash immediately on startup but only for aarch64 (arm64) on Linux when using page sizes other than 4K - ie. as used in Apple silicon etc
[USN-6529-1] Request Tracker vulnerabilities (05:25)
- 4 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- Possible timing attack in the authentication module - could allow to enumerate user accounts
- XSS plus some info leaks as well
[USN-6530-1] HAProxy vulnerability (06:12)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Mishandling of # character in URIs could allow unexpected routing of a URI
containing say
index.html#.pngto a static server (since usually is configured to route.pngto a static server, but in this case the request is really forindex.html)
[USN-6531-1] Redis vulnerabilities (07:06)
- 6 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- Heap overflow in cjson library able to be triggered by a Lua script -> RCE
- Race condition on setting permissions on the local unix socket - if using a less restrictive umask could allow a local attacker to race redis on startup
- Also various integer overflows and other issues fixed too
[USN-6494-2] Linux kernel vulnerabilities (08:08)
- 9 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
[USN-6495-2] Linux kernel vulnerabilities
- 2 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
[USN-6496-2] Linux kernel vulnerabilities
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6502-4] Linux kernel vulnerabilities
- 5 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04)
[USN-6532-1] Linux kernel vulnerabilities
- 10 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
[USN-6533-1] Linux kernel (OEM) vulnerabilities
- 2 CVEs addressed in Jammy (22.04 LTS)
[USN-6534-1] Linux kernel vulnerabilities
- 12 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04)
Goings on in Ubuntu Security Community
Alex discusses the OpenSSF’s Compiler Options Hardening Guide for C/C++ with Mark Esler (08:38)
Get in contact
Episode 214
1 december 2023 |
20 min
Overview
This week we take a deep dive into the Reptar vuln in Intel processors plus we look into some relic vulnerabilities in Squid and OpenZFS and finally we detail new hardening measures in tracker-miners to keep your desktop safer.
This week in Ubuntu Security Updates
115 unique CVEs addressed
[USN-6481-1] FRR vulnerabilities (01:21)
- 2 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- Two different crashes reported by network pentester from Amazon - appears to be fuzzing frr -> DoS
[USN-6482-1] Quagga vulnerabilities (01:42)
- 2 CVEs addressed in Focal (20.04 LTS)
- Speaking of BGP daemons - Quagga was the precursor to FRR - also suffers from one of these CVEs, plus and older one that was previously fixed in FRR ([USN-5685-1] FRR vulnerabilities from Episode 181) that would lead to an OOB read
[USN-6483-1] HTML Tidy vulnerability (02:05)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- Implemented parser as a recursive algorithm - so on deeply nested documents, could end up exhausting the stack and causing memory corruption etc.
- Fixed by reimplementing the parser as an iterative loop with a heap-based stack
[USN-6480-1] .NET vulnerabilities (02:42)
- 2 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
[USN-6484-1] OpenVPN vulnerabilities (02:51)
- 2 CVEs addressed in Lunar (23.04), Mantic (23.10)
- Two issues which only affected more recent versions of OpenVPN (>= =2.6.0) - one UAF and the other a possible divide by zero -> DoS
[USN-6485-1] Intel Microcode vulnerability (03:13)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- Tavis Ormandy’s latest processor bug - “Reptar” - found again using the same technique as he used to find Zenbleed (AMD) but this time in Intel processors - essentially can be thought of as akin to fuzzing but instead of generating random input to find unexpected behaviour, generate some random input in the form of a set of processor instructions, and then also generate an equivalent version of this by adding random alignment, serialization and memory fence instructions etc. These extra instructions shouldn’t change the behaviour of the program being executed, so if a difference is observed then can likely assume the hardware has behaved incorrectly - perhaps some underlying microarchitectural behaviour has been triggered - but either way could indicate the presence of a hardware bug which could in turn be exploited as a vulnerability to cause undesired affects
- In this case, found a sequence of instructions that in general should be ignored but which could instead cause the processor to hit a machine check exception and halt - even from an unprivileged guest VM - this is the kind of things that cloud providers worry about
- Theorised that since they can cause MCEs by corrupting various internal state of the processor, they could potentially get privilege escalation if they could control that corruption with enough precision but since it is not really possible to debug the microarchitectural state of the processor it is not easy to develop such a PoC
- Reported the issue to Intel who released a microcode update to fix this, and Tavis released a PoC tool to test for and reproduce the basic issue
[USN-6486-1] iniParser vulnerability (06:25)
- 1 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- Possible NULL ptr deref on crafted input
[USN-6487-1] Avahi vulnerabilities (06:36)
- 5 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- Various assertions were able to be triggered through crafted input - so a local attacker on your network could cause your local avahi daemon to crash
[USN-6489-1] Tang vulnerability (07:09)
- 1 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Race condition when generating keys - would write to a file and then set permissions so only root could read them - small time window then where another process could possibly read the key before the more restrictive permissions are set - fixed by setting a restrictive umask before creating the file such that it gets created with the restrictive permissions from the start
[USN-6488-1] strongSwan vulnerability (07:59)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
[USN-6490-1] WebKitGTK vulnerabilities
- 2 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
[USN-6491-1] Node.js vulnerabilities
- 6 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6493-1, USN-6493-2] hibagent update
- Affecting Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
[USN-6492-1] Mosquitto vulnerabilities (08:06)
- 6 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Multiple memory leaks which can be triggered through crafted packets -> DoS
- Excessive CPU usage when parsing a connect request from a client with a large number of user-properties -> DoS
- Logic bug - failed to revoke existing subscriptions when a topic subscription is revoked in some cases - would still get notified after the fact - info / privacy leak
[USN-6498-1] FRR vulnerabilities (08:55)
- 4 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- More issues discovered by Iggy Frankovic at Amazon - seemingly through fuzzing of frr - UAF, OOB read etc.
[USN-6499-1] GnuTLS vulnerability (09:13)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- Timing side-channel during RSA-PSK ClientKeyExchange - response time would vary if given malformed ciphertext compared to when using correct PKCS#1 v1.5 padding - very similar to historical CVE-2023-0361 ([USN-5901-1] GnuTLS vulnerability from Episode 189) - in that case the same issue was fixed for regular RSA - but no-one noticed that the same problematic code existed for this other case as well
- Old adage - if you want to find a vuln, look near other previous vulns - and by the same token, if a project has a vuln reported, go looking to see if perhaps there are other instances of the same vuln in the code base
- Lots of projects have lots of copy-pasted or duplicated code within themselves
[USN-6500-1] Squid vulnerabilities (10:20)
- 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- Back in early 2021 a security audit was performed on Squid which found 55 vulnerabilities - these were reported to the upstream project and some CVEs were assigned but a lot went without any fix
- Unfortunately the Squid project is understaffed and hasn’t had the resources to fix all the issues
- Researchers eventually got tired of waiting (approx 900 days so not surprising) - so released details publicly of all their findings
- https://megamansec.github.io/Squid-Security-Audit/
- A mix of CVEs and GHSAs have been assigned for some, but not all issues, so some are still unfixed
- This update contains fixes for all the CVEs which have been assigned so far - expect more updates in the future
[USN-6494-1] Linux kernel vulnerabilities
- 9 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
[USN-6495-1] Linux kernel vulnerabilities
- 2 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
[USN-6496-1] Linux kernel vulnerabilities
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6497-1] Linux kernel (OEM) vulnerabilities (11:50)
- 3 CVEs addressed in Jammy (22.04 LTS)
- Logic issue in handling of x2AVIC MSR in KVM nested virtualisation on AMD processors - could allow an attacker in a guest VM to cause a crash on the host kernel and hence a DoS against the whole host
[USN-6502-1] Linux kernel vulnerabilities
- 5 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04)
- UAF in the error handling code for SMB file system - local attacker could use this to escalate privileges
[USN-6502-2] Linux kernel (Oracle) vulnerabilities
- 5 CVEs addressed in Lunar (23.04)
[USN-6502-3] Linux kernel (NVIDIA) vulnerabilities
- 5 CVEs addressed in Jammy (22.04 LTS)
[USN-6503-1] Linux kernel vulnerabilities
- 5 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
[USN-6516-1] Linux kernel (Intel IoTG) vulnerabilities
- 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6520-1] Linux kernel (StarFive) vulnerabilities
- 16 CVEs addressed in Jammy (22.04 LTS)
[LSN-0099-1] Linux kernel vulnerability (12:49)
- 16 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
| Kernel type | 22.04 | 20.04 | 18.04 | 16.04 | 14.04 |
|---|---|---|---|---|---|
| aws | 99.2 | 99.1 | 99.1 | 99.1 | — |
| aws-5.15 | — | 99.2 | — | — | — |
| aws-5.4 | — | — | 99.1 | — | — |
| aws-6.2 | 99.2 | — | — | — | — |
| aws-hwe | — | — | — | 99.1 | — |
| azure | 99.2 | 99.1 | — | 99.1 | — |
| azure-4.15 | — | — | 99.1 | — | — |
| azure-5.4 | — | — | 99.1 | — | — |
| azure-6.2 | 99.2 | — | — | — | — |
| gcp | 99.2 | 99.1 | — | 99.1 | — |
| gcp-4.15 | — | — | 99.1 | — | — |
| gcp-5.15 | — | 99.2 | — | — | — |
| gcp-5.4 | — | — | 99.1 | — | — |
| gcp-6.2 | 99.2 | — | — | — | — |
| generic-4.15 | — | — | 99.1 | 99.1 | — |
| generic-4.4 | — | — | — | 99.1 | 99.1 |
| generic-5.15 | — | 99.2 | — | — | — |
| generic-5.4 | — | 99.1 | 99.1 | — | — |
| gke | 99.2 | 99.1 | — | — | — |
| gke-5.15 | — | 99.2 | — | — | — |
| gkeop | — | 99.1 | — | — | — |
| hwe-6.2 | 99.2 | — | — | — | — |
| ibm | 99.2 | 99.1 | — | — | — |
| ibm-5.15 | — | 99.2 | — | — | — |
| ibm-5.4 | — | — | 99.1 | — | — |
| linux | 99.2 | — | — | — | — |
| lowlatency-4.15 | — | — | 99.1 | 99.1 | — |
| lowlatency-4.4 | — | — | — | 99.1 | 99.1 |
| lowlatency-5.15 | — | 99.2 | — | — | — |
| lowlatency-5.4 | — | 99.1 | 99.1 | — | — |
canonical-livepatch status
[USN-6501-1] RabbitMQ vulnerability
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
[USN-6504-1] tracker-miners vulnerability (13:30)
- 1 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- Hardening of the seccomp sandbox in tracker
- [USN-6423-2] CUE vulnerability (07:04) from Episode 211 - libcue vuln from Kevin Backhouse at Github exploited this weakness in the existing seccomp sandbox to be able to mount their attack for that vulnerability
- At the time I discussed how the tracker developers were deploying additional hardening to ensure all threads used by tracker-miners were sandboxed - this is that fix
[USN-6505-1] nghttp2 vulnerability (15:20)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- [USN-6438-1, USN-6438-2, USN-6427-2] .NET vulnerabilities from Episode 212
- HTTP/2 Rapid Reset - affects multiple HTTP/2 implementations
[USN-6506-1] Apache HTTP Server vulnerabilities (15:27)
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- DoS against HTTP/2 implemtation - very similar to historical Slow Loris attack - fixing required backporting the entire version of the http/2 module from 2.0.10 back to earlier releases - thanks to Marc for this herculean effort
[USN-6507-1] GlusterFS vulnerability
- 1 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
[USN-6509-1] Firefox vulnerabilities (16:17)
- 10 CVEs addressed in Focal (20.04 LTS)
- 120.0
- One issue specific to Linux when running under X11 (and I assume XWayland) - when copying text using the Selection API, this would also be copied into the primary selection (aka where stuff goes when you highlight it and then paste it with middle mouse button)
[USN-6508-1, USN-6508-2] poppler vulnerabilities
- 5 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6511-1] OpenZFS vulnerability (17:21)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Oldest CVE patched in a while - was originally reported to openzfs project back in November 2013 - over 10 years ago
- When sharing over IPv6 would expose to everyone, not just the intended IPv6 address but to everyone
- Issue languished, eventually a CVE was assigned in Feb 2021 and then fixed in October 2021
[USN-6510-1] Apache HTTP Server vulnerability
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
[USN-6512-1] LibTIFF vulnerabilities
- 2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6513-1] Python vulnerabilities
- 2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
[USN-6514-1] Open vSwitch vulnerability (18:18)
- 1 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- Failed to properly handle OpenFlow rules for ICMPv6 Neighbour Advertisements - in some circumstances would match against the wrong rules and so could allow an attacker who could load certain rules to then cause other traffic to be redirected contrary to expectations - this would then result in an info leak
[USN-6515-1] Thunderbird vulnerabilities (18:46)
- 7 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- 115.5.0
[USN-6517-1] Perl vulnerabilities
- 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
[USN-6402-2] LibTomMath vulnerability
- 1 CVEs addressed in Mantic (23.10)
[USN-6513-2] Python vulnerability
- 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
[USN-6518-1] AFFLIB vulnerability
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
[USN-6519-1] EC2 hibagent update
- Affecting Bionic ESM (18.04 ESM)
Get in contact
Episode 213
17 november 2023 |
9 min
Overview
As we ease back into regular programming, we cover the various activities the team got up to over the past few weeks whilst away in Riga for the Ubuntu Summit and Ubuntu Engineering Sprint.
Goings on in Ubuntu Security Community
Ubuntu Security team at the Ubuntu Summit (00:48)
- Preparation for Riga Product Roadmap Sprint, Ubuntu Summit and Engineering Sprint from Episode 212
- In the last episode we previewed a couple talks by different folks from the Ubuntu Security Team - recordings for these will be available but currently there is only the livestreams from the main plenary room - as such, right now you can go watch Tobias’ talk “From Asahi Linux to Ubuntu: Running Linux on Apple Silicon”
Andrei publishes The Open Source Fortress (01:41)
- https://discourse.ubuntu.com/t/the-open-source-fortress-is-now-live/40183
- Back in August, Andrei put out a call for topic suggestions for a vulnerability discovery workshop that he was putting together, with a particular focus on open source code bases
- He presented this in a 90 minute session 2 weeks ago on the final day of the Ubuntu Summit
- He covered a number of topics with a focus on practical application of each
using dedicated tooling, e.g.:
- Threat modelling with OWASP Threat Dragon
- Secret scanning with Gitleaks
- Dependency scanning with OSV-Scanner
- Linting with Bandit and flawfinder
- Code querying with Semgrep
- Fuzzing with AFL++
- Symbolic execution with KLEE
- So not only did participants learn about a given technique, such as what fuzzing is etc, but also how they can easily apply it with standard tooling to find real world problems
- Due to the success of the workshop, he has decided to make the contents
publicly available
- Online wiki https://ossfortress.io/
- Presentation from the Summit
- Github repository with example projects to run the various tools against
- Pre-built docker images for the various tools used in the workshop
- Designed to be worked through in your own time
UbuCTF at the Ubuntu Engineering Sprint (04:15)
- Emi, Nishit, Andei, Amir and David from the team organised and held the first UbuCTF at the Engineering Sprint the week after the Ubuntu Summit
- Organised around a story of cyber crime fighting against a criminal gang in Riga
- 5 days, 26 challenges, 64 players
- Challenges covered a variety of topics
- Networking
- Web
- Crypto(graphy)
- Reverse engineering
- Pwning
- Vulnerability Patching
- Gave experience using tools like Wfuzz, Pwntools, cutter / rizin / radare2, Ghidra, Wireshark, insomnia and more
- 457 flags submitted (110 correct), 47 patches submitted
- Result was very close - won by Anton Troyanov (Senior Engineer on the MAAS team)
- Ubuntu Security team members were barred from competing as we had previously worked on these challenges - BUT shout out to Sudhakar Verma who just joined our team only 4 weeks ago and so didn’t have any prior experience with this CTF - managed to solve every single challenge 💪💪💪
Get in contact
Episode 212
27 oktober 2023 |
23 min
Overview
With the Ubuntu Summit just around the corner, we preview a couple talks by the Ubuntu Security team, plus we look at security updates for OpenSSL, Sofia-SIP, AOM, ncurses, the Linux kernel and more.
