Overview
The Linux kernel.org CNA has assigned their first CVEs so we revisit this topic
to assess the initial impact on Ubuntu and the CVE ecosystem, plus we cover
security updates for Roundcube Webmail, less, GNU binutils and the Linux kernel
itself.
This week in Ubuntu Security Updates
64 unique CVEs addressed
[USN-6647-1] Linux kernel vulnerabilities (01:14)
- 3 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- 4.15 - AWS/Azure/GCP/HWE/KVM/Oracle
- Memory leak in netfilter able to be abused via an unprivileged user
namespace - DoS via exhausting system memory
[USN-6648-1] Linux kernel vulnerabilities (02:00)
- 4 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- 5.4 - IOT/Xilinx ZynqMP/IBM/Bluefield/GKEOP/Raspi/KVM/Oracle/AWS/GCP/Generic/LowLatency/OEM
- OOB write in KTLS reported by Jann Horn - if a user can get the kernel to
splice a ktls socket can possibly escalate privileges
- UAF in AppleTalk network driver - could be abused by a local unprivileged
user - can be mitigated by blocklisting in
/etc/modprobe.d/blacklist-rare-network.conf
# appletalk
alias net-pf-5 off
[USN-6650-1] Linux kernel (OEM) vulnerability (03:30)
- 1 CVEs addressed in Jammy (22.04 LTS)
- NULL ptr deref in generic ID allocator
[USN-6651-1] Linux kernel vulnerabilities (03:38)
- 6 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
- ktls + appletalk
[USN-6653-1] Linux kernel vulnerabilities
- 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- ktls + appletalk
[USN-6652-1] Linux kernel (Azure) vulnerabilities (03:47)
[USN-6649-1] Firefox vulnerabilities (04:14)
- 12 CVEs addressed in Focal (20.04 LTS)
- 123.0
[USN-6654-1] Roundcube Webmail vulnerability (04:35)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- XSS able to abused by simple text/plain emails with crafted links - included
the ability to detect link references like
[1]
and linkify them to the
source - if an attacker used a form like [<script>evil</script>]
this would be
included in the generated HTML without escaping and so could get arbitrary XSS
- Since is in universe, this update is available via Ubuntu Pro
[USN-6655-1] GNU binutils vulnerabilities (05:54)
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- 3 instances of DoS via excessive memory consumption, one of NULL ptr deref -
in general upstream does not consider binutils safe for analysing untrusted
inputs
[USN-6656-1] PostgreSQL vulnerability (06:31)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Failed to properly drop privileges when handling
REFRESH MATERIALIZED VIEW CONCURRENTLY
commands - should drop privileges so that the SQL is executed as
the owner of the materialized view - as such, if an attacker could get a user
or automated system to run such a command they could possibly execute
arbitrary SQL as the user rather than as the owner of the view as expected
[USN-6657-1] Dnsmasq vulnerabilities (07:10)
[USN-6658-1] libxml2 vulnerability (07:33)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- UAF if using DTD validation with XInclude expansion enabled
[USN-6659-1] libde265 vulnerabilities (07:52)
- 13 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- Next lot of libde265 vulns after discussed previously in
[USN-6627-1] libde265 vulnerabilities from
Episode 219 - more fuzzing related fixes for usual sorts of issues
[USN-6660-1, USN-6661-1] OpenJDK 11 & 17 vulnerabilities (08:17)
- 6 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- 11.0.22; 17.0.10
[USN-6662-1] OpenJDK 21 vulnerabilities
- 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- 21.0.2
[USN-6305-2] PHP vulnerabilities (08:37)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
[USN-6663-1] OpenSSL update (08:40)
- Affecting Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Hardening update for openssl 3.0 / 1.0 - OpenSSL 3.2.0 introduced a change to
return random output instead of an exception when it detected wrong padding
for PKCS#1 v1.5 encryption - without this there is a timing side-channel which
can be used to infer the secret key and hence break confidentiality
[USN-6664-1] less vulnerability (09:40)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Failed to quote filenames when using
LESSCLOSE
- could then get arbitrary
shell commands - env var that tells less to invoke a particular command as an
input post-processor (this is used in conjunction with LESSOPEN
to
pre-processor the file before it is displayed by less - for instance, if you
wanted to use less to page through a HTML file you might perhaps use this to
run it via html2text
first - then use LESSCLOSE
to do any cleanup)
[USN-6644-2] LibTIFF vulnerabilities (10:51)
- 3 CVEs addressed in Jammy (22.04 LTS)
- Heap buffer overflow in libtiff itself, plus a heap buffer overflow in the
tiffcp tool (used to combine multiple TIFF files into a single one) and
finally a possible OOM issue in libtiff if an input file specified a very
large size but then failed to actually contain such data (ie the headers
specify a certain size but the file itself doesn’t contain that amount of
data)
Goings on in Ubuntu Security Community
Follow up to Linux kernel CNA (11:40)
- Since announcing kernel.org has now started assigning CVEs
- First CVE assigned
- Both historical and recent
- 40 from 2024
- 66 from 2023
- 1 from 2022
- 165 from 2021
- 13 from 2020
- 3 from 2019
- As of
Fri 01 Mar 2024 04:04:26 UTC
have assigned 288 CVEs
- 9 days, 15 hours and 11 minutes or so
- 231 hours
- Currently assigning more than 1 CVE per hour
- Looking at these, 8 appear to be due to reported issues from Coverity -
popular static analysis tool which is not infallible. Others appear to come
directly from the GSD project (Global Security Database)
- On a personal note - I have been doing the CVE Triage role on our team this
week - in past weeks, I would normally spend about 30-minutes to 1 hour each
day doing this - and this week it has been at least 2 hours each day, mostly
due to the large influx of kernel CVEs
- Perhaps the only way to solve this is better tooling - on our side, mdeslaur
added support for automatically extracting the required git commits from the
CVE notifications and the kernel team already has tooling which checks if the
required commits are in the git trees of the various Ubuntu kernels
- Hopefully that helps - but it doesn’t help to assign priorities to each CVE
- The kernel CNA is not assigning CVSS scores and they don’t intend to -
although my understanding is this is required - and so we can’t use this to help
- So then we need to try and manually assess the impact of each CVE - but even
the kernel CNA says this is not obvious - so then perhaps the solution is to
just assign them all to medium and deal with them as part of the usual kernel
SRU cycle
Get in contact