Overview
This week we look at some new Linux kernel security features including the
Landlock LSM and Core Scheduling plus we cover security updates for
RabbitMQ, Ceph, Thunderbird and more.
This week in Ubuntu Security Updates
46 unique CVEs addressed
[USN-5004-1] RabbitMQ vulnerabilities [00:44]
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10), Hirsute (21.04)
- AMQP server written in Erlang
- Possible to cause the server to consume excessive memory by sending large
values in the X-Reason HTTP header - resource exhaustion - DoS
- Possible infinite loop - failed to perform sufficient validation - DoS
[USN-4998-1] Ceph vulnerabilities [01:38]
- 7 CVEs addressed in Focal (20.04 LTS), Groovy (20.10)
- May log passwords in clear
- Exposure of user credentials to unprivileged users in particular
configurations
- 2 different XSS in ceph-dashboard
- Possible to authenticate as another user since could reuse session keys
- Crash radosgw through malicious GET requests with crafted swift URLs ->
DoS
[USN-4995-2] Thunderbird vulnerabilities [02:22]
- 20 CVEs addressed in Bionic (18.04 LTS)
- Episode 121
- 78.11.0
[USN-5000-2] Linux kernel (KVM) vulnerabilities [02:48]
- 15 CVEs addressed in Focal (20.04 LTS)
- Episode 121
- KVM kernel for 20.04 LTS
- 2 high priority privesc issues fixed - CAN BCM UAFs, eBPF OOB write -
plus various others too
[USN-4997-2] Linux kernel (KVM) vulnerabilities
- 17 CVEs addressed in Hirsute (21.04)
Goings on in Ubuntu Security Community
Landlock released in 5.13 kernel [03:49]
- Allows unprivileged processes to sandbox themselves - currently only
supports file paths - so can specify read/write of files/dirs etc
- Took 34 revisions of the patch set and it evolved significantly over
time - was originally based on attaching BPF programs to LSM hooks but
given how fraught unprivileged BPF has been this was NACKd and instead
went with a new approach based on a custom API with brand new system
calls to support it
- API is quite low-level compared to say how AppArmor policy is specified
so will be interesting to see if there becomes a liblandlock in the
future to make this kind of thing easier (cf. libseccomp for doing
seccomp BPF programs etc)
- https://lwn.net/Articles/859908/
- https://landlock.io/
Core Scheduling merged for 5.14 kernel [06:43]
- SMT siblings share lots of microarchitectural state like L1D cache etc -
various micro-arch attacks could only be mitigated across different SMT
cores - so processes which shared the same core could snoop on each other
(eg. L1TF - in the context of virtualisation, a malicious guest VM could
snoop on the L1D contents of another VM on the same SMT core) - so the
only option was to disable SMT which brings a big performance hit
- Solution is core scheduling - ie. make the schedular aware of and respect
SMT threads on the same core
- Tag processes via cgroups - this defines the trust boundaries - processes
in the same tagged cgroup share a trust boundary and can be scheduled on
sibling SMT cores - and by default all processes are in the same group
- Uses prctl() to allow setting / copying these - and can only set these on
processes which you can ptrace
- https://lwn.net/Articles/820321/
- https://www.phoronix.com/scan.php?page=news_item&px=Core-Scheduling-Linux-Close
Get in contact