This week in Ubuntu Security Updates
91 unique CVEs addressed
[USN-6437-1] VIPS vulnerabilities (00:35)
- 5 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Jammy (22.04 LTS)
- Image processing library / CLI tool
- NULL ptr derefs + divide by zero -> crash -> DoS
- info leak since would fail to clear memory and leak this in the generated image
[USN-6435-1] OpenSSL vulnerabilities (01:26)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- CPU-based DoS via an execssively large DH modulus (
pparameter) value (over 10,000 bits) - OpenSSL by default will try and validate if the modulus over 10,000 bits and
raise an error - but before the error is raised it would still check other
aspects of the supplied key / parameters which in turn could use the
pvalue and hence take an excessive amount of time - fixed by checking this earlier and erroring out in that case - Then was found that the
qparameter could also be abused in the same way - since the size of this has to be less thanpwas fixed by just checking it against this
[USN-6450-1] OpenSSL vulnerabilities
- 4 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- Two CPU-based DoS issues above plus
- Possible truncation / overrun during the initialisation of various ciphers if
the key or IV lengths differ compared to when initially established - some
ciphers allow a variable length IV (e.g. AES-GCM) and so it is possible that
an application will use a non-standard IV length during the use of the cipher
compared to when they initialise it
- The API for this was only “recently” introduced (3.x) - and in general not a lot of applications will be affected
- Issue specific to the AES-SIV (mode of AES that provides deterministic
nonce-less key wrapping - used for key wrapping when transporting
cryptographic keys; as well as nonce-based authenticated encryption that is
resistant to nonce reuse)
- AES-SIV allows to perform authentication of data - and to do this the relevant OpenSSL API’s should be called with an input buffer length of 0 and a NULL ptr for the output buffer - BUT if the associated data to be authenticated was empty, in this case, OpenSSL would return success without doing any authentication
- In practice this is unlikely to be an issue since it doesn’t not affect non-empty data authentication which is the vast majority of use-cases
- Possible truncation / overrun during the initialisation of various ciphers if
the key or IV lengths differ compared to when initially established - some
ciphers allow a variable length IV (e.g. AES-GCM) and so it is possible that
an application will use a non-standard IV length during the use of the cipher
compared to when they initialise it
[USN-6165-2] GLib vulnerabilities (07:57)
- 5 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- [USN-6165-1] GLib vulnerabilities from Episode 199
[USN-6374-2] Mutt vulnerabilities (05:08)
- 2 CVEs addressed in Mantic (23.10)
- [USN-6374-1] Mutt vulnerabilities from Episode 210
[USN-6438-1, USN-6438-2, USN-6427-2] .NET vulnerabilities (05:15)
- 2 CVEs addressed in Mantic (23.10)
- HTTP/2 Rapid Reset - DoS on server side by clients sending a large number of
requests and immediately cancelling them many times over and over - exploited
in the wild recently, achieving the largest DoS attack bandwidths seen -
requires HTTP/2 implementations to essentially do heuristics over time to
track allocated streams against connections and block the connection when too
many are made or similar
- Fix for Kestrel web server in .NET
[USN-6362-2] .Net regressions
- 1 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04)
- [USN-6362-1] .NET vulnerability from Episode 209
- Fix for DoS in handling of X.509 certificates
[USN-6199-2] PHP vulnerability (06:31)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- [USN-6199-1] PHP vulnerability from Episode 202
[USN-6403-2] libvpx vulnerabilities (06:39)
- 2 CVEs addressed in Bionic ESM (18.04 ESM)
- WebM VP8/VP9 video en/decoder
- Heap buffer overflow -> DoS/RCE
- OOB read -> DoS
[USN-6408-2] libXpm vulnerabilities (07:00)
- 4 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- Infinite recursion -> stack exhaustion -> crash -> DoS
- Integer overflow -> heap buffer overflow -> RCE/DoS
- Two different OOB reads -> crash -> DoS
[USN-6448-1] Sofia-SIP vulnerability (09:01)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)
- SIP user agent - integer overflows and resulting heap buffer overflows due to missing length checks in the STUN message parser -> RCE
- Also fixed a OOB read as well -> DoS
[USN-6422-2] Ring vulnerabilities (09:17)
- 20 CVEs addressed in Mantic (23.10)
- Voice / video and chat platform (now called Jami, contains embedded copy of PJSIP - library implementing various related protocols for remote communication like SIP, STUN, RTP, ICE and others)
- Also missed various length checks, allowing possible integer underflow -> crash / memory corruption -> RCE
- Buffer overflow when using the internal DNS resolver
[USN-6449-1] FFmpeg vulnerabilities (09:58)
- 8 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- Various memory leaks -> DoS, plus some integer overflows -> buffer overflows in various parsers for different media types
[USN-6447-1] AOM vulnerabilities (11:32)
- 7 CVEs addressed in Focal (20.04 LTS)
- AV1 Video Codec Library - used by things like gstreamer, libavcodec - in turn
is used by a huge number of multimedia applications from blender, ffmpeg,
kodi, mplayer, obs-studio, vlc and more
- Very much a case of xkcd 2347 (Dependency)
- Various buffer overflows, use-after-frees, stack buffer overflow, NULL ptr derefs etc.
[USN-6288-2] MySQL vulnerability (12:40)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- [USN-6288-1] MySQL vulnerabilities from Episode 205
[USN-6451-1] ncurses vulnerability (12:47)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- Heap buffer overflow via crafted terminfo file - found by fuzzing
infotocap- terminfo files are usually trusted content so unlikely to be an issue in practice
[USN-6416-3] Linux kernel (Raspberry Pi) vulnerabilities (14:00)
- 13 CVEs addressed in Jammy (22.04 LTS)
- 5.15 raspi for 22.04 LTS
- Most interesting vuln fixed is AMD “INCEPTION” - [USN-6319-1] AMD Microcode vulnerability from Episode 207 - speculative execution attack similar to the original Spectre
- Have now added a mitigation within the kernel itself rather than having to rely on CPU microcode (particularly when that microcode only covers a subset of the affected CPUs)
[USN-6439-1, USN-6439-2] Linux kernel vulnerabilities (15:09)
- 11 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
- 4.4 generic,low-latency,kvm,aws etc
- includes various high priority fixes which we’ve covered in previous episodes
[USN-6440-1, USN-6440-2] Linux kernel vulnerabilities (15:40)
- 12 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- 4.15
- kvm, gcp, aws, azure, generic, lowlatency on 18.04 / 16.04 HWE
- azure 14.04
- same as above
[USN-6441-1, USN-6441-2] Linux kernel vulnerabilities (15:50)
- 9 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- 5.4 xilinx zyncmp, ibm, gkeop, kvm, oracle, aws, gcp, azure, generic, lowlatency
[USN-6442-1] Linux kernel (BlueField) vulnerabilities
- 10 CVEs addressed in Focal (20.04 LTS)
- 5.4 bluefiled (same as above)
[USN-6443-1] Linux kernel (OEM) vulnerabilities (15:55)
- 6 CVEs addressed in Jammy (22.04 LTS)
- 6.1 oem
[USN-6444-1, USN-6444-2] Linux kernel vulnerabilities (16:46)
- 11 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04)
- 6.2 starfive, aws, oracle, azure, kvm, lowlatency, raspi, gcp, generic for 23.04
[USN-6445-1, USN-6445-2] Linux kernel (Intel IoTG) vulnerabilities
- 24 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- CVE-2023-5197
- CVE-2023-4921
- CVE-2023-4881
- CVE-2023-4623
- CVE-2023-4622
- CVE-2023-44466
- CVE-2023-42756
- CVE-2023-42755
- CVE-2023-42753
- CVE-2023-42752
- CVE-2023-4273
- CVE-2023-4244
- CVE-2023-4194
- CVE-2023-4155
- CVE-2023-4132
- CVE-2023-3866
- CVE-2023-3865
- CVE-2023-3863
- CVE-2023-38432
- CVE-2023-34319
- CVE-2023-3338
- CVE-2023-2156
- CVE-2023-20569
- CVE-2023-1206
- 5.15 intel iotg
[USN-6446-1, USN-6446-2] Linux kernel vulnerabilities
- 11 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- 5.15 gkeop, nvidia, ibm, raspi, gcp, gke, kvm, oracle, aws, azure, azure-fde
Goings on in Ubuntu Security Community
Preparation for Riga Product Roadmap Sprint, Ubuntu Summit and Engineering Sprint (17:33)
- Ubuntu Summit
- https://events.canonical.com/event/31/
- Mark Esler will be presenting “Improving FOSS Security” - designed for FOSS maintainers who want to be proactive about security and protecting their users
- Tobias Heider will be presenting with Hector Martin on Asahi Linux and in particular Ubuntu Asahi - community project to bring the Asahi Linux work to Ubuntu (also was a great shout-out from Joe Ressington on the most recent Late Night Linux plus a good write-up on omgubuntu)
Goodbye and good luck to David Lane (21:31)
- Led the snap store reviewers work - much more streamlined process for folks interacting on the snapcraft forum
- Great manager + engineer and a great friend
- See you at b-sides cbr in 2024
Get in contact
Episode 211
20 oktober 2023 |
20 min
Overview
After a well-deserved break, we’re is back looking at the recent Ubuntu 23.10 release and the significant security technologies it introduces along with a call for testing of unprivileged user namespace restrictions, plus the details of security updates for curl, Samba, iperf3, CUE and more.
This week in Ubuntu Security Updates
26 unique CVEs addressed
[USN-6429-2, USN-6429-3] curl vulnerability (00:51)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- for Ubuntu Pro users
- under rare circumstances, possible that an application using libcurl would
potentially load cookies from a crafted file on disk - allowing a local
attacker to inject arbitrary cookies into a connection - although requires the
application to use the
curl_easy_duphandle()function - 2 CVEs addressed in Mantic (23.10)
- cookie issue above, plus a possible heap buffer overflow when using a SOCKS5 proxy, if the specified hostname was longer than 255 bytes
[USN-6425-3] Samba vulnerabilities (02:38)
- 4 CVEs addressed in Mantic (23.10)
- Various logic issues which could result in a range of effects, from attackers being able to truncate read-only files, or cause Samba to stop responding and hence DoS through to the ability to obtain all domain secrets
[USN-6425-2] Samba regression (03:06)
- 4 CVEs addressed in Focal (20.04 LTS)
- Previous security update for focal was miscompiled and resulted in an issue
when handling the
%Udirective in smb.conf - if specified a path to be shared like/home/%U/FILESthe%Uwould seemingly be ignored and not replaced with the username as expected - and hence the share would fail - this same issue actually occurred previously in January this year - have now added a regression test specifically to try and ensure we do not introduce this same issue in the future again
[USN-6430-1] FFmpeg vulnerabilities (04:25)
- 6 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- Most just memory leaks in handling of various crafted files -> DoS
- One heap buffer overflow - possible RCE but likely just DoS
- One integer overflow in FPS calculation
[USN-6431-1, USN-6431-2, USN-6431-3] iperf3 vulnerabilities (05:12)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Integer overflow -> heap buffer overflow -> RCE / crash - essentially, when
parsing a frame, would allocate memory for the frame, plus 1 extra byte for a
trailing NUL - if frame length was
MAX_UINTadding 1 then wraps the integer around back to zero - and so no memory gets allocated - and when copying into the subsequent memory get a buffer overflow - When preparing this update, Jorge discovered he could cause the iperf3 server to hang indefinitely on crafted input as well - reported this upstream and included that fix here as well
[USN-6432-1] Quagga vulnerabilities (06:26)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- 2 different DoS vulns - both OOB reads on crafted input -> crash
[USN-6436-1] FRR vulnerabilities (06:38)
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- FRR is the new Quagga
[USN-6394-2] Python vulnerability (06:52)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- Possible UAF in heapq module (aka priority queue implementation)
[USN-6423-2] CUE vulnerability (07:04)
- 1 CVEs addressed in Mantic (23.10)
- OOB write discovered by Kevin Backhouse from Github - allows for a one-click RCE on GNOME desktop due to the use of libcue by tracker - when a crafted CUE file is downloaded, will get automatically indexed by tracker and hence parsed by libcue triggering this bug -> RCE
- Interestingly, tracker employed a seccomp sandbox which should have limited the impact for this kind of issue (ie restricting what the exploit could do) but Kevin found a way to bypass this since the seccomp filter was only applied to the thread used to parse the file - not the main thread - so Kevin could simply delegate the code execution to the main thread to bypass this
- Upstream GNOME developers were already aware of this as a possible weakness in the sandbox, and so worked to ensure this is then applied to all threads within tracker, not just the one spawned to parse the particular file
[USN-6433-1] Ghostscript vulnerability (10:18)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Possible sandbox escape via a crafted PS document since it could modify the specified IJS server parameter binary to execute some other binary instead
[USN-6396-3] Linux kernel (Azure) vulnerabilities (10:55)
- 6 CVEs addressed in Trusty ESM (14.04 ESM)
- Various issues covered previously - 2 different UAFs - network packet classifier and bluetooth subsystems, recent speculative execution vulns in AMD and Intel processors and more
[USN-6434-1] PMIx vulnerability (11:24)
- 1 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- OpenPMIx implementiation - Process Management Interface Exascale Standard - API used in HPC environments
- Possible privilege escalation via race condition - library sets ownership of various files but would follow symlinks when doing this - so if a user could race it to swap a symlink out then could get it to set the ownership of a root owned file to themselves and gain the ability to read it etc
Goings on in Ubuntu Security Community
Ubuntu 23.10 (Mantic Minotaur) Released (12:41)
- https://ubuntu.com/blog/canonical-releases-ubuntu-23-10-mantic-minotaur
- Culmination of the last 6 months of work - this release in particular has a strong focus on raising the bar for security, and setting the stage for the next LTS (24.04)
- Two preview features - TPM-backed FDE on Ubuntu Desktop, and unprivileged user namespace restrictions via AppArmor
- Covered both of these in previous episodes
Call for testing of Unprivileged User Namespace Restrictions on Mantic
-
The hope is to get this enabled by default in 24.04 LTS - but we need as much testing as we can get to find anything else which is not working as expected beforehand - easy to do via a new sysctl
- Can either do it immediately:
sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=1 - Or can set this to be applied at boot via a new file in
/etc/sysctl.d, e.g.: create a file/etc/sysctl.d/60-apparmor.confwith the following contents:
kernel.apparmor_restrict_unprivileged_userns = 1 - Can either do it immediately:
-
Then if you do find something which is not working as expected, you can create a simple AppArmor profile which will allow it to use unprivileged user namespaces without any additional restrictions, e.g:
abi <abi/4.0>,
include <tunables/global>
/opt/google/chrome/chrome flags=(unconfined) {
userns,
# Site-specific additions and overrides. See local/README for details.
include if exists <local/opt.google.chrome.chrome>
}
- From a defensive security point of view, also is useful to enable an
additional sysctl to ensure that anything which is unconfined can’t just abuse
these profiles by
aa-exec‘ing themselves via that profile - so then also need to enable thekernel.apparmor_restrict_unprivileged_unconfined = 1sysctl too - One application that we are aware of that is impacted is LXD - which, to avoid issues, is currently disabling this automatically at startup - so for now you have to keep manually re-enabling this restriction until the LXD devs land a change to stop this https://github.com/canonical/lxd-pkg-snap/pull/187
- Also all applications based on chromium (ie all electron apps) may likely have issues since the chromium sandbox uses unprivileged user namespaces by default - we have already created profiles for the various ones in the Ubuntu archive that we are aware of, and for some third party ones too (Brave, Vivaldi etc) but we expect there will be others - in that case, let us know
- File a bug against apparmor:
ubuntu-bug apparmoror visit https://bugs.launchpad.net/ubuntu/+source/apparmor/+filebug
Get in contact
Episode 210
22 september 2023 |
21 min
Overview
It’s the Linux Security Summit in Bilbao this week and we bring you some highlights from our favourite talks, plus we cover the 25 most stubborn software weaknesses, and we look at security updates for Open VM Tools, libwebp, Django, binutils, Indent, the Linux kernel and more.
This week in Ubuntu Security Updates
88 unique CVEs addressed
[USN-6365-1] Open VM Tools vulnerability (00:45)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Failed to properly validate SAML tokens - uses the xmlsec library but when verifying the signature on a SAML document, failed to configure the library to only use the X509 certificate for validation - since presumably an attacker could intercept the SAML token, and replace the X509 cert with a different type of signature which would then be trusted by the xmlsec library and allow the attacker to gain access
[USN-6366-1] PostgreSQL vulnerability (01:34)
- 1 CVEs addressed in Xenial ESM (16.04 ESM)
- Fixed for other releases in [USN-6296-1] PostgreSQL vulnerabilities in Episode
206 - one issue, which allowed an attacker to escalate their privileges
(from
CREATEto being able to execute arbitrary code as a bootstrap superuser) also affected PostgreSQL 9.5 in Ubuntu 16.04
[USN-6364-1] Ghostscript vulnerabilities (01:59)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- Divide by zero and buffer overflow in handling of PDFs -> DoS / RCE?
