Episode 220

Posted on Friday, Mar 1, 2024
The Linux kernel.org CNA has assigned their first CVEs so we revisit this topic to assess the initial impact on Ubuntu and the CVE ecosystem, plus we cover security updates for Roundcube Webmail, less, GNU binutils and the Linux kernel itself.

Show Notes

Overview

The Linux kernel.org CNA has assigned their first CVEs so we revisit this topic to assess the initial impact on Ubuntu and the CVE ecosystem, plus we cover security updates for Roundcube Webmail, less, GNU binutils and the Linux kernel itself.

This week in Ubuntu Security Updates

64 unique CVEs addressed

[USN-6647-1] Linux kernel vulnerabilities (01:14)

  • 3 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
  • 4.15 - AWS/Azure/GCP/HWE/KVM/Oracle
  • Memory leak in netfilter able to be abused via an unprivileged user namespace - DoS via exhausting system memory

[USN-6648-1] Linux kernel vulnerabilities (02:00)

  • 4 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
  • 5.4 - IOT/Xilinx ZynqMP/IBM/Bluefield/GKEOP/Raspi/KVM/Oracle/AWS/GCP/Generic/LowLatency/OEM
  • OOB write in KTLS reported by Jann Horn - if a user can get the kernel to splice a ktls socket can possibly escalate privileges
  • UAF in AppleTalk network driver - could be abused by a local unprivileged user - can be mitigated by blocklisting in /etc/modprobe.d/blacklist-rare-network.conf 
    # appletalk
alias net-pf-5 off

[USN-6650-1] Linux kernel (OEM) vulnerability (03:30)

  • 1 CVEs addressed in Jammy (22.04 LTS)
  • NULL ptr deref in generic ID allocator

[USN-6651-1] Linux kernel vulnerabilities (03:38)

[USN-6653-1] Linux kernel vulnerabilities

[USN-6652-1] Linux kernel (Azure) vulnerabilities (03:47)

[USN-6649-1] Firefox vulnerabilities (04:14)

[USN-6654-1] Roundcube Webmail vulnerability (04:35)

  • 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
  • XSS able to abused by simple text/plain emails with crafted links - included the ability to detect link references like [1] and linkify them to the source - if an attacker used a form like [<script>evil</script>] this would be included in the generated HTML without escaping and so could get arbitrary XSS
  • Since is in universe, this update is available via Ubuntu Pro

[USN-6655-1] GNU binutils vulnerabilities (05:54)

  • 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
  • 3 instances of DoS via excessive memory consumption, one of NULL ptr deref - in general upstream does not