Episode 54

27 min • 23 november 2019

Overview

Security updates for DPDK, Linux kernel, QEMU, ImageMagick, Ghostscript and more, plus Joe and Alex talk about how to get into information security.

89 unique CVEs addressed

1 CVEs addressed in Bionic, Disco, Eoan
- CVE-2019-14818
Data Plane Development Kit - Memory and file-descriptor leak, able to be triggered by a malicious master or a container with access to the vhost_user socket

9 CVEs addressed in Eoan
Episode 53 - Extra update for CVE-2019-0155 (i915 blitter command streamer) - previous one was based on an in-flight patch that got changed at the last minute before the CRD - part of this fix is to whitelist certain commands to the command-streamer, and this is done via a bitmask - this used a memset() to zero it out but assumed the size of the underlying data was 32-bit - so on 64-bit platforms this becomes a 64-bit size and so half the bitmask is not zeroed out - meaning the whitelist may be able to be bypassed - this fix includes the final upstream fix

14 CVEs addressed in Bionic (HWE), Disco
See above (i915 vuln) - but also includes a fix for a regression that was introduced in last week’s kernel - KVM guests would fail to launch if extended page tables were disabled or not supported.

5 CVEs addressed in Trusty ESM, Xenial, Bionic, Disco, Eoan
Heap buffer overflow and UAF in SLiRP networking implementation - DoS + possible code exec
Bridge helper didn’t validate interface names to be within IFNAMSIZ - could be used to bypass ACL restrictions
NULL pointer dereference in qxl paravirtual graphics driver - DoS
Possible CPU based DoS via an infinite loop able to be triggered in the LSI SCSI adaptor emulator

1 CVEs addressed in Xenial, Bionic, Disco, Eoan
- CVE-2019-14869
Another -dSAFER bypass - newest Ghostscript is not affected since it rewrote the SAFER sandbox - but older versions are - allows a malicious postscript file to bypass the sandbox and access files or execute commands etc.

1 CVEs addressed in Xenial, Bionic, Disco, Eoan
- CVE-2019-3466
Privesc via arbitrary directory creation through the pg_ctlcluster command - allows to create a dir as postgres user - say /usr/lib/sudo/haswell - then dump a shared lib there which will be loaded by sudo to gain a root shell - by specifying this as the stats_temp_directory in the config
Interesting but requires ability to configure and run as postgres

2 CVEs addressed in Xenial, Bionic, Disco, Eoan
- CVE-2019-14859
- CVE-2019-14853
Issues in handling DER encoding of signatures - failed to verify proper DER encoding but also might raise exceptions unexpectedly on valid input so would cause a DoS

Kategorier

Förekommer på

00:00 -00:00