[USN-6369-1] libwebp vulnerability (02:19)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- heap buffer overflow -> OOB write -> RCE
- originally reported as a vuln in Chrome on 12 September - full impact that
this was actually a bug in libwebp became clear a few days later
- Solar Designer has a good thread on the details on oss-security
[USN-6367-1] Firefox vulnerability (03:55)
- 1 CVEs addressed in Focal (20.04 LTS)
- 117.0.1 for the libwebp fix above
[USN-6368-1] Thunderbird vulnerabilities (04:04)
- 6 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- 102.15.1 - libwebp issue above plus various other issues - various UAFs,
missing
.xllfiles from standard blocklist that warns users when downloading executables - more of a windows issue but these are Excel add-in files - ie. plugins for Excel, “memory safety bugs”
[USN-6370-1] ModSecurity vulnerabilities (04:42)
- 3 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- CPU-based DoS when parsing excessively nested JSON objects (needs to be tens-of-thousands deep)
- Mishandling of NUL byte in file uploads - would parse the filename as a string
but if it contained an embedded NUL byte then filename would be truncated and
hence could result in a buffer overread or the ability to bypass the web
application firewall for rules which read from the
FILES_TMP_CONTENTvariable - Mishandling of HTTP multipart requests could also allow to bypass WAF
[USN-6371-1] libssh2 vulnerability (06:07)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- OOB read - low impact since requires to connect to a malicious server to trigger - and outcome is likely a DoS
[USN-6372-1] DBus vulnerability (06:26)
- 1 CVEs addressed in Xenial ESM (16.04 ESM)
- Ability to crash the dbus daemon by an unprivileged user - BUT only if there is a privileged user using the in-built monitoring interface of dbus to monitor the traffic - so low chance of being able to trigger this and the outcome is just a DoS anyway - and will be restarted by systemd anyway
[USN-6373-1] gawk vulnerability (07:02)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- Heap OOB read - DoS
[USN-6374-1] Mutt vulnerabilities (07:16)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- 2 different NULL ptr deref
- viewing crafted email
- composing from a specially crafted draft email
- DoS only
[USN-6375-1] atftp vulnerability (07:38)
- Affecting Jammy (22.04 LTS), Lunar (23.04)
- Could crash
atftpdif requesting a non-existant file - turns out to be a buffer overflow so could possibly be used for code execution
[USN-6376-1] c-ares vulnerability (7:50)
- 1 CVEs addressed in Focal (20.04 LTS)
- OOB read when parsing a crafted Start of Authority (SOA) reply
[USN-6377-1] LibRaw vulnerability (7:56)
- 1 CVEs addressed in Focal (20.04 LTS)
- Failed to reject images with invalid pixel aspect ratio - leading to an OOB read -> crash
[USN-6378-1] Django vulnerability (08:08)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- DoS via handling of URIs with a very large number of unicode characters - algorithm would parse from start of string forwards for every invalid unicode character - instead of just using the remainder of the string
[USN-6379-1] vsftpd vulnerability (08:47)
- 1 CVEs addressed in Focal (20.04 LTS)
- Possible application layer confusion attack (ALPACA) - abuses wildcard or multi-domain certificates to redirect traffic from one subdomain to another
[USN-6381-1] GNU binutils vulnerabilities (09:07)
- 8 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- memory leaks in nm and when disassembling microblaze instructions -> DoS
- various buffer overflows in different functions -> DoS / RCE
- failure to zero memory -> info leak
- OOB read in objdump
- heap buffer overflow in readelf
- in general, we don’t consider it safe to run binutils on untrusted inputs
[USN-6380-1] Node.js vulnerabilities (09:54)
- 6 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- abort when sending a crafted X509 certificate -> DoS
- 2 different HTTP request smuggling attacks
- possible bypass of HTTP authorization since would include whitespace in HTTP headers
- couple memory corruption issues in various operations implemented in C
[USN-6382-1] Memcached vulnerability (10:23)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- NULL ptr deref upon reception of a UDP multi-packet request
[USN-6389-1] Indent vulnerability (10:30)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- heap buffer overflow -> DoS / RCE
[USN-6339-4] Linux kernel (Intel IoTG) vulnerabilities (10:53)
- 8 CVEs addressed in Jammy (22.04 LTS)
- 5.15
- same set of vulns from [USN-6350-1, USN-6351-1, USN-6339-2, USN-6339-3] Linux kernel vulnerabilities
[USN-6383-1] Linux kernel vulnerabilities (11:15)
- 5 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04)
- 6.2 all in 23.04, HWE in 22.04
- speculative execution leak when performing a divide-by-zero on various AMD processors
- possible privilege escalation in ARM64 KVM implementation -> guest VM could then write to host memory -> code execution
- UAF in L2CAP socket handling in bluetooth - local DoS / code execution
- UAF in various network packet classifiers - local DoS via unprivileged user namespace
- Memory leak in netfilter - also able to be abused by an unprivileged user in a user namespace
[USN-6384-1] Linux kernel (OEM) vulnerabilities (12:23)
- 2 CVEs addressed in Jammy (22.04 LTS)
- 6.1
- speculative execution leak when performing a divide-by-zero on various AMD processors
- Memory leak in netfilter - also able to be abused by an unprivileged user in a user namespace
[USN-6385-1] Linux kernel (OEM) vulnerabilities (12:37)
- 37 CVEs addressed in Jammy (22.04 LTS)
- CVE-2023-4569
- CVE-2023-4273
- CVE-2023-4128
- CVE-2023-40283
- CVE-2023-4015
- CVE-2023-4004
- CVE-2023-3995
- CVE-2023-3863
- CVE-2023-3777
- CVE-2023-3776
- CVE-2023-3611
- CVE-2023-3610
- CVE-2023-3609
- CVE-2023-3390
- CVE-2023-32269
- CVE-2023-3220
- CVE-2023-31436
- CVE-2023-3141
- CVE-2023-3090
- CVE-2023-2898
- CVE-2023-28466
- CVE-2023-28328
- CVE-2023-2269
- CVE-2023-2235
- CVE-2023-2163
- CVE-2023-2162
- CVE-2023-20593
- CVE-2023-2002
- CVE-2023-1611
- CVE-2023-1380
- CVE-2023-1206
- CVE-2023-4194
- CVE-2023-1076
- CVE-2023-1075
- CVE-2023-0458
- CVE-2022-4269
- CVE-2022-27672
- 6.0 OEM
- All the previously mentioned vulns plus a heap more - kudos to OEM team and Timo Aaltonen from the kernel team for the most number of CVEs fixed this week
[USN-6386-1] Linux kernel vulnerabilities (13:01)
- 4 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- 5.15 22.04 GA. 20.04 HWE
[USN-6387-1] Linux kernel vulnerabilities (13:08)
- 3 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- 5.4 20.04 GA, 18.04 HWE
[USN-6388-1] Linux kernel vulnerabilities (13:12)
- 9 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
- 4.4 16.04 GA, 14.04 HWE
Goings on in Ubuntu Security Community
Highlights from LSS EU (13:29)
- Hardware-backed Per-process Secrets - Matthew Garrett, Aurora
- Mark Esler described as a crystal clear explanation of how TPM works and proposes an automated attestation for confidential computing
- Estimating Security Risk Through Repository Mining - Tamas K. Lengyel, Intel
proposed that most common metrics don’t demonstrate code quality, except
possibly percentage of cognitive complex functions
- cyclomatic complexity measured how hard to test - cognitive complexity
tries to measure how hard to understand
- premise is that if you can’t understand it, you can’t see the vulns
- intuitively makes sense, but relies on the ability actually measure cognitive complexity
- Cognitive Complexity: A new way of measuring understandability white paper by G. Ann Campbell of SonarSource
- I missed this one but as Steve Beattie said, it does provide some things to think about in the context of the security reviews that the Ubuntu Security does as part of the MIR process (for a good overview of this, take a step back in time to Main inclusion review security code audits discussion with Seth Arnold from Episode 32)
- cyclomatic complexity measured how hard to test - cognitive complexity
tries to measure how hard to understand
Top 25 most stubborn weaknesses (17:13)
- https://cwe.mitre.org/top25/archive/2023/2023_stubborn_weaknesses.html
- MITRE 2023 CWE Top 25 Most Dangerous Software Weaknesses published from Episode 201
- 15 CWEs present in every one of the last 5 top 25 most dangerous lists from MITRE
| CWE-ID | Description | 2023 Rank |
|---|---|---|
| CWE-787 | Out-of-bounds Write | 1 |
| CWE-79 | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) | 2 |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) | 3 |
| CWE-416 | Use After Free | 4 |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) | 5 |
| CWE-20 | Improper Input Validation | 6 |
| CWE-125 | Out-of-bounds Read | 7 |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) | 8 |
| CWE-352 | Cross-Site Request Forgery (CSRF) | 9 |
| CWE-476 | NULL Pointer Dereference | 12 |
| CWE-287 | Improper Authentication | 13 |
| CWE-190 | Integer Overflow or Wraparound | 14 |
| CWE-502 | Deserialization of Untrusted Data | 15 |
| CWE-119 | Improper Restriction of Operations within Bounds of a Memory Buffer | 17 |
| CWE-798 | Use of Hard-coded Credentials | 18 |
- all fall into one of three different categories
- errors when processing of data from untrusted sources providing an initial entry point for compromise
- weaknesses from using languages that don’t provide strong memory safety guarantees
- poor security architecture / design choices
- re memory safety - MITRE note that this has been coming down - CWE-119 (“Improper Restriction of Operations within Bounds of a Memory Buffer”) was once ranked 1 5 years ago, is now 17. Related (but not directly memory safety but more correctness) CWE-190 (“Integer Overflow or Wraparound”) was ranked 5, is now 7.
- Really shows that if you are implementing any new code, choosing a language that is memory safe will help avoid a lot of the most prevalent security issues - clearly won’t help with lack of proper input validation or poor security architecture etc - but will cut out the most dangerous and most stubborn issues (OOB W, UAF etc)
Get in contact
Episode 209
15 september 2023 |
25 min
Overview
Andrei is back this week with a deep dive into recent research around CVSS scoring inconsistencies, plus we look at a recent Ubuntu blog post on the internals of package updates and the repositories, and we cover security updates in Apache Shiro, GRUB2, CUPS, RedCloth, curl and more.
This week in Ubuntu Security Updates
77 unique CVEs addressed
[USN-6346-1] Linux kernel (Raspberry Pi) vulnerabilities (00:55)
- 5 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- 5.4 raspi + HWE on 18.04
- Covered previously in [USN-6315-1] Linux kernel vulnerabilities from Episode 207
[USN-6347-1] Linux kernel (Azure CVM) vulnerabilities
- 24 CVEs addressed in Focal (20.04 LTS)
- CVE-2023-35829
- CVE-2023-35828
- CVE-2023-35824
- CVE-2023-35823
- CVE-2023-33288
- CVE-2023-33203
- CVE-2023-3268
- CVE-2023-32248
- CVE-2023-3141
- CVE-2023-30772
- CVE-2023-28466
- CVE-2023-23004
- CVE-2023-2269
- CVE-2023-2235
- CVE-2023-2194
- CVE-2023-2163
- CVE-2023-2124
- CVE-2023-2002
- CVE-2023-1990
- CVE-2023-1855
- CVE-2023-1611
- CVE-2023-0597
- CVE-2022-48502
- CVE-2022-4269
- Microsoft Azure CVM cloud systems - 5.15
[USN-6348-1] Linux kernel vulnerabilities
- 11 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- 5.15 Raspi on 22.04 / Intel-IoTG on 20.04
[USN-6349-1] Linux kernel (Azure) vulnerabilities
- 9 CVEs addressed in Focal (20.04 LTS)
- 5.4 Azure
[USN-6350-1, USN-6351-1, USN-6339-2, USN-6339-3] Linux kernel vulnerabilities
- 8 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- 5.15
- Oracle, AWS, GKE, Raspi, Azure on 22.04
- IBM, Oracle, AWS, GKE, Azure on 20.04
[USN-6340-2] Linux kernel vulnerabilities
- 9 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- 5.4 Xilinx ZyncMP, GKEOP, Raspi on 20.04; Raspi, GCP, Azure on 18.04 (Ubuntu Pro)
[USN-6342-2] Linux kernel (Azure) vulnerabilities
- 6 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- 4.15 Azure on all
[USN-6338-2] Linux kernel vulnerabilities
- 11 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04)
- 6.2
- Starfive, IBM, Oracle, GCP on 23.04
- GCP on 22.04
[USN-6357-1] Linux kernel (IBM) vulnerabilities
- 14 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- 5.4 IBM on 20.04 / 18.04
[USN-6345-1] SoX vulnerability (02:42)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Floating point exception via crafted content -> crash -> DoS
[USN-6352-1] Apache Shiro vulnerabilities (03:03)
- 2 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- Two different authentication bypasses for crafted HTTP requests - not great to have in a component whose purpose is to to authentication, authorisation, cryptopraphy and session management
[USN-6353-1] PLIB vulnerability (03:25)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- Portable games library - aims to work across a range of HW and OSes - used by torcs and flightgear
- Integer overflow -> buffer overflow on crafted TGA file
[USN-6354-1] Python vulnerability (03:54)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- XML eXternal Entity when parsing XML plist files - fix was to reject entity declarations in plist files - this is consistent with the behaviour in Apple’s plutil tool as well
[USN-6355-1] GRUB2 vulnerabilities (04:14)
- 10 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- Various grub vulns - see [USN-4992-1] GRUB 2 vulnerabilities from Episode 121 for the previous lot - these updates were published back in February to the -updates pocket and have now been synced to -security
- various OOB R/W via crafted images (Daniel Axtens), integer overflow when parsing crafted IP packets -> buffer overflow, OOB write via crafted HTTP header, UAF in chainloader and more
[USN-6356-1] OpenDMARC vulnerabilities (05:08)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- Open Source implementation of the DMARC specification
- Possible to inject authentication results via a crafted domain
- 1-byte heap buffer overflow of a NUL-byte - likely just crash -> DoS
[USN-6164-2] c-ares vulnerabilities (05:39)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- [USN-6164-1] c-ares vulnerabilities from Episode 199
[USN-6237-3] curl vulnerabilities (05:50)
- 3 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- [USN-6237-1] curl vulnerabilities from Episode 203
[USN-6359-1] file vulnerability (06:01)
- 1 CVEs addressed in Jammy (22.04 LTS)
- stack-based buffer over-read -> crash, DoS
[USN-6360-1] FLAC vulnerability (06:18)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- buffer overflow -> RCE / crash
[USN-6361-1] CUPS vulnerability (06:27)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Default configuration failed to require authentication for the
CUPS-Get-Documentoperation - could allow other users to fetch print documents without authentication
[USN-6362-1] .NET vulnerability (06:46)
- 1 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04)
- DoS in X509 certs handling
[USN-6358-1] RedCloth vulnerability (06:52)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- ReDoS via crafted HTML payload - upstream maintainer hasn’t responded to the original report or to the PR with the proposed fix - one of the rare occasions where we deploy a fix that is not blessed by upstream - also demonstrates though that we try and maintain the software in Ubuntu even when upstream stops supporting it (whether officially or not)
[USN-6363-1] curl vulnerability (08:03)
- 1 CVEs addressed in Lunar (23.04)
- Provides an API to access headers from past HTTP responses - so stores headers in memory, but failed to limit how large this could be - so if a malicious server provided a response with a very large header then could DoS the application using libcurl - limited to 300KB total per response - which is similar to how Chrome behaves
Goings on in Ubuntu Security Community
Part 4 of Andrei’s deep dive into cybersecurity research ()
“Shedding Light on CVSS Scoring Inconsistencies: A User-Centric Study on Evaluating Widespread Security Vulnerabilities” - to appear in IEEE Symposium on Security & Privacy (aka S&P) in 2024
- Tries to answer the questions “Are CVSS evaluations consistent?” and “Which factors influence CVSS assessments?”
- https://arxiv.org/abs/2308.15259
- https://www.first.org/cvss/specification-document
- https://www.first.org/cvss/user-guide
- https://www.first.org/cvss/examples
- https://www.first.org/cvss/examples#OpenSSL-Heartbleed-Vulnerability-CVE-2014-0160
- https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
- https://ubuntu.com/blog/securing-open-source-through-cve-prioritisation
Ubuntu updates, releases and repositories explained (22:18)
- https://ubuntu.com/blog/ubuntu-updates-releases-and-repositories-explained
- by Aaron Whitehouse - Senior Public Cloud Enablement Director at Canonical, leads the team that drives Canonical’s joint initiatives with the major public clouds
Get in contact
Episode 208
8 september 2023 |
25 min
Overview
This week we detail the recently announced and long-awaited feature of TPM-backed full-disk encryption for the upcoming Ubuntu 23.10 release, plus we cover security updates for elfutils, GitPython, atftp, BusyBox, Docker Registry and more.
