Episode 12

Posted on Monday, Nov 19, 2018
This week we look at some details of the 33 unique CVEs addressed across the supported Ubuntu releases, including some significant updates for systemd and the kernel, plus we talk about even more Intel side-channel vulnerabilities and more.

Show Notes

Overview

This week we look at some details of the 33 unique CVEs addressed across the supported Ubuntu releases, including some significant updates for systemd and the kernel, plus we talk about even more Intel side-channel vulnerabilities and more.

This week in Ubuntu Security Updates

33 unique CVEs addressed

[USN-3814-1] libmspack vulnerabilities

  • 2 CVEs addressed in Xenial, Bionic, Cosmic
  • Out of bounds write of 1 byte when a CAB file uses the maximum Quantum block size - buffer overflow, DoS -> crash, possible code execution
  • Failure to validate filenames properly - could accept a filename with embedded NUL bytes - possible DoS -> crash

[USN-3815-1, USN-3815-2] gettext vulnerability

  • 1 CVEs addressed in Precise ESM, Trusty, Xenial, Bionic, Cosmic
  • Double free for specially crafted translations file, DoS -> crash, possible code execution via heap corruption etc.
    • PoC’s on github

[USN-3816-1] systemd vulnerabilities

  • 3 CVEs addressed in Xenial, Bionic, Cosmic
  • Large backport of multiple patch series
  • Jann Horn (GPZ) reported two issues to Ubuntu regarding systemd
    • possible to inject / alter state across re-execution of systemd itself (since serialized state) - but fails to deserialize it correctly
      • Insecure use of fgets() when parsing long lines
      • Possible root privilege escalation
    • When changing ownership of files in a directory via systemd (useful for executing a systemd unit as a given user for example to ensure files it needs are owned by that user)
      • Would try and handle symlinks specially BUT this is racy (since could change where pointed to during check of symlink and then actual work of chown() after)
      • So for instance, could convince systemd to possible change the ownership of a root owned file to that of another user
      • So could allow to change arbitrary files ownerships or even permissions
  • Third issue - older one, systemd-tmpfiles could be used to obtain ownership of arbitrary files
    • Would follow symlinks in non-terminal path components, and then operate on the resulting file
    • Can tell it to set permissions / ownership of given files
    • So could race it to replace path components with symlinks to root-owned files and get it to change their ownership to that of the user (or whomeever)
    • Original patch series (March) didn’t completely fix this - required much more invasive patching later
    • We waited to fix it until the complete fix was available and accepted upstream (August) to then start backporting

[USN-3814-2, USN-3814-3] ClamAV vulnerabilities

  • 2 CVEs addressed in Precise ESM & Trusty
  • Same issues as for libmspack earlier (since clamav in Trusty and Precise ESM embeds libmspack, later releases use the system libmspack package instead)

[USN-3811-2] SpamAssassin vulnerability

  • 1 CVEs addressed in Precise ESM
  • One of the CVEs for SpamAssassin in Episode 7

[USN-3817-1, USN-3817-2] Python vulnerabilities

  • 5 CVEs addressed in Precise ESM, Trusty, Xenial, Bionic
  • Failure to initialize hash salt for PRNG in hash tables for elementtree (XML parser)
    • Could relatively easily cause hash-collisions on specially crafted document
    • High CPU and memory usage -> DoS
  • Possible command injection when using Python to create a ZIP file archive
    • Used spawn() which is vulnerable to shell command injection -> subprocess()
  • 3 lower priority issues
    • Race condition in when reading from multiple threads on same file - possible heap buffer overflow or UAF
    • DoS via CPU usage due to regexes in mail server response handling with backtracking - could be triggered by a malicious mail server
    • Similar but in regexes in difflib (catastrophic backtracking)

[USN-3818-1] PostgreSQL vulnerability

  • 1 CVEs addressed in Bionic, Cosmic
  • Possible to inject arbitrary SQL with superuser privileges during dump/restore cycle
  • Can be triggered by regular users in default config since they can trigger as have CREATE privilege on the public schema

[USN-3819-1] Linux kernel vulnerability

[USN-3820-1, USN-3820-2, USN-3820-3] Linux kernel vulnerabilities

  • 4 CVEs addressed in Bionic, Xenial (Bionic HWE kernel) and Trusty (Azure)
  • Bluetooth HID integer overflow and info leak in CDROM ioctl (covered in Episode 9 for Xenial kernel)
  • Possible privilege escalation via SCSI subsystem
  • Xen virtual network driver didn’t check supplied parameters -> integer overflow -> OOB read -> possible OOB write -> privilege escalation, DoS etc

[USN-3821-1] Linux kernel vulnerabilities

  • 7 CVEs addressed in Xenial and Trusty (Xenial HWE kernel)
  • Potential host system crash / code execution from malicious guest for KVM on ARM64
  • Stack unwinding in procfs didn’t check caller was root - anyone could race stack unwinder to read stack of arbitrary kernel processes
  • NULL pointer dereferences in various file-system drivers -> triggered by mounting malicious fs image
    • HFS+, btrfs, f2fs
  • OOB stack write in ext4 with malicious image
  • Integer overflow in alarmtimer handling

[USN-3822-1] Linux kernel vulnerabilities

  • 5 CVEs addressed in Trusty and Precise ESM (Trusty HWE kernel)
  • Same bluetooth HID, CDROM and SCSI vulns as for Bionic earlier
  • Possible divide by zero in CDC USB ethernet driver for specially crafted device
  • KVM guest user could cause guest OS crash due to mismanagement of emulated exception handling

[USN-3823-1] Linux kernel vulnerabilities

[LSN-0045-1] Linux kernel vulnerability

[USN-3824-1] OpenJDK 7 vulnerabilities

Goings on in Ubuntu Security Community

New Intel Side Channel Attacks (again…)

  • A Systematic Evaluation of Transient Execution Attacks and Defenses
  • Reclassifies existing Meltdown and Spectre attacks with a new nomenclature
    • ie. original Meltdown is now Meltdown-US (US = User/Supervisor)
  • Identifies a bunch of other possible variants for both Meltdown and Spectre
    • Meltdown-PK - bypass restrictions on Intel memory protection keys
    • Meltdown-BR - Spectre-like attack but using bounds-range exceeded exception to trigger
    • 5 new Spectre variants based on existing ones but targetting different microarchitectural elements (ie targetting the Branch Target Buffer when doing a Spectre-RSB attack since some processors fallback to BTB when RSB is empty)
  • Compares existing mitigations for each existing and newly identified attack
  • Very comprehensive, demonstrates the utility of such a complete analysis compared to existing approach where different researchers have looked at a single aspect
  • Still an active area of research with new vulnerabilities turning up

Hiring

Ubuntu Security Engineer

Get in contact