Overview
The team is back from Madrid and this week we bring you some of our plans for
the upcoming Ubuntu 24.10 release, plus we talk about Google’s kernelCTF project
and Mozilla’s PDF.js sandbox when covering security updates for the Linux
kernel, Firefox, Spreadsheet::ParseExcel, idna and more.
This week in Ubuntu Security Updates
121 unique CVEs addressed
[USN-6766-2] Linux kernel vulnerabilities (01:07)
- 92 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- 5.15 - raspi kernel on 22.04 and OEM or optional HWE on 20.04
- Linux kernel CNA has been quite busy assigning both historical and recent CVEs against the kernel
- As discussed previously Linux kernel becomes a CNA from Episode 219 Follow up
to Linux kernel CNA from Episode 220, the impact of these CVEs is often not
apparent so it makes it quite hard to assign a proper priority - even the
kernel CNA themselves are not assigning a CVSS score - so for now we have
little information which we can glean for each of these
- As such, the USNs contain quite little detail and are very generic - and for
each we will be assigning just a medium priority unless we have some good
evidence otherwise
- One example here is CVE-2024-26808 - UAF in netfilter - was reported via
Google’s kernelCTF (not to be confused with their kCTF which is their
kubernetes-based CTF hosting platform - but which also has a vulnerabilities
reward program (VRP)) - kernelCTF - program to offer rewards for exploits
against the kernel - but not just any exploits - can’t use
io_uring
or
nftables
since they were disabled in their target kernel configuration due to
high number of historical vulns in both subsystems
- base reward of $21k, $10k bonus if is reliable more than 90% of the time,
additional $20k bonus if works without using unprivileged user namespaces,
and a final additional $20k bonus if it is 0-day (ie not patched in the
mainline tree and not disclosed anywhere - including via syzkaller)
- So in this case, we rated this CVE with a high priority since it is known
exploitable
[USN-6766-3] Linux kernel (AWS) vulnerabilities (04:48)
- 92 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- 5.15 - AWS on both 22.04 and 20.04
[USN-6774-1] Linux kernel vulnerabilities (05:01)
- 13 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
- 6.5 - all on 23.10, HWE (all) on 22.04
[USN-6775-1] Linux kernel vulnerabilities
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- 5.15 all on 22.04, HWE (all) on 20.04
[USN-6775-2] Linux kernel vulnerabilities
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- 5.15 AWS/GKE
[USN-6776-1] Linux kernel vulnerabilities
- 4 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- 5.4 all on 20.04, HWE (all) on 18.04
[USN-6777-1] Linux kernel vulnerabilities
- 17 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- 4.15 - all on 18.04, HWE (all) on 16.04
[USN-6777-2] Linux kernel (Azure) vulnerabilities
- 17 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
- 4.15 - azure
[USN-6777-3] Linux kernel (GCP) vulnerabilities
- 17 CVEs addressed in Xenial ESM (16.04 ESM)
[USN-6778-1] Linux kernel vulnerabilities
- 14 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
- 4.4 - all on 16.04, HWE on 14.04
[USN-6773-1] .NET vulnerabilities (05:34)
- 2 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- dotnet 7 and 8
[USN-6779-1] Firefox vulnerabilities (05:54)
- 14 CVEs addressed in Focal (20.04 LTS)
- 126.0
- UAF due to multiple WebRTC threads trying to use an audio input device if it
was just added
- type confusion bug in handling of missing fonts -> arbitrary JS execution via
PDF.js (this is in the context of PDF.js which uses the quickjs JS engine
inside the standard ComponentUtils.Sandbox implementation - which is the same
sandbox used to execute JS from websites etc in firefox) - unrelated to this
vuln but PDFs can contain JavaScript (e.g. in a form, to calculate values
based on user input)
- also PDF.js doesn’t implement the PDF APIs related to network or disk etc to
avoid possible security issues
[USN-6782-1] Thunderbird vulnerabilities (07:29)
- 6 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- 115.11.0
- same PDF.js issues and others as above from Firefox
[USN-6781-1] Spreadsheet::ParseExcel vulnerability (07:51)
- 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- RCE vuln via the use of
eval()
on untrusted user input - high profile,
disclosed by Mandiant - high profile since it affected Barracuda email gateway
devices and was publicly reported as being exploited against these by a
Chinese APT group
[USN-6780-1] idna vulnerability (08:59)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- Python module for handling internationalised domain names (RFC 5895)
- CPU-based DoS due to inefficient algorithm when encoding a domain name
Goings on in Ubuntu Security Community
Ubuntu Security Plans for 24.10 Development Cycle (09:33)
- Progressing the FIPS certification for 24.04 though NIST
- Implementation of OpenVEX and OSV data formats for machine readable vulnerability information
- Historically have generated OVAL data for this purpose
- XML-based format, existed for over 20 years
- more recently, OpenVEX and OSV have appeared which also serve the same
purpose and have a more vibrant community around them
- Similarly, next version of the SPDX format will also support vulnerability
descriptions too
- Finally, given the recent announcement that
CIS has
relinquished the role in sponsoring OVAL project and there doesn’t appear
to be any other sponsor on the horizon, thought it was prudent to develop a
“second-supplier” approach given this uncertain future for OVAL upstream
- likely will have more to say on this in the future
- Improvements to the process the team uses for working with the snap store and doing reviews etc
- AppArmor profile development across the 24.10 release
Get in contact