This week in Ubuntu Security Updates
93 unique CVEs addressed
[USN-6322-1] elfutils vulnerabilities (00:38)
- 10 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- All the older CVEs (2018-2019) for Ubuntu 14.04 only - and all of these are just DoS through OOB read / NULL ptr deref etc
- OOB write / off-by-one + CPU-based DoS as well for more recent releases -> code execution / crash | DoS
[USN-6323-1] FRR vulnerability (01:40)
- 1 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04)
- Missing length check when handling particular options - would cause an OOB read and hence a crash of bgpd within frr - similar to recent issues like [USN-6136-1] FRR vulnerabilities from Episode 198
[USN-6326-1] GitPython vulnerability (02:11)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Incomplete fix for historical CVE-2022-24439 ([USN-5968-1] GitPython vulnerability from Episode 192)
- Essentially allows to get RCE since calls
git cloneand doesn’t completely validate the options and so leads to shell-command injection - thanks to Sylvain Beucler from Debian LTS team for noticing this and pointing it out to the upstream project
[USN-6333-1] Thunderbird vulnerabilities (03:00)
- 9 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- 102.15.0
[USN-6334-1] atftp vulnerabilities (03:10)
- 3 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- TFTP server and client packages
- All 3 issues in the atftpd server
- assertion failure when handling crafted Multicast Read Request
- buffer overflow when handling crafted request with multiple options
- buffer overread when handling crafted options data - would read past the
array of options and into adjacent memory - according to the CVE this would
then be the data from
/etc/groupon the server but likely this is not deterministic and would be whatever else was on the heap
[USN-6335-1] BusyBox vulnerabilities (05:20)
- 2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- Invalid
free()on malformed gzip data - on error, sets bit 1 of a pointer to indicate that an error occurred - would then go and pass this pointer tofree()but now the pointer is 1-byte past where it should be - so need to unset this bit first - In shell handling of crafted input could trigger a stack overflow when parsing certain arithmetic expressions -> crash / RCE - BUT since this is in parsing of shell expressions anyway could just easily pass actual shell code to evaluate surely?
[USN-6336-1] Docker Registry vulnerabilities (07:52)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Tools to pack and server docker images - ie. to stand up your own docker registry for serving OCI images
- Two different DoS since didn’t place any bounds on the size of various parameters in requests - so when handling a crafted request with a very large value, would try and allocate enough memory for that and then potentially run out of memory and crash
- Even in languages like Go which are memory safe, we still run into real world limits like this - whilst in computing we like to have abstractions like unlimited memory, and can generally program assuming this to be true, need to be careful still when handling untrusted input
[USN-6321-1] Linux kernel vulnerabilities (09:21)
- 10 CVEs addressed in Lunar (23.04)
- 6.2 for StarFive and GCP
- Covered previously in [USN-6315-1] Linux kernel vulnerabilities from Episode 207
[USN-6325-1] Linux kernel vulnerabilities
- 11 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- 5.15 GKEOP, Intel IoTG
[USN-6324-1] Linux kernel (GKE) vulnerabilities
- 5 CVEs addressed in Focal (20.04 LTS)
- 5.4 for GKE
[USN-6327-1] Linux kernel (KVM) vulnerabilities
- 6 CVEs addressed in Xenial ESM (16.04 ESM)
[USN-6328-1] Linux kernel (Oracle) vulnerabilities
- 10 CVEs addressed in Lunar (23.04)
[USN-6329-1] Linux kernel vulnerabilities
- 5 CVEs addressed in Bionic ESM (18.04 ESM)
[USN-6330-1] Linux kernel (GCP) vulnerabilities
- 11 CVEs addressed in Focal (20.04 LTS)
[USN-6331-1] Linux kernel (Azure) vulnerabilities
- 21 CVEs addressed in Focal (20.04 LTS)
- CVE-2023-3776
- CVE-2023-3611
- CVE-2023-3609
- CVE-2023-33203
- CVE-2023-3141
- CVE-2023-3111
- CVE-2023-30772
- CVE-2023-28466
- CVE-2023-2194
- CVE-2023-2124
- CVE-2023-20593
- CVE-2023-1990
- CVE-2023-1855
- CVE-2023-1611
- CVE-2023-0590
- CVE-2022-4269
- CVE-2022-40982
- CVE-2022-27672
- CVE-2022-1184
- CVE-2022-0168
- CVE-2020-36691
[USN-6332-1] Linux kernel (Azure) vulnerabilities
- 35 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- CVE-2023-4015
- CVE-2023-4004
- CVE-2023-3995
- CVE-2023-3777
- CVE-2023-3776
- CVE-2023-3611
- CVE-2023-3610
- CVE-2023-3609
- CVE-2023-35829
- CVE-2023-35828
- CVE-2023-35824
- CVE-2023-35823
- CVE-2023-33288
- CVE-2023-33203
- CVE-2023-3268
- CVE-2023-32248
- CVE-2023-3141
- CVE-2023-30772
- CVE-2023-28466
- CVE-2023-23004
- CVE-2023-2269
- CVE-2023-2235
- CVE-2023-2194
- CVE-2023-2163
- CVE-2023-21400
- CVE-2023-2124
- CVE-2023-20593
- CVE-2023-2002
- CVE-2023-1990
- CVE-2023-1855
- CVE-2023-1611
- CVE-2023-0597
- CVE-2022-48502
- CVE-2022-4269
- CVE-2022-40982
[USN-6337-1] Linux kernel (Azure) vulnerabilities
- 16 CVEs addressed in Bionic ESM (18.04 ESM)
[USN-6338-1] Linux kernel vulnerabilities
- 11 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04)
[USN-6339-1] Linux kernel vulnerabilities
- 8 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6340-1] Linux kernel vulnerabilities
- 9 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
[USN-6341-1] Linux kernel vulnerabilities
- 5 CVEs addressed in Trusty ESM (14.04 ESM)
[USN-6342-1] Linux kernel vulnerabilities
- 6 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
[USN-6343-1] Linux kernel (OEM) vulnerabilities
- 7 CVEs addressed in Jammy (22.04 LTS)
[USN-6344-1] Linux kernel (Azure) vulnerabilities
- 11 CVEs addressed in Lunar (23.04)
Goings on in Ubuntu Security Community
TPM-backed Full Disk Encryption is coming to Ubuntu (10:48)
- https://ubuntu.com/blog/tpm-backed-full-disk-encryption-is-coming-to-ubuntu
- Ijlal Loutfi (Product Manager for Security Technologies)
- Technical work has been led by Chris Coulson from our team - from early research, design and implementation
- Ubuntu has traditionally offered FDE via LUKS on-top of LVM since 6.06 - back then it was via an alternate install image but in 12.10 got integrated into the main install image
- Uses a passphrase which is manually typed in at boot to unlock the disk
- Not very useful in environments which don’t have a user to do this - ie. servers or IoT etc
- Demand for an ability to have FDE without having to enter a passphrase - particularly for IoT - so that if a device is stolen and the disk is removed it cannot be compromised
- Windows has long supported this via BitLocker - uses a hardware component called the Trusted Platform Module (TPM) to essentially store an encryption key which is only made available if the machine is booting the expected operating system under the expected BIOS etc
- As I said earlier, this is a feature that has high demand in the IoT space, so back in 2019 work was started to design and implement a similar solution for Ubuntu Core
- Debuted in Ubuntu Core 20 and has seen ongoing development through Ubuntu Core 22 and more since
- To ensure that the expected + trusted BIOS and OS is running, use the TPM to essentially store a chain of hashes of each component in the boot chain - ie. BIOS, bootloader (shim + grub), kernel (including the kernel command-line) and initrd etc
- When the TPM is asked to unlock the encryption key, it will check that the system is in the expected state by looking at the chain of hashes to make sure they match the one that was used when the key was locked into the TPM in the first place. If this is as expected, it will unlock the key, but if not (ie. the system is booting some other OS or the disk is running on some other machine etc) then the state won’t match the disk won’t be able to be unlocked
- This has traditionally been quite hard to do on traditional Ubuntu and general Linux systems since things like the initrd are composed on the local machine (see update-initramfs) - and so they can’t easily be signed and verified by such a system.
- But Ubuntu Core is a different beast, not subject to these same constraints - built on snaps for more specialised use-cases - so for Ubuntu Core 20 the kernel snap was updated to use unified kernel images which contain both the kernel and initrd (plus some other components) into a single UEFI binary - this allows them to be signed like existing kernel EFI binaries and hence verified during the boot process and measured by the TPM to support this use-case. Similarly, the gadget snap contains the bootloader and UEFI configuration etc - so this can also be measured and verified at boot to ensure the system is in the required state (ie. UEFI Secure Boot is enabled etc).
- Unlike Ubuntu Core, traditional or classic Ubuntu however uses debs for the kernel and shim etc, and so is not easily amenable to this same solution - also as mentioned above, components like the initrd and bootloader configuration are generated locally and so can’t easily be signed and hence verified at boot
- As such, to support this same use-case on traditional Ubuntu, the snap-based approach was reused - in this model, instead of deb packages providing kernel and shim + grub etc, snaps are used. As such, snapd is then also used to manage the TPM as described above - ie. calculate the expected hashes when a new kernel / bootloader is installed and re-seal the encryption key based on this
- This is then all provided via a new experimental option in the installer:
- Can list the recovery key once booted via:
snap recovery --show-keys
- Otherwise is intended to function like a regular Ubuntu install - but like BitLocker on Windows, you won’t have to enter a passphrase on boot but you still get full disk encryption - and the kernel and bootloader are delivered as snaps:
- Now you may ask, how is this different than existing solutions like Clevis?
- Clevis only verifies the bootloader and kernel and hence can be bypassed reasonably easily - in fact there was a recent blog from Pulse Security describing this kind of thing https://pulsesecurity.co.nz/advisories/tpm-luks-bypass
- In this case, the systemd
emergency.serviceunit is still enabled which allows the usual boot checks to be bypassed - Chris considered this in the original design for Ubuntu Core and so this is disabled
- Crucially, when using something like Clevis, the initrd is not verified, so an attacker can just replace the initrd with one of their own choosing to subvert the usual trusted boot process as well
- Interestingly the folks from Linux Matters were recently talking about TPM-backed FDE - mentioned systemd-cryptenroll - this can provide a more comprehensive solution since you can choose to have it verify more of the boot components BUT it still requires a lot of manual work to get running and won’t be as comprehensive in the end - also won’t necessarily auto-update when new kernels are installed etc
- Intended to be a holistic solution the provides robust protection against various online and offline attacks, whilst providing strong guarantees that things like Secure Boot is not bypassed and that the key from the TPM can’t be easily sniffed from the bus etc.
- Thanks again to Chris for leading this work
- Try it out, provide feedback
Get in contact
Episode 207
1 september 2023 |
22 min
Overview
This week we cover reports of “fake” CVEs and their impact on the FOSS security ecosystem, plus we look at security updates for PHP, Fast DDS, JOSE for C/C++, the Linux kernel, AMD Microcode and more.
This week in Ubuntu Security Updates
83 unique CVEs addressed
[USN-6305-1] PHP vulnerabilities (00:53)
- 2 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04)
- One interesting issue in the handling of XML - PHP uses the libxml library for
XML handling which maintains global state for things like whether XML external
entities should be loaded. However PHP also uses ImageMagick for image
handling, which also uses libxml (for say SVG parsing etc). As such,
ImageMagick may end up configuring XML EE to be enabled, which then in turn
enables it for all of PHP and so allows XML EE attacks - which can then be
used to read and disclose the contents of local files.
- Fixed by making PHPs use of libxml set a local context which explicitly turns off XML EE handling rather than relying on the global context
- Stack buffer overflow when reading dirents from PHAR archives
[USN-6306-1] Fast DDS vulnerabilities (02:28)
- 7 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04)
- C++ implementation of DDS standard - pub-sub model for connecting software components, used in various contexts like Adaptive AUTOSAR in the automotive industry and others
- DoS via traffic flood - fixed by implementing an exponential backoff for authentication requests
- various other DoS through different assertion failures, unhandled exceptions and a couple heap buffer overflows for good measure too
[USN-6307-1] JOSE for C/C++ vulnerability (03:33)
- 1 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- C library implementation of Javascript Object Signing and Encryption (JOSE) standard
- AES/GCM decryption would used the tag length value from the Authentication Tag provided in the JWE header rather than the fixed length of 16 as specified. Attacker could then provide a crafted JWE header with a shorter authentication tag to trigger a buffer overflow on the receiver -> crash -> DoS / info leak
[USN-6308-1] Libqb vulnerability (04:25)
- 1 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04)
- tooling for generating man pages from Doxygen XML files
- heap buffer overflow via an overly long input line when outputting certain log messages
[USN-6309-1] Linux kernel vulnerabilities (04:48)
- 6 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
- 4.4 GA in 16.04, HWE in 14.04
- Mentioned some of these last week in [USN-6285-1] Linux kernel (OEM) vulnerabilities
- deadlocks in device mapper and DVB Core drivers; UAFs in HFS+ file-system
impl, virtual terminal drivers and netfilter network packet classifier; OOB
write in QFS network scheduler
- DoS via CPU deadlock or crash; possible code execution for the UAFs / OOB write
[USN-6311-1] Linux kernel vulnerabilities (06:07)
- 24 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- CVE-2023-35829
- CVE-2023-35828
- CVE-2023-35824
- CVE-2023-35823
- CVE-2023-33288
- CVE-2023-33203
- CVE-2023-3268
- CVE-2023-32248
- CVE-2023-3141
- CVE-2023-30772
- CVE-2023-28466
- CVE-2023-23004
- CVE-2023-2269
- CVE-2023-2235
- CVE-2023-2194
- CVE-2023-2163
- CVE-2023-2124
- CVE-2023-2002
- CVE-2023-1990
- CVE-2023-1855
- CVE-2023-1611
- CVE-2023-0597
- CVE-2022-48502
- CVE-2022-4269
- 5.15 kernel variants for GCP and GKE
[USN-6312-1] Linux kernel vulnerabilities (06:22)
- 16 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- 5.4 for GKE on 20.04 and IBM on 18.04
[USN-6314-1] Linux kernel vulnerabilities (06:33)
- 16 CVEs addressed in Focal (20.04 LTS)
- 5.4 for IBM and BlueField (NVIDIA DPU family using ARM CPU cores from Mellanox (now owned by NVIDIA))
[USN-6315-1] Linux kernel vulnerabilities (06:58)
- 11 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- 5.15 GA (GKE, NVIDIA, IBM, GCP, KVM, Oracle, AWS, LowLatency) for 22.04 and HWE for 20.04 + some OEM specific kernels too
- Zenbleed ([USN-6244-1] AMD Microcode vulnerability from Episode 204) and
Gather Data Sampling ([USN-6286-1] Intel Microcode vulnerabilities from
Episode 205)
- Previously released microcode updates, now also shipping associated kernel
fixes - for Zenbleed this enables a workaround if the microcode is not
available (since for some CPUs this is only available as a BIOS update, not
via microcode in Ubuntu), whilst for GDS this simply provides kernel support
to help identify if the mitigation is in place or not - if no microcode is
available, can disable AVX entirely by setting
clearcpuid=avxon the kernel command-line (but this will have a decent performance impact)
- Previously released microcode updates, now also shipping associated kernel
fixes - for Zenbleed this enables a workaround if the microcode is not
available (since for some CPUs this is only available as a BIOS update, not
via microcode in Ubuntu), whilst for GDS this simply provides kernel support
to help identify if the mitigation is in place or not - if no microcode is
available, can disable AVX entirely by setting
[USN-6316-1] Linux kernel (OEM) vulnerabilities (09:02)
- 6 CVEs addressed in Jammy (22.04 LTS)
- 6.1 OEM on 22.04
[USN-6317-1] Linux kernel vulnerabilities (09:10)
- 5 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- 5.4 GA for 20.04 / HWE for 18.04
[USN-6318-1] Linux kernel vulnerabilities (09:20)
- 10 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04)
- 6.2 23.04 GA, HWE for 22.04
[USN-6310-1] json-c vulnerability (09:41)
- 1 CVEs addressed in Jammy (22.04 LTS)
- stack buffer overread on crafted input - interestingly the CVE says that it can allow code execution but that is the first time I have heard an OOB read can allow code execution
[USN-6313-1] FAAD2 vulnerabilities (10:08)
- 8 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- audio decoding library
- various heap and stack buffer overflows plus a NULL ptr deref for good measure
[USN-6319-1] AMD Microcode vulnerability (10:33)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- “INCEPTION” / “RAS Poisoning” - similar to the original SpectreV2 vulns - another variant of a speculative execution attack using the branch prediction buffer to cause an incorrectly speculated return to be executed which can then be inferred from a cache timing attack to read kernel memory
[USN-6320-1] Firefox vulnerabilities (11:13)
- 11 CVEs addressed in Focal (20.04 LTS)
- 117.0
[USN-6263-2] OpenJDK regression (11:24)
- 7 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- [USN-6263-1] OpenJDK vulnerabilities from Episode 204
- Upstream regression in handling of JAR files made with older versions of Ant etc - would fail to be decompressed
Goings on in Ubuntu Security Community
Reports of “Fake” CVEs being assigned by MITRE (12:07)
- https://riskybiznews.substack.com/p/open-source-projects-plagued-by-fake-cves
- Dan Lorenc from Chainguard posted about a heap of CVEs assigned just over 1 week ago (22nd August 2023) against a heap of open source projects - cURL, PostgreSQL, Python, nasm, ImageMagick and a heap more
- Each refers to either a bug report or patch sent to the upstream project that mentions a fix for seemingly real vulnerability (“buffer overflow”, “use after free” etc)
- But for most of these, the upstream project never agreed that these were valid
vulnerabilities, and some have come out to expressly disavow them - PostgreSQL
on CVE-2020-21469 and cURL on CVE-2020-19909
- PostgreSQL issue is a DoS via sending a repeated SIGHUP to the server
- BUT you need to have local access with priviliges to send SIGHUP - ie be root - and have access to the PostgreSQL superuser etc
- which if you do, you can do a lot more damage - ie. this is not a vulnerability - there is no privilege boundary being crossed etc
- cURL is an integer overflow in the
--retry-delaycommand-line option - where if you specify a really large value of seconds, cURL will multiply this by 1000 to convert it to ms and hence overflow- BUT this is not used for memory calculations etc - is just used for a retry delay - ie. it will only wait for say a few seconds rather than the billion odd seconds originally specified - again, there is no security impact here
- PostgreSQL issue is a DoS via sending a repeated SIGHUP to the server
- Dan posited that these were likely just scraped automatically and CVEs filed
- But who filed the CVEs?
- all show as assigned by MITRE - and anyone can request a CVE from MITRE as they are the CNA of last resort - https://cveform.mitre.org/
- BUT like all CNAs, they should be checking validating the information before assigning a CVE
- MITRE even rejected the request by Daniel Stenberg (@bagder) (cURL maintainer) to reject the CVE
- clearly something is breaking down here
- Not only does this create a heap of work for the upstream projects (as
mentioned by Risky Biz) but for all the downstreams like Ubuntu and other
distros
- We have to triage these CVEs against the packages in Ubuntu and determine whether the require immediate fixing etc - this takes time for everyone involved
- RiskyBiz calls these “Fake” CVEs - but they are not fake in the traditional sense - ie. they are not fradualent, they have been issued by the official custodians of CVEs - MITRE - but it is just that they are not actual vulnerabilities
- Is this just taking the Linux kernel mantra of security problems are just bugs (and hence to get kernel security fixes you need to get all kernel bug fixes as you won’t know which are the real vulns) to the opposite extreme - all bugs are security bugs and hence should get CVEs?
- Will have to wait and see how this plays out but if consumers can’t trust CVEs that will likely put the whole system in jeopardy since whilst CVEs have many shortcomings, they are the global defacto for vulnerability tracking
Get in contact
Episode 206
25 augusti 2023 |
16 min
Overview
This week we talk about HTTP Content-Length handling, intricacies of group management in container environments and making sure you check your return codes while covering vulns in HAProxy, Podman, Inetutils and more, plus we put a call out for input on using open source tools to secure your SDLC.
This week in Ubuntu Security Updates
69 unique CVEs addressed
[USN-6294-1, USN-6294-2] HAProxy vulnerability (01:00)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Would forward requests with empty
Content-Lengthheaders even when there was content in the request (which violates RFC 9110 - HTTP Semantics) - this RFC explicitly says:
If the message is forwarded by a downstream intermediary, a Content-Length field value that is inconsistent with the received message framing might cause a security failure due to request smuggling or response splitting. As a result, a sender MUST NOT forward a message with a Content-Length header field value that is known to be incorrect.
- As such, downstream HTTP/1 servers behind HAProxy may interpret the payload in the request as an extra request and hence this can be used for request smuggling as warned by the RFC
[USN-6295-1] Podman vulnerability (02:34)
- 1 CVEs addressed in Jammy (22.04 LTS)
- https://www.benthamsgaze.org/2022/08/22/vulnerability-in-linux-containers-investigation-and-mitigation/
- interaction between supplemental groups, negative group permissions and setgid binaries
- supplemental groups - each user generally has a group specific to their user (so-called primary group for that user), but can also belong to other supplemental groups:
ubuntu@ubuntu:~$ groups
ubuntu sudo
- negative group permissions - not used often but allows to say that a certain group of users should not be able to access something - ie. denylisting
- setgid binary - like a setuid binary - no matter what group that executes the binary, the binary runs as the primary group of the binary
- so could a user could create a binary, make it set-group for one of their
supplemental groups and then drop their primary group, run it and use that to
access such a resource that has been denied access to their primary group?
- no, since on login, primary group gets added to the list of supplemental groups which can’t be modified by a user themself - this has been the standard behaviour in UNIX since 1994 in BSD 4.4 and hence Linux has always worked this way too
- However, podman is a container manager though and it manages groups within the container - and it failed to do this duplication of the primary group into the supplemental group and so would allow exactly this attack
[USN-6296-1] PostgreSQL vulnerabilities (06:44)
- 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Latest upstream point releases, so contains both security fixes and other bug fixes
[USN-6298-1] ZZIPlib vulnerabilities (07:04)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- Provides the ability to read into a zip archive, as well as the ability to overlay a zip archive with an existing file system
- Used by applications like mpd, milkytracker and texlive (LaTeX etc)
- Two different DoS
- infinite loop -> CPU based DoS
- memory leak -> resource based DoS
- both require to parse an attacker provided ZIP archive
[USN-6297-1] Ghostscript vulnerability (07:50)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Buffer overflow when generating a PDF file for a DEVN device - DEVN is an abbreviation for DeviceN which is a type of colour space - ie a way of specifying different colour levels across a set of channels - ie. encoding colour information for a printer etc
- Needs an attacker to provide a crafted input file though…
[USN-6299-1] poppler vulnerabilities (08:40)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- someone has been fuzzing poppler - in particular the
pdftopsbinary - stack overflow and NULL ptr deref when handling crafted input PDFs -> crash -> DoS
[USN-6300-1] Linux kernel vulnerabilities (09:18)
- 24 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- CVE-2023-35829
- CVE-2023-35828
- CVE-2023-35824
- CVE-2023-35823
- CVE-2023-33288
- CVE-2023-33203
- CVE-2023-3268
- CVE-2023-32248
- CVE-2023-3141
- CVE-2023-30772
- CVE-2023-28466
- CVE-2023-23004
- CVE-2023-2269
- CVE-2023-2235
- CVE-2023-2194
- CVE-2023-2163
- CVE-2023-2124
- CVE-2023-2002
- CVE-2023-1990
- CVE-2023-1855
- CVE-2023-1611
- CVE-2023-0597
- CVE-2022-48502
- CVE-2022-4269
- 5.15 GA, AWS, GCP, IBM, Intel-IoTG, KVM, Low latency, NVIDIA, Raspi etc
- Have mentioned some of these previously - issues across various drivers and subsystems
- Lots of UAFs, a few OOB / NULL ptr deref, memory leak (DoS), OOB read / write as well
[USN-6301-1] Linux kernel vulnerabilities (10:07)
- 16 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- 5.4 Xilinx ZynqMP on 20.04 (Hi Portia!)
- HWE / OEM etc on 18.04 ESM
- Very similar sorts of issues as above
[USN-6267-3] Firefox regressions (10:44)
- 12 CVEs addressed in Focal (20.04 LTS)
- Second lot of regressions in the upstream 116 release - now at 116.0.3
- often these regressions are for Windows users etc but this time we have one for Linux - in particular screensharing on Wayland was broken since would fail to properly negotiate framerate in webrtc with Pipewire
[USN-6302-1] Vim vulnerabilities (11:22)
- 15 CVEs addressed in Trusty ESM (14.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- More vim - is now the 8th most mentioned package in this podcast (only behind Linux kernel, Firefox, Thunderbird, PHP, MySQL, WebkitGTK)
[USN-6303-1, USN-6303-2] ClamAV vulnerability (11:50)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Infinite loop in the HFS+ parser -> DoS of entire ClamAV
[USN-6304-1] Inetutils vulnerabilities (12:14)
- 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Provides various utilities for different network services - ie. clients / servers for ftp, telnet, and talk
- NULL ptr deref in telnetd - not super interesting - if running telnetd you probably have bigger problems
- Failed to check return values of the various
setuid()=/=setgid()system calls used in ftpd/rshd/rlogin etc- daemon runs as root and uses these calls to drop privileges to the user who is logging in - if these fail, then users session will still be running as root - easy privesc (although not really able to be controlled by the remote attacker to induce this error to occur)
Goings on in Ubuntu Security Community
Brainstorming for a software security workshop (13:53)
Get in contact
Episode 205
18 augusti 2023 |
20 min
Overview
We’re back after unexpectedly going AWOL last week to bring you the latest in Ubuntu Security including the recently announced Downfall and GameOver(lay) vulnerabilities, plus we look at security updates for OpenSSH and GStreamer and we detail plans for using AppArmor to restrict the use of unprivileged user namespaces as an attack vector in future Ubuntu releases.
This week in Ubuntu Security Updates
143 unique CVEs addressed
[USN-6268-1, USN-6269-1] GStreamer Base and Good Plugins vulnerabilities (01:07)
- 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Both CVEs discovered by an independent security researcher and reported via ZDI (ZDI-CAN-20775, ZDI-CAN-20994)
- Used by the built-in Videos app (aka totem) which can play streaming videos (even has a default plugin providing integration with Apple Video Trailers and others) - so could possibly be used for remote exploitation
- Integer overflow -> buffer overflow -> RCE in FLAC audio decoder
- Buffer overflow in PGS subtitle handler - failed to validate length before copying -> heap buffer overflow -> RCE
[USN-6270-1] Vim vulnerabilities (02:49)
- 11 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- Latest round of vim vulns - all via the bug bounty program and from just 3 researchers - would be interesting to know what kind of bounties are payed out for these “vulns” since most require the user to run vim with a crafted set of commands against a crafted input file - if you can get someone to do that, you can probably just write arbitrary shell code for them to execute as well…
[USN-6271-1] MaraDNS vulnerabilities (03:55)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
[USN-6272-1] OpenJDK 20 vulnerabilities
- 7 CVEs addressed in Lunar (23.04)
- 20.0.2
[USN-5064-3] GNU cpio vulnerability (04:08)
- 1 CVEs addressed in Trusty ESM (14.04 ESM)
- [USN-5064-1] GNU cpio vulnerability from Episode 130 - integer overflow -> heap buffer overflow if using untrusted pattern files
[USN-6275-1] Cargo vulnerability
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6273-1] poppler vulnerabilities
- 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
[USN-6274-1] XMLTooling vulnerability
- 1 CVEs addressed in Xenial ESM (16.04 ESM)
[USN-6276-1] unixODBC vulnerability
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
[USN-6267-2] Firefox regressions
- 12 CVEs addressed in Focal (20.04 LTS)
[USN-6277-1, USN-6277-2] Dompdf vulnerabilities
- 5 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6278-1, USN-6278-2] .NET vulnerabilities (04:41)
- 3 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04)
[USN-6279-1] OpenSSH update (04:53)
- Affecting Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- Possible info leak during algorithm negotiation - related to CVE-2020-14145 - which is a low priority vulnerability where it is possible for a person in the middle to determine if a client already has knowledge of the server’s host key. This could be used to then attack clients which do not have this knowledge (since they then will be prompted to accept and trust the host key which is offered on first connection) and offer them an attacker chosen host key to cause them to authenticate to a host controlled by the attacker and therefore intercept their connection etc
- There is a partial mitigation in the form of a client change so that if the client does already have the server’s host key, it will still preserve the original algorithm ordering sent to the server and so not leak this information.
- This is not a complete fix for this issue since it only mitigates some of the use-cases of the original vuln.
[USN-4336-3] GNU binutils vulnerabilities
- 6 CVEs addressed in Trusty ESM (14.04 ESM)
[USN-6243-2] Graphite-Web regression
- 4 CVEs addressed in Bionic ESM (18.04 ESM)
[USN-6281-1] Velocity Engine vulnerability
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
[USN-6282-1] Velocity Tools vulnerability
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
[USN-6283-1] Linux kernel vulnerabilities (07:34)
- 13 CVEs addressed in Lunar (23.04)
[USN-6284-1] Linux kernel vulnerabilities
- 16 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
[USN-6285-1] Linux kernel (OEM) vulnerabilities (07:50)
-
14 CVEs addressed in Jammy (22.04 LTS)
-
6.1 kernel
-
8 different high priority vulns - most mentioned previously - does include “GameOver(lay)” which we haven’t covered yet - reported by WizResearch and is specific to Ubuntu kernels
-
OverlayFS is a union filesystem which allows multiple filesystems to be mounted at the same time, and presents a single unified view of the filesystems. In 2018 we introduced some changes to OverlayFS as SAUCE patches to handle extended attributes in overlayfs. Then in 2020 we backported commits to fix CVE-2021-3493 - in the process this also added support for extended attributes in OverlayFS so now there were two code paths, each using different implementations for extended attributes. One was protected against the vuln in CVE-2021-3493 whilst the other was not.
-
This vulnerability is exploiting that same vulnerability in the unprotected implementation.
-
In this case, the vulnerability is in the handling of extended attributes in OverlayFS - the vulnerability is that it is possible to create a file with extended attributes which are not visible to the user, and then mount that file in a way which allows the extended attributes to be visible to the user
- this is done by mounting the file with the
nosuidoption, and then
remounting it with
suidoption. This allows the user to then execute arbitrary code as root. NOTE: requires the user to have the ability to haveCAP_SYS_ADMINbut this is easy with unprivileged user namespaces. - this is done by mounting the file with the
-
Even more reason to keep pursuing the effort to restrict the use of unprivileged user namespaces in upcoming Ubuntu 23.10
[USN-6286-1] Intel Microcode vulnerabilities (10:59)
- 3 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Gather data sampling (aka “Downfall”) - another microarchitectural CPU vulnerability - the last one we saw was Zenbleed from Episode 103 in AMD Zen2 CPUs
- This time in Intel hardware (6th to 11th generation) CPUs
- Presented at BlackHat just over 1 week ago - https://www.blackhat.com/us-23/briefings/schedule/#single-instruction-multiple-data-leaks-in-cutting-edge-cpus-aka-downfall-31490
- Similar to Zenbleed in a way, since both are related to the SIMD instruction set (single instruction, multiple data) - these instructions are used to perform the same operation on multiple data elements simultaneously (e.g. adding two vectors of 4 32-bit integers together) which is very useful for things like video encoding/decoding, image processing, etc.
- As the name, Gather data sampling suggests, the fault in this case is in the SIMD Gather instruction which is used to load data into a vector register from a memory location specified by an index vector register. Essentially this allows the efficient loading of data which is scattered across memory into a single register to then perform further operations on, and is useful in many applications. The vulnerability is that under speculative execution, the data which is loaded could be stale and come from an address which is not accessible to the current process, and the data could be used in further operations which could then leak the contents of that inaccessible memory - e.g. stealing cryptographic keys from another process.
- The fix in this case was a microcode update, which stops the CPU from speculatively executing the Gather instruction, and instead waits for the data to be available before executing the instruction. This results in a performance hit, which was measured at up to 50% in a small number of use-cases (whilst in others it is negligible).
- Perhaps the most interesting part of this vulnerability is the timeline - it was reported to Intel on 24th August 2022 yet only fixed publicly on 8th August 2023 - basically meaning it took a year for Intel to fix this issue.
- Associated with the microcode update is a kernel patch - this allows the
microcode fix to be reverted at boot by a new kernel command line option:
gather_data_sampling=off- this is useful for those who want to avoid the performance hit, and are willing to accept the risk of the vulnerability. - Ubuntu kernels have not yet been updated with this fix but that should arrive within the next week (ie. week of 21st August)
[USN-6280-1] PyPDF2 vulnerability
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6287-1] Go yaml vulnerabilities
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
[USN-4897-2] Pygments vulnerabilities
- 2 CVEs addressed in Trusty ESM (14.04 ESM)
- [USN-4897-1] Pygments vulnerability from Episode 110 - ReDoS
[USN-6288-1] MySQL vulnerabilities
- 11 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
[USN-6289-1] WebKitGTK vulnerabilities
- 9 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04)
[USN-6290-1] LibTIFF vulnerabilities
- 10 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
[USN-6291-1] GStreamer vulnerability
- 1 CVEs addressed in Xenial ESM (16.04 ESM)
[USN-6292-1] Ceph vulnerability
- 1 CVEs addressed in Lunar (23.04)
[USN-6293-1] OpenStack Heat vulnerability
- 1 CVEs addressed in Jammy (22.04 LTS)
Goings on in Ubuntu Security Community
Ubuntu 22.04.3 LTS Released (15:47)
Ubuntu 22.10 (Kinetic Kudu) End of Life (16:32)
Unprivileged user namespace restrictions via AppArmor in Ubuntu (17:00)
Get in contact
Episode 204
4 augusti 2023 |
28 min
Overview
This week we look at the recent Zenbleed vulnerability affecting some AMD processors, plus we cover security updates for the Linux kernel, a high profile OpenSSH vulnerability and finally Andrei is back with a deep dive into recent academic research around how to safeguard machine learning systems when used across distributed deployments.
This fortnight in Ubuntu Security Updates
123 unique CVEs addressed
[USN-6238-1] Samba vulnerabilities [01:15]
- 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04)
- Possible attacker-in-the-middle attack when configured to do SMB2 packet signing (as it was not properly enforced), couple issues in the Spotlight protocol implementation (used to enable MacOS clients to search the Samba share via Finder) - DoS via a possible infinite loop when processing RPC packets which specified 0 elements in an array-like structure, plus info leak where full server-side path of resources would be returned in results
[USN-6237-2] curl regression
- 3 CVEs addressed in Jammy (22.04 LTS)
[USN-6239-1] ECDSA Util vulnerability [02:13]
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- Very similar to “Psychic Signatures” vuln in Java (OpenJDK) - [USN-5546-1, USN-5546-2] OpenJDK vulnerabilities from Episode 172 - basically would fail to first check if the provided exponents in the signature were zero - since if they are, then an all-zero signature would be considered as valid - so could easily forge a signature
[USN-6232-1] wkhtmltopdf vulnerability
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
[USN-6241-1] OpenStack vulnerability
- 1 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04)
[USN-6240-1] FRR vulnerability
- 1 CVEs addressed in Lunar (23.04)
[USN-6242-1, USN-6242-2] OpenSSH vulnerability [03:08]
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Result of an incomplete fix for historical vulnerability CVE-2016-10009 in PKCS#11 module in ssh-agent
- Vuln is hence very similar to that, ie. if you chose to forward the ssh-agent
socket to a remote machine, then the remote machine could cause your local
ssh-agent to execute arbitrary code - it does this by causing the PKCS#11
module in ssh-agent to load an attacker controlled library from
/usr/libon your local machine- On the surface, it would appear that it would require a malicious library to
be on your machine in this privileged location - BUT there are a bunch of
seemingly innocuous libraries in say standard Ubuntu that can be abused to
cause malicious actions and get arbitrary code execution. This is exactly
what Qualys did to demonstrate the impact of this vuln -
https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt
- very clever use of various pieces of surprising behaviour from various libraries (such as the ability to make the stack executable or register signal handlers just by dlopen()‘ing a module) - chain these together to then get code execution
- It does though require you to use ssh-agent forwarding - this is generally
discouraged, and instead you should probably use an jump host - this is even
mentioned in the man page for
ssh
- On the surface, it would appear that it would require a malicious library to
be on your machine in this privileged location - BUT there are a bunch of
seemingly innocuous libraries in say standard Ubuntu that can be abused to
cause malicious actions and get arbitrary code execution. This is exactly
what Qualys did to demonstrate the impact of this vuln -
https://www.qualys.com/2023/07/19/cve-2023-38408/rce-openssh-forwarded-ssh-agent.txt
- Fixed by making module loading more defensive (ie that they contain the expected symbols and if not abort etc)
[USN-6243-1] Graphite-Web vulnerabilities
- 4 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6203-2] Django vulnerability
- 1 CVEs addressed in Bionic ESM (18.04 ESM)
[USN-6129-2] Avahi vulnerability
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
[USN-6244-1] AMD Microcode vulnerability [05:57]
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Zenbleed - Tavis Ormandy (GPZ) discovered new hardware vuln via fuzzing of the ISA - great writeup on his blog - https://lock.cmpxchg8b.com/zenbleed.html
- Only specific to AMD’s Zen2 family of processors and is related to speculative execution - but unlike Spectre etc, speculative execution is not used as the attack primitive - instead for Zenbleed, the processor fails to properly clean up state after speculatively executing a particular vector register instruction - which then allows an attacker thread / process to read this data from the vector register - all comes about because these registers are not like the normal physical registers in the CPU, but instead are shared as a “Register File” - this sharing means that when one instruction gets speculatively executed, but which turns out to not actually be needed, it fails to properly clean up - and then leaks this data via the shared register file which can be read by another process which is executing at the same time
- Tavis also released a handy PoC - requires the use of specific assembly
language intructions and so it is not clear if this could be exploited
remotely say via JS running a web-browser - but it definitely can be exploited
by local users to spy on all other processes in the system (that use vector
registers), including root / VMs etc
- What kinds of things use these vector registers? Turns out is is many, since glibc implements functions like strlen() using them - and this is a very common operation in all kinds of code
- So basically anyone with local unprivileged code-access on an affected system could snoop on passwords etc
- AMD released a microcode update to fix this - but only for server-oriented EPYC line of processors (code named “Rome”) - so in that case all you need to do is install this microcode update and reboot and you are good.
- But that still leaves a lot of other platforms without an official fix - according to their advisory they will release BIOS firmware updates for other affected processors later in the year
- You can however set a so-called “chicken bit” in the processor which (as far as I can tell) instructs it to not execute this particular instruction out-of-order (ie not speculatively execute it) - AMD haven’t actually said what this does but that is the assumption. As such, this does have an effect on performance, although it is not clear how much.
wrmsr -a 0xc0011029 $(($(rdmsr -c 0xc0011029) | (1<<9)))
- Kernel developers have then developed a patch to automatically enable this chicken-bit if the associated microcode update is not present - for Ubuntu we plan to include this fix in the next round of kernel security updates, due on 21st August
[LSN-0096-1] Linux kernel vulnerability [11:47]
- 5 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- OOB write in netfilter -> crash / code-exec - plus a UAF in netfilter as
well - both require
CAP_NET_ADMINto exploit - but can get this in an unprivileged user namespace -> privesc - Plus a bunch of vulns covered in previous episodes
- OOB read in the USB handling code for Broadcom FullMAC USB WiFi driver
- KVM mishandling of control registers for nested guest VMs
- OOB write in network queuing scheduler - also able to be triggered though an unprivileged user namespace
| Kernel type | 22.04 | 20.04 | 18.04 | 16.04 | 14.04 |
|---|---|---|---|---|---|
| aws | — | 96.2 | — | 96.2 | — |
| aws-hwe | — | — | — | 96.2 | — |
| azure | 96.3 | 96.2 | — | 96.2 | — |
| azure-5.4 | — | — | 96.2 | — | — |
| gcp | 96.3 | 96.2 | — | 96.2 | — |
| gcp-4.15 | — | — | 96.2 | — | — |
| gcp-5.15 | — | 96.3 | — | — | — |
| gcp-5.4 | — | — | 96.2 | — | — |
| generic-4.15 | — | — | 96.2 | 96.2 | — |
| generic-4.4 | — | — | — | 96.2 | 96.2 |
| generic-5.15 | — | 96.3 | — | — | — |
| generic-5.4 | — | 96.2 | 96.2 | — | — |
| gke | 96.3 | 96.2 | — | — | — |
| gke-5.15 | — | 96.3 | — | — | — |
| gke-5.4 | — | — | 96.2 | — | — |
| gkeop | — | 96.2 | — | — | — |
| gkeop-5.4 | — | — | 96.2 | — | — |
| ibm | 96.3 | 96.2 | — | — | — |
| ibm-5.4 | — | — | 96.2 | — | — |
| linux | 96.3 | — | — | — | — |
| lowlatency-4.15 | — | — | 96.2 | 96.2 | — |
| lowlatency-4.4 | — | — | — | 96.2 | 96.2 |
| lowlatency-5.15 | — | 96.3 | — | — | — |
| lowlatency-5.4 | — | 96.2 | 96.2 | — | — |
[USN-6246-1] Linux kernel vulnerabilities
- 6 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
[USN-6247-1] Linux kernel (OEM) vulnerabilities
- 6 CVEs addressed in Jammy (22.04 LTS)
[USN-6248-1] Linux kernel (OEM) vulnerabilities
- 7 CVEs addressed in Jammy (22.04 LTS)
[USN-6249-1] Linux kernel (OEM) vulnerabilities
- 2 CVEs addressed in Jammy (22.04 LTS)
[USN-6250-1] Linux kernel vulnerabilities
- 8 CVEs addressed in Lunar (23.04)
[USN-6251-1] Linux kernel vulnerabilities
- 4 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
[USN-6252-1] Linux kernel vulnerabilities
- 13 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
[USN-6254-1] Linux kernel vulnerabilities
- 12 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
[USN-6255-1] Linux kernel (Intel IoTG) vulnerabilities
- 6 CVEs addressed in Focal (20.04 LTS)
[USN-6256-1] Linux kernel (IoT) vulnerabilities
- 32 CVEs addressed in Focal (20.04 LTS)
- CVE-2023-35788
- CVE-2023-32269
- CVE-2023-32233
- CVE-2023-3161
- CVE-2023-31436
- CVE-2023-30456
- CVE-2023-2985
- CVE-2023-26545
- CVE-2023-2612
- CVE-2023-25012
- CVE-2023-2162
- CVE-2023-1998
- CVE-2023-1859
- CVE-2023-1829
- CVE-2023-1670
- CVE-2023-1513
- CVE-2023-1380
- CVE-2023-1281
- CVE-2023-1118
- CVE-2023-1079
- CVE-2023-1078
- CVE-2023-1077
- CVE-2023-1076
- CVE-2023-1075
- CVE-2023-1074
- CVE-2023-1073
- CVE-2023-0459
- CVE-2023-0458
- CVE-2022-4129
- CVE-2022-3903
- CVE-2022-3707
- CVE-2022-3108
[USN-6260-1] Linux kernel vulnerabilities
- 9 CVEs addressed in Jammy (22.04 LTS)
[USN-6261-1] Linux kernel (IoT) vulnerabilities
- 4 CVEs addressed in Focal (20.04 LTS)
[USN-6245-1] Trove vulnerabilities
- Affecting Jammy (22.04 LTS)
[USN-5807-3] libXpm vulnerability
- 1 CVEs addressed in Trusty ESM (14.04 ESM)
[USN-6253-1] libvirt vulnerability
- 1 CVEs addressed in Lunar (23.04)
[USN-6257-1] Open VM Tools vulnerability
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
[USN-6258-1] LLVM Toolchain vulnerabilities
- 4 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04)
[USN-5193-3] X.Org X Server vulnerabilities
- 3 CVEs addressed in Xenial ESM (16.04 ESM)
[USN-6259-1] Open-iSCSI vulnerabilities
- 3 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
[USN-6262-1] Wireshark vulnerabilities
- 5 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
[USN-6265-1] RabbitMQ vulnerability
- 1 CVEs addressed in Xenial ESM (16.04 ESM)
[USN-6264-1] WebKitGTK vulnerabilities
- 6 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04)
[USN-6263-1] OpenJDK vulnerabilities
- 7 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
[USN-6266-1] librsvg vulnerability [13:55]
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- Directory traversal vuln - arbitrary file read by using a specially crafted
includeelement that specifies say<xi:include href=”.?../../../../../../../../../../etc/passwd”/>- simple PoC provided by the upstream reporter
[USN-6267-1] Firefox vulnerabilities [14:47]
- 12 CVEs addressed in Focal (20.04 LTS)
- 116.0
Goings on in Ubuntu Security Community
Andrei discusses safeguarding machine learning infrastructure when used in distributed applications [15:05]
- https://arxiv.org/abs/2101.02281
- https://www.usenix.org/system/files/sec22-nguyen.pdf
- https://www.youtube.com/watch?v=nMrte2S9U68
Get in contact
Episode 203
21 juli 2023 |
17 min
Overview
This week we talk about the dual use purposes of eBPF - both for security and for exploitation, and how you can keep your systems safe, plus we cover security updates for the Linux kernel, Ruby, SciPy, YAJL, ConnMan, curl and more.
This week in Ubuntu Security Updates
80 unique CVEs addressed
[USN-6220-1] Linux kernel vulnerabilities (00:50)
- 1 CVEs addressed in Lunar (23.04)
- 6.2 gcp, ibm, azure, oracle
- [USN-6192-1] Linux kernel vulnerabilities for Episode 202
- Off-by-one in the flower network traffic classifier
- info leak via stale page table entries (INVLPG)
[USN-6234-1] Linux kernel (Xilinx ZynqMP) vulnerability (01:20)
- 1 CVEs addressed in Focal (20.04 LTS)
- 5.4 Xilinux ZynqMP platform
[USN-6221-1] Linux kernel vulnerabilities (01:32)
- 7 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
- 4.4 Xenial ESM, Trusty ESM LTS Xenial
- AWS, KVM, Generic, Low latency
[USN-6222-1] Linux kernel (Xilinx ZynqMP) vulnerabilities (02:13)
- 31 CVEs addressed in Focal (20.04 LTS)
- CVE-2023-32269
- CVE-2023-32233
- CVE-2023-3161
- CVE-2023-31436
- CVE-2023-30456
- CVE-2023-2985
- CVE-2023-26545
- CVE-2023-2612
- CVE-2023-25012
- CVE-2023-2162
- CVE-2023-1998
- CVE-2023-1859
- CVE-2023-1829
- CVE-2023-1670
- CVE-2023-1513
- CVE-2023-1380
- CVE-2023-1281
- CVE-2023-1118
- CVE-2023-1079
- CVE-2023-1078
- CVE-2023-1077
- CVE-2023-1076
- CVE-2023-1075
- CVE-2023-1074
- CVE-2023-1073
- CVE-2023-0459
- CVE-2023-0458
- CVE-2022-4129
- CVE-2022-3903
- CVE-2022-3707
- CVE-2022-3108
[USN-6223-1] Linux kernel (Azure CVM) vulnerabilities (02:25)
- 9 CVEs addressed in Jammy (22.04 LTS)
[USN-6224-1, USN-6228-1] Linux kernel vulnerabilities (02:36)
- 2 CVEs addressed in Lunar (23.04)
- 6.2 Oracle, Azure, GCP, IBM, Raspi, AWS, KVM, Low latency
[USN-6231-1] Linux kernel (OEM) vulnerabilities (02:53)
- 5 CVEs addressed in Jammy (22.04 LTS)
- 6.1 OEM
- OOB write due to uninitialized memory in packet control buffer for IP-VLAN network driver
[USN-6235-1] Linux kernel (OEM) vulnerabilities (03:17)
- 8 CVEs addressed in Jammy (22.04 LTS)
- 6.0 OEM
- Flower, missing lock in
io_uring
[USN-6219-1] Ruby vulnerabilities (03:32)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04)
- ReDoS in URI parser - only one issue really but fix for first was incomplete
[USN-6216-1] lib3mf vulnerability (04:09)
- 1 CVEs addressed in Focal (20.04 LTS)
- UAF
[USN-6225-1] Knot Resolver vulnerability (04:14)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)
- CPU-based DoS due to high algorithmic complexity - requires an authoritative server to return large address sets - fixed by adding a limit to various lookups etc
[USN-6226-1] SciPy vulnerabilities (04:45)
- 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)
- 2 issues in reference count handling - both appear to be disputed by upstream - first, as it would only be able to triggered by first deterministicly exhausting memory, the other since the only way to trigger it would be to first be able to execute arbitrary Python code. Both were reported by the same user who discovered them via static analysis
[USN-6227-1] SpiderMonkey vulnerabilities (05:47)
- 2 CVEs addressed in Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04)
- mozjs102 (102.13.0) - memory mishandling in JS engine
[USN-6229-1] LibTIFF vulnerabilities (06:00)
- 4 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- 2 heap buffer overflows, one OOB read, one NULL ptr deref
[USN-6230-1] PostgreSQL vulnerability (06:24)
- 1 CVEs addressed in Xenial ESM (16.04 ESM)
- [USN-6104-1] PostgreSQL vulnerabilities from Episode 197
[USN-6184-2] CUPS vulnerability (06:34)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- [USN-6184-1] CUPS vulnerability from Episode 201
[USN-6078-2] libwebp vulnerability (06:43)
- 1 CVEs addressed in Xenial ESM (16.04 ESM)
- [USN-6078-1] libwebp vulnerability from Episode 195
[USN-6183-2] Bind vulnerability (06:46)
- 2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- [USN-6183-1] Bind vulnerabilities from Episode 201
[USN-6233-1] YAJL vulnerabilities (06:56)
- 3 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- Yet Another JSON library - used by i3, mpd, uwsgi, modsecurity, libvirt and others
- Memory leak, buffer overflow on unicode parsing, integer overflow -> heap buffer overflow when handling inputs larger than 2GB
[USN-6236-1] ConnMan vulnerabilities (07:33)
- 9 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- a number of issues in internal gdhcp client - stack buffer overflow, OOB read (info leak) - requires an attacker to run a malicious DHCP server - think public wifi etc
- UAF in WISPR HTTP handling (MiTM)
- Heap buffer overflow gweb component - RCE
- 2 different OOB read in DNS proxy component - crash / info leak
- Also an infinite loop in DNS proxy
[USN-6237-1] curl vulnerabilities (08:45)
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04)
- Improperly matched wildcard patterns when doing certificate validation - in
particular could match a punycode-encoded IDN against an ascii wildcard of
x*as punycode names always start withxn-- - Logic error where would use the read callback to ask a remote client to ask for data to send even if the same handle had been used previously for a PUT request - unexpected behaviour for applications using curl, so could result in potentially sending the wrong data (info leak) or a UAF etc.
- Race condition on fopen() - used to save cookies etc to files - would first check that file is a real file before opening - local attacker could race to say replace it with a symlink instead to then get cookies written to a different file etc.
The dual use of eBPF as both a tool for malware and a tool for detecting malware (10:34)
- Interesting write-up on the use of eBPF by malware authors for hooking into libpam to steal credentials
- pamspy - uses eBPF uprobes - way of hooking into userspace functions from the kernel using user-level return probe
- requires to be root in the first place to be able to create a uretprobe
through
/sys/kernel/debug/tracing/uprobe_eventsbut once done, allows to then have a BPF program executed every time the specified function within a specified library / binary is executed - so by hooking libpam can then log the credentials used by any user when logging in / authenticating for sudo etc. - More traditional approach would have been to use say
LD_PRELOADto hook into the functions - but this requires that binaries get executed with this environment set so is harder to achieve - But uretprobes have their own problems - implementation is based on
breakpoints so potentially be detected by the program which is being traced by
examining its own code (
.textsection) to look for breakpoint opcode (0xCC) or it could look for the special memory mapping[uprobes]in/proc/self/maps - Potentially more easy to find that they are being used on a system as well by
just looking at the contents of
/sys/kernel/debug/tracing/uprobe_events- which lists all the uretprobes currently in use on the system - Interesting to see that (not surprisingly) each new technology can be used in multiple ways - BPF+uprobes is a great way to do tracing of userspace code for developers / sysadmins etc when debugging - but is also a great way for malware authors to do the same
- Also interesting to see the aquasec team mention the use of eBPF for system
monitoring / instrumentation to detect malware - ie. using an eBPF program to
detect malicious use of eBPF
- but perhaps the best solution is to disable the use of eBPF by unprivileged / untrusted users and use seccomp or similar (via systemd units) to restrict the use of eBPF to only those applications which really need it
- then the only way for malware to use eBPF would be to compromise something which already has access to eBPF - ie. the kernel itself or a privileged process - ie. reducing the attack surface
Get in contact
Episode 202
7 juli 2023 |
22 min
Overview
We take a sneak peek at the upcoming AppArmor 4.0 release, plus we cover vulnerabilities in AccountsService, the Linux Kernel, ReportLab, GNU Screen, containerd and more.
This week in Ubuntu Security Updates
50 unique CVEs addressed
[USN-6190-1] AccountsService vulnerability (00:47)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04)
- Mentioned in passing last week - reported to us by Kevin Backhouse from the Github Security Lab team
- DBus service that provides APIs to add, delete or modify system accounts - ie create a new user etc
- Originally developed by GNOME - used by gnome-control-center etc
- Also allows to configure language / locale settings etc
- In Ubuntu, we carry a custom patch which is used to synchronise the language
and locale from accountsservice to the local users
~/.pam_environmentfile which is used to configure various per-user session environment variables - this way no matter how you log in to a Ubuntu system, the locale etc that you configured via g-c-c etc gets used - Turned out there was a number of cases of UAF due to logic errors in the original patch - so an unprivileged user could trigger this and crash the accounts-daemon which runs as root
[USN-6191-1] Linux kernel regression (02:44)
- Affecting Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- Spurious warning message would be printed via the IPv6 subsystem
[USN-6192-1] Linux kernel vulnerabilities (03:10)
- 2 CVEs addressed in Jammy (22.04 LTS), Kinetic (22.10)
- Off-by-one in the flower network traffic classifier - flow based traffic control filter - allows to define a “flow” by a set of key/value pairs (ie. src MAC address, port number or various other types) - could be leveraged for DoS or potential code execution - PoC posted publicly but even then was stated that it doesn’t even crash the kernel, however gdb can be used to detect the OOB write
- Mishandling of locking in the
io_uringsubsystem - local attacker could use this to trigger a deadlock and hence a DoS - Possible info leak via stale page table entries - when KPTI was introduced in
the wake of Meltdown, to minimise the cost of flushing page table on every
entry/exit to/from kernel space, PCIDs are a hardware feature that was
introduced in more recent Intel processors to try and minimise this cost by
only flushing on exit back to userspace - this is done by issuing the
INVLPGinstruction - but it was found that on certain hardware platforms this did not actually flush the global TLB contrary to expectation - and so could leak kernel memory back to userspace
[USN-6193-1] Linux kernel vulnerabilities
- 1 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04)
- TC flower + INVLPG
[USN-6194-1] Linux kernel (OEM) vulnerabilities (06:04)
- 3 CVEs addressed in Jammy (22.04 LTS)
io_uringand TC flower plus OOB read in InfiniBand RDMA driver - DoS / info leak
[USN-6195-1] Vim vulnerabilities (06:26)
- 6 CVEs addressed in Jammy (22.04 LTS)
- More vim fuzzing results - OOB read, UAF, heap buffer overflow, NULL pointer dereference etc.
[USN-6196-1] ReportLab vulnerability (06:47)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04)
- Python library for producing PDFs - often used to convert HTML to PDF etc
- Bypass of validation originally put in place for a previous CVE-2019-17626 (see [USN-4273-1] ReportLab vulnerability in Episode 62)
- That vuln was RCE since reportlab would call the python
eval()function directly on value obtained from an XML document - To fix that, introduced a complex validation scheme so they could still use
eval()without having to remove this functionality - new update disables this by default and instead only allows a much limited subset of colors to be parsed
[USN-6197-1] OpenLDAP vulnerability (08:48)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- NULL pointer deref in certain circumstances if failed to allocate memory during various string handling operations - unlikely to be able to be triggered easily (would first need a memory leak bug or similar…)
[USN-6198-1] GNU Screen vulnerability (09:25)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- screen provides an API to allow the processes under its controlled to be say killed from another session - but would fail to check if the specified PID was actually owned by the calling user - so if screen was setuid, would allow a local user to send a SIGHUP to any other process on the system
- In Ubuntu screen is not setuid so this was not a real issue
[USN-6199-1] PHP vulnerability (10:35)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04)
- When generating a nonce for use in HTTP Digest during SOAP authentication, wouldn’t actually check the return value from the call to generate random data for the nonce - as such, the nonce would be whatever was previously in the stack memory - so could leak info from the stack, or this could be say all zeros which would defeat the purpose of the nonce
[USN-6200-1] ImageMagick vulnerabilities (11:27)
- 20 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04)
- Time for another frequent mention in the podcast - ImageMagick (seems to come up every 10 episodes or so)
- Huge range of CVEs fixed across the various releases with some dating back to 2020
- OOB read, stack bufffer overflow, NULL ptr deref, lots of heap buffer overflows
- Since 20.04, ImageMagick is now in universe, so for 20.04 LTS this update is available via Ubuntu Pro
[USN-6201-1] Firefox vulnerabilities (12:27)
- 13 CVEs addressed in Focal (20.04 LTS)
- 115.0
- Usual web browser issues (DoS, domain bypass, RCE etc) - but also bypass of cookie storage protections, possible spoofing attack via fullscreen notifications and others
[USN-6202-1] containerd vulnerabilities (13:09)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04)
- DoS when importing an OCI image with a really large manifest or image layout file - would try and read the whole JSON file into memory - could cause containerd to crash by running out of memory - limited to 20MBs
[USN-6203-1] Django vulnerability (13:55)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04)
- ReDoS in EmailValidator and URLValidator classes when parsing really long strings - fixed by rejecting anything longer than some hardcoded constants (2KB for URL, 320 chars for email as per RFC x3696)
Goings on in Ubuntu Security Community
AppArmor 4.0-alpha1 in progress (14:44)
- https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_4.0-alpha1
- “Bridge” between 3.0 style policy and new 4.0 policy
- New profile flags
- unconfined, debug
- New mediation types
- Minor changes
- Ability to filter the output of aa-status
- Inclusion of a new utility called aa-load which can load pre-compiled /
cached binary policies without the use of
apparmor_parser - Ability to run and compile policies as an unprivileged user (still need to be root to actually load the policy into the kernel)
AppArmor kernel fixes for Linux 6.5 (20:42)
Get in contact
Episode 201
30 juni 2023 |
20 min
Overview
This week we look at the top 25 most dangerous vulnerability types, as well as the announcement of the program for LSS EU, and we cover security updates for Bind, the Linux kernel, CUPS, etcd and more.
This week in Ubuntu Security Updates
36 unique CVEs addressed
[USN-6183-1] Bind vulnerabilities (00:53)
- 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04)
- Two DoS issues - when bind was configured as a recursive resolver, possible to cause the configured cache size to be exceeded by a remote attacker by performing queries in a particular manner (as this would then evade the normal cache cleaning algorithm) - DoS due to excessive memory usage -> OOM killer etc
- The other was due to a recursive algorithm that could be triggered in a pathological way when particular configuration options were used - eventually would exhaust the available stack space -> killed by stack protections -> DoS
[USN-6185-1] Linux kernel vulnerabilities (01:52)
- 8 CVEs addressed in Focal (20.04 LTS)
- 5.4 - IBM, GCP, GKEOP, raspi2, Azure, AWS, Bluefield, KVM, Oracle
- type confusion in real-time scheduler -> DoS
- few different UAF in various USB device drivers (and even PCMCIA) - could all be triggered by a local attacker with physical access
- UAF in HFS+ file-system + Xen 9P file-system protocol impl
[USN-6187-1] Linux kernel (IBM) vulnerabilities (02:49)
- 9 CVEs addressed in Kinetic (22.10)
- 5.19 IBM
- All of the above plus a possible deadlock in the network traffic control subsystem that could be triggered by a local attacker -> DoS
[USN-6186-1] Linux kernel vulnerabilities (03:06)
- 20 CVEs addressed in Lunar (23.04)
- All interesting CVEs discussed previously - [USN-6130-1] Linux kernel vulnerabilities in Episode 198
- netfilter race condition able to be triggered by a local attacker -> UAF -> DoS/RCE
- OOB read in the USB handling code for Broadcom FullMAC USB WiFi driver
- KVM mishandling of control registers for nested guest VMs
- OOB write in network queuing scheduler - able to be triggered though an unprivileged user namespace (again)
[USN-6184-1] CUPS vulnerability (03:55)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04)
- UAF since would log details of a connection after closing the connection (and
hence freeing the memory associated with the connection) - since was in the
logging code, would only happen if the log level was set to
warnor higher - could then either cause a crash (SEGV etc) or could potentially end up logging sensitive info if that was then present in that memory location
[USN-6188-1] OpenSSL vulnerability (04:43)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
- [USN-6119-1] OpenSSL vulnerabilities from Episode 197
- CPU-based DoS when parsing crafted ASN.1 object identifiers
[USN-6161-2] .NET regression (05:02)
- 5 CVEs addressed in Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04)
- [USN-6161-1] .NET vulnerabilities from Episode 199
- New upstream point release to address a regression in the previous release - would fail to import PKCS12 blobs where the private keys were protected by a null password (apparently this was non-deterministic which sounds like it was due to an uninitialised local variable…?)
[USN-6189-1] etcd vulnerability (05:55)
- 1 CVEs addressed in Kinetic (22.10), Lunar (23.04)
- Leaked credentials into the debug log which could then be accessed by a remote attacker via the debug API endpoint
Goings on in Ubuntu Security Community
MITRE 2023 CWE Top 25 Most Dangerous Software Weaknesses published (06:20)
| Rank | ID | Name | Score | CVEs in KEV |
|---|---|---|---|---|
| 1 | CWE-787 | Out-of-bounds Write | 63.72 | 70 |
| 2 | CWE-79 | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) | 45.54 | 4 |
| 3 | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) | 34.27 | 6 |
| 4 | CWE-416 | Use After Free | 16.71 | 44 |
| 5 | CWE-78 | Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) | 15.65 | 23 |
| 6 | CWE-20 | Improper Input Validation | 15.50 | 35 |
| 7 | CWE-125 | Out-of-bounds Read | 14.60 | 2 |
| 8 | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) | 14.11 | 16 |
| 9 | CWE-352 | Cross-Site Request Forgery (CSRF) | 11.73 | 0 |
| 10 | CWE-434 | Unrestricted Upload of File with Dangerous Type | 10.41 | 5 |
| 11 | CWE-862 | Missing Authorization | 6.90 | 0 |
| 12 | CWE-476 | NULL Pointer Dereference | 6.59 | 0 |
| 13 | CWE-287 | Improper Authentication | 6.39 | 10 |
| 14 | CWE-190 | Integer Overflow or Wraparound | 5.89 | 4 |
| 15 | CWE-502 | Deserialization of Untrusted Data | 5.56 | 14 |
| 16 | CWE-77 | Improper Neutralization of Special Elements used in a Command (‘Command Injection’) | 4.95 | 4 |
| 17 | CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | 4.75 | 7 |
| 18 | CWE-798 | Use of Hard-coded Credentials | 4.57 | 2 |
| 19 | CWE-918 | Server-Side Request Forgery (SSRF) | 4.56 | 16 |
| 20 | CWE-306 | Missing Authentication for Critical Function | 3.78 | 8 |
| 21 | CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’) | 3.53 | 8 |
| 22 | CWE-269 | Improper Privilege Management | 3.31 | 5 |
| 23 | CWE-94 | Improper Control of Generation of Code (‘Code Injection’) | 3.30 | 6 |
| 24 | CWE-863 | Incorrect Authorization | 3.16 | 0 |
| 25 | CWE-276 | Incorrect Default Permissions | 3.16 | 0 |
- https://cwe.mitre.org/top25/archive/2023/2023_top25_list.html
- MITRE (operates the US Homeland Security Systems Engineering and Development Institute) released the 2023 CWE Top 25 Most Dangerous Software Weaknesses
- Calculated by analysing the previous 2 years worth of public vulnerability data from NVD for their various root-causes and ranking those
- Also incorporates updates weakness data for the CVEs that form CISA’s (US Cybersecurity & Infrastructure Security Agency) known exploited vulnerabilities catalog (KEV)
- root-causes - CWE - common weakness enumeration - list of software and hardware weakness types
- Looked at CVEs published in 2021 and 2022 and used those where the CWEs could be mapped to the simplified collection of 130 weakness types which are the most common set
- Each CVE published by NVD has associated CWEs that identify the root-case for the vulnerability - these are generally chosen by the CNA who assigns the CVE (as they are most familiar with the product and vulnerability in question) or by an NVD analyst - multiple CWEs can be assigned for a CVE since they can often be part of chain
- Score was calculated as the frequency of the CWE compared to other CWEs in the
dataset, multiplied by the average CVSS score for all CVEs that had the CWE
- Have spoken in the past about perceived inaccuracies in CVSS scores and how they are not necessarily a good fit for determining the risk of a given CVE - but in this case, using them as the basis for this calculation is perhaps not awful as they are the only real objective measure of the potential severity of a CVE - and this is a noisy measure anyway
- Looking at the top 10, OOB writes come in way at the top with a score of 63.7,
then XSS (45.5), SQLi (34.3) after which follows a long tail of CWEs with
scores in the teens - UAF (16.7), OS Command Injection (15.6), Improper Input
Validation (15.5), OOB Read (14.6), Path Traversal (14.11), CSRF (11.73) and
finally Unrestricted Upload of File with Dangerous Type (10.4)
- Interesting to see the top 3 have a much higher score (all over 34) where as the rest are half this - below 16
- They also quote the number of CVEs that featured in the KEV list (known exploited vulns) - OOB W (70) yet XSS (4) + SQLi (6) - so just because there are more of a given type of vuln, doesn’t mean that they get exploited more - e.g. OOB reads are #7 yet only 2 in the list of KEV, and CSRF #9 yet none in the KEV list
- What does this mean for Ubuntu Security? Ultimately it is interesting and seems to back up our more traditional approach to CVE priority assignment compared to trying to use CVSS as a priority (again this is a severity score but doesn’t really indicate risk, which is what our traditional priority score is based on) - but perhaps is more interesting from an industry point of view - memory corruption vulns (OOB Writes) still most prevalent and impactful - static / dynamic analysis still very important to try and find these - but ultimately the move to memory safe languages (Rust, Go etc) is where we will finally see a shift away from this dominance
- Even then, will still be security bugs (XSS + SQLi, OS Command Injection, Improper Input Validation, Path Traveral, CSRF etc)
Linux Security Summit EU Schedule Published (17:16)
- https://events.linuxfoundation.org/linux-security-summit-europe/program/schedule/
- 20-21 September - in Bilbao Spain alongside the Open Source Summit
- Still chance to get Early Bird Registration (closes 6th July)
- BPF, exploit detection, estimating security risk of a given OSS project, OP-TEE (ARM Trust-Zone) usage, novel project using CHERI hardware architecture to protect security sensitive parts of the kernel, using TPM for per-process secret storage, secure boot, LSM Updates + LandLock and some more
Get in contact
Episode 200
23 juni 2023 |
20 min
Overview
For our 200th episode, we discuss the impact of Red Hat’s decision to stop publicly releasing the RHEL source code, plus we cover security updates for libX11, GNU SASL, QEMU, VLC, pngcheck, the Linux kernel and a whole lot more.
This week in Ubuntu Security Updates
73 unique CVEs addressed
[USN-6163-1] pano13 vulnerabilities (01:08)
- 2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- use by hugin-tools for stitching together photos into a panorama
- format-string vuln in
PTcroputility which could be abused to execute arbitrary code etc - OOB read (looks more like a NULL ptr deref from the upstream patch…) when parsing TIFF images
[USN-6168-1, USN-6168-2] libx11 vulnerability (01:55)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04)
- libx11 mishandled various Request, Event and Error IDs - these IDs get used as indexes into various arrays and so can be used to trigger OOB writes up - these IDs get supplied back from the X server to the X client - if were tricked into connecting to a malicious X server, could then either crash X client -> DoS or get code execution - in general, it is highly unlikely to be tricked into connecting to a malicious X server due to the nature of the X protocol (as the X server usually runs on the local machine)
[USN-6169-1] GNU SASL vulnerability (03:22)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- library and CLI application for the Simple Authentication and Security Layer
(SASL) framework - used by network servers like IMAP/XMPP etc and to
authenticate clients etc
- e.g. mutt and neomutt both use this
- Possible OOB read on server side if client provides crafted auth data -> DoS / info leak against the server
[USN-6155-2] Requests vulnerability (04:02)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- [USN-6155-1] Requests vulnerability from Episode 199
[USN-6166-2] libcap2 vulnerability (04:21)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- [USN-6166-1] libcap2 vulnerabilities from Episode 199
[USN-6083-2] cups-filters vulnerability (04:30)
- 1 CVEs addressed in Xenial ESM (16.04 ESM)
- [USN-6083-1] cups-filters vulnerability from Episode 196
[USN-6156-2] SSSD regression (04:40)
- Affecting Focal (20.04 LTS)
- [USN-6156-1] SSSD vulnerability from Episode 199
- possible issue if were to install only some of the newer binary packages from
the previous security update - fixed by adding more specific dependency info
in the package metadata but ideally users should just run
apt upgradeor useunattended-upgradesto install security updates as this will upgrade all installed binary packages to all the newer versions, and not say justapt install sssdwhich would only pull in some of the binary packages
[USN-6167-1] QEMU vulnerabilities (05:31)
- 4 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04)
- All various memory management issues in different guest drivers, which could allow a malicious guest to cause QEMU on the host to crash - not really surprising as the boundary between unprivileged and privileged components is the literal attack surface in this case and so is where security issues of this nature will likely be found
[USN-6176-1] PyPDF2 vulnerability (05:57)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- Library for handling PDF files
- Possible infinite loop if input PDF was malformed and finished without containing an expected terminating element - would just keep trying to read even though there was nothing more to read
[USN-6170-1] Podman vulnerabilities (06:26)
- Affecting Jammy (22.04 LTS)
- When using
podman play kubeto create containers / pods / volumes based on a k8s yaml, it would always pull in thek8s.gcr.io/pauseimage - this is not necessary and it not necessarily maintained and so could present a security issue as a result
[USN-6177-1, USN-6179-1] Jettison vulnerabilities (07:01)
- 4 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04)
- Java library for converting between XML and JSON
- 3 different stack overflows due to recursive parsing implementation for JSON - so could simply create a JSON structure that had a very deeply nested object to trigger this - plus an associated memory leak -> OOM - fixed by counting number of recursions and bailing if get too deep
[USN-6178-1] SVG++ library vulnerabilities (07:37)
- 2 CVEs addressed in Bionic ESM (18.04 ESM), Jammy (22.04 LTS), Kinetic (22.10)
- Possible OOB reads - one in demo code only - not much of a security impact - still assigned CVSS 6.5 for NULL ptr deref in demo code - shows the limits of CVSS as a metric - Daniel Stenberg (curl maintainer) has a good discussion of this on his blog -
- https://daniel.haxx.se/blog/2023/03/06/nvd-makes-up-vulnerability-severity-levels/
- https://daniel.haxx.se/blog/2023/06/12/nvd-damage-continued/
- I even wrote something about this a few years ago - https://ubuntu.com/blog/securing-open-source-through-cve-prioritisation - there is more to CVEs than just their CVSS score - also CVSS 4 will help a bit but will still not capture enough nuance, and even if it does, it still won’t stop the problem of CVEs being misclassified due to a lack of deep understanding by whoever assigns the CVSS score (and in fact this may be made worse by CVSS 4 since it contains more attributes used to compute a score)
[USN-6180-1] VLC media player vulnerabilities (09:58)
- 7 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)
- OOB reads / write when handling various image or video files -> DoS / RCE
[USN-5948-2] Werkzeug vulnerabilities (10:16)
- 2 CVEs addressed in Lunar (23.04)
- various utilities for WSGI applications in python
- one issue in cookie parsing which could allow a remote attacker to shadow other cookies, another CPU-based DoS via unlimited number of multipart form data parts - since each consumes only a small number of bytes but takes a reasonable amount of CPU time to parse (and also consumes RAM too)
[USN-6143-3] Firefox regressions (11:09)
- 4 CVEs addressed in Focal (20.04 LTS)
- 114.0.2 - Upstream regressions in native messaging handlers and some possible crashes as well
[USN-6181-1] Ruby vulnerabilities (11:24)
- 3 CVEs addressed in Kinetic (22.10), Lunar (23.04)
- 2 different ReDoS, 1 issue in handling of responses in the cgi gem could allow an attacker to modify the response that would then be received by the user via a HTTP response splitting attack
[USN-6182-1] pngcheck vulnerabilities (11:51)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- Used to verify the integrity of PNG and associated files (used by the forensics-extra package which contains various forensics and ethical hacking tools etc)
- Ironically this contained a buffer overflow which could be triggered on a crafted file
[USN-6171-1] Linux kernel vulnerabilities (12:29)
- 9 CVEs addressed in Jammy (22.04 LTS), Kinetic (22.10)
- 5.19
- 22.10 - generic, AWS, Azure. GCP, KVM, Oracle, Raspi, Lowlatency
- 22.04 - HWE
- Various issues allowing local user to trigger deadlock, OOPS (crash), or read kernel memory (info leak) - none appear to be exploitable remotely
[USN-6172-1] Linux kernel vulnerabilities (13:02)
- 8 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- 5.15
- 22.04 generic, GCP, GKE, Raspi, AWS, Azure, Oracle, KVM, lowlatency etc
- 5.4
- 20.04 generic, GCP, GKE, Raspi, AWS, Azure, Oracle, KVM, lowlatency etc
- Similar set of issues as above
[USN-6173-1] Linux kernel (OEM) vulnerabilities (13:32)
-
7 CVEs addressed in Jammy (22.04 LTS)
-
6.1 OEM
-
OOB read in the USB handling code for Broadcom FullMAC USB WiFi driver
- requires an attacker to create a malicious USB device and insert that into
your machine to be able to trigger (shout out to USBGuard)
-
OOB write in network queuing scheduler
- able to be triggered though an unprivileged user namespace (again)
[USN-6174-1] Linux kernel (OEM) vulnerabilities
- 3 CVEs addressed in Jammy (22.04 LTS)
- 5.17 OEM
[USN-6175-1] Linux kernel vulnerabilities (14:11)
- 20 CVEs addressed in Lunar (23.04)
- 6.2 GA (everything)
- [USN-6130-1] Linux kernel vulnerabilities from Episode 198
[LSN-0095-1] Linux kernel vulnerability (14:25)
- 6 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
| Kernel type | 22.04 | 20.04 | 18.04 |
|---|---|---|---|
| aws | 95.4 | 95.4 | — |
| aws-5.15 | — | 95.4 | — |
| aws-5.4 | — | — | 95.4 |
| azure | 95.4 | 95.4 | — |
| azure-5.4 | — | — | 95.4 |
| gcp | 95.4 | 95.4 | — |
| gcp-5.15 | — | 95.4 | — |
| gcp-5.4 | — | — | 95.4 |
| generic-5.4 | — | 95.4 | 95.4 |
| gke | 95.4 | 95.4 | — |
| gke-5.15 | — | 95.4 | — |
| gke-5.4 | — | — | 95.4 |
| gkeop | — | 95.4 | — |
| gkeop-5.4 | — | — | 95.4 |
| ibm | 95.4 | 95.4 | — |
| ibm-5.4 | — | — | 95.4 |
| linux | 95.4 | — | — |
| lowlatency | 95.1 | — | — |
| lowlatency-5.4 | — | 95.4 | 95.4 |
To check your kernel type and Livepatch version, enter this command:
canonical-livepatch status
Goings on in Linux Security Community
Red Hat to stop publicly releasing source code for RHEL (14:59)
- https://www.redhat.com/en/blog/furthering-evolution-centos-stream
- Previously would release sources for RHEL to git.centos.org - the repo which was used for the previous CentOS Linux - a freely available repackaging of RHEL, more like a downstream - was discontinued at the end of 2021 in favour of CentOS Stream which is positioned more as an upstream of RHEL now.
- By pushing these sources public, allowed others to inspect their work, but also to create competitor products based off that work - AlmaLinux / Rocky etc - both of which aim to be community versions of RHEL, bug-for-bug compatible etc
- https://almalinux.org/blog/impact-of-rhel-changes/
- https://rockylinux.org/news/2023-06-22-press-release/
- This change first occurred last week, noticed by the AlmaLinux developers - RHEL then released the public statement above
- Red Hat say CentOS Stream will now be the only public repo for RHEL-related
source code - but this does not necessarily contain all the patches and
updates that end up in the various RHEL packages
- AlmaLinux plans to then use CentOS Stream to base their security updates off - as this is still public
- Rocky Linux is not so open about how they plan to deal with this - also looks like they will use CentOS Stream as their upstream - but will this then be bug-for-bug compatible with RHEL as they claim?
- Red Hat also say the sources for RHEL will be available to customers and partners via their usual customer portal - however the standard RHEL license agreement prohibits these from being used to develop competitor products etc
- Doesn’t have a huge impact on Ubuntu as in general we take our patches direct from the upstream projects - and when we have to backport these to older versions, they are not necessarily the same version as used in RHEL anyway so we don’t often use patches from RHEL
- Will be interesting to see what impact this does have on AlmaLinux and Rocky Linux
Get in contact
Episode 199
16 juni 2023 |
27 min
Overview
For our 199th episode Andrei looks at Fuzzing Configurations of Program Options
plus we discuss Google’s findings on the io_uring kernel subsystem and we look
at vulnerability fixes for Netatalk, Jupyter Core, Vim, SSSD, GNU binutils, GLib
and more.
This week in Ubuntu Security Updates
53 unique CVEs addressed
[USN-6145-1] Sysstat vulnerabilities (00:55)
- 2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04)
- system performance tools - integer overflow leading to possible buffer overflow - original fix was incomplete so a second CVE was issued
[USN-6146-1] Netatalk vulnerabilities (01:22)
- 9 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)
- Implementation of the Apple Filing Protocol - allows a Ubuntu server to share files with macOS clients - similar to Samba for Windows
- Lots of different buffer overflows - some / most disclosed via ZDI
- Almost all due to missing length checks on the input data - some OOB write, others OOB read - sadly there is no AppArmor profile for netatalk but it would be interesting to try and create one
[USN-6147-1] SpiderMonkey vulnerability (02:21)
- 1 CVEs addressed in Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04)
- Latest release of mozjs-102.12.0 (Mozilla’s SpiderMonkey JS engine)
- Used by gnome-shell etc
- Upstream mozilla describes this issue as ‘memory safety bugs’
[USN-6149-1] Linux kernel vulnerabilities (02:52)
- 6 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
- 4.4 based kernel (Xenial GA kernel)
- All interesting CVEs discussed last week - [USN-6130-1] Linux kernel vulnerabilities in Episode 198
- OOB read in the USB handling code for Broadcom FullMAC USB WiFi driver
- KVM mishandling of control registers for nested guest VMs
- OOB write in network queuing scheduler - able to be triggered though an unprivileged user namespace (again)
- race condition -> UAF -> privesc in netfilter
[USN-6150-1, USN-6162-1] Linux kernel vulnerabilities (03:55)
- 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- 5.15 Raspi + Intel-IoTG 22.04 LTS,
- 5.4 Raspi + Intel-IoTG 20.04 LTS
[USN-6151-1] Linux kernel (Xilinx ZynqMP) vulnerabilities (04:13)
- 4 CVEs addressed in Focal (20.04 LTS)
- 5.4
[USN-6152-1] Linux kernel (GKE) regression (04:21)
- Affecting Focal (20.04 LTS), Jammy (22.04 LTS)
- 5.15 - NFS cache issue causing a severe degradation in performance under certain conditions
[USN-6153-1] Jupyter Core vulnerability (04:42)
- 1 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10)
- Executed untrusted files from current working directory - possible RCE - would unconditionally prepend the current working dir to the search path
[USN-6154-1] Vim vulnerabilities (04:58)
- 3 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04)
- Moar vim CVEs
- Seems we talk about vim every month or so lately
- Only a few CVEs per year until 2021 - then 20, 113 for 2022, so far only 15 for 2023 - is this the sign that the rate of vim CVEs are decreasing?
Figure 1: Vulnerabilities by year in vim from https://www.cvedetails.com/product/14270/VIM-VIM.html?vendor_id=8218
[USN-6155-1] Requests vulnerability (05:56)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04)
- Python requests library - leaked Proxy-Authorization headers to the destination server when redirected by a HTTPS endpoint
[USN-6156-1] SSSD vulnerability (06:11)
- 1 CVEs addressed in Focal (20.04 LTS)
- Failed to sanitise certificate attributes before issuing an LDAP search -
ie. a certificate may contain parenthesis in say the
Subject DNfield - this would then be used directly in the query and would be interpreted as parameters in the LDAP query - could then allow a malicious client to provide a crafted certificate which performs arbitrary LDAP queries etc - such that when used in conjunction with FreeIPA they could elevate their privileges
[USN-6148-1] SNI Proxy vulnerability (06:54)
- 1 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04)
- Buffer overflow when handling a crafted HTTP packet that specifies an IPv6 address longer than the maximum possible - since parses it into a fixed size buffer
[USN-6157-1] GlusterFS vulnerability
- 1 CVEs addressed in Jammy (22.04 LTS), Kinetic (22.10), Lunar (23.04)
- Stack buffer overread - generally protected by stack protector on Ubuntu - crash -> DoS
[USN-6143-2] Firefox regressions (07:25)
- 4 CVEs addressed in Focal (20.04 LTS)
- 114.0.1 - crash on startup if on disk metadata is corrupted / invalid - fixed to just indicate an error occurred and continue without the data
[USN-6158-1] Node Fetch vulnerability (07:45)
- 1 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- If redirected to another site, would leak the cookie of the originating site to the other - violation of same origin policy
[USN-6159-1] Tornado vulnerability (07:59)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Lunar (23.04)
- Open redirect - allows an attacker to craft a URL to a site that when visited will redirect the user to a different arbitrary site - can then be used to phish the user
[USN-6160-1] GNU binutils vulnerability (08:27)
- 1 CVEs addressed in Focal (20.04 LTS)
- Heap based buffer overflow when reading certain debugging information - could then possibly get code execution - requires the user to run objdump or similar on an attacker controlled binary - in general binutils is expected to only be run on trusted inputs - so if you are using objdump etc for reverse engineering arbitrary binaries, should do this in an isolated environment - VM
[USN-6161-1] .NET vulnerabilities (09:02)
- 5 CVEs addressed in Jammy (22.04 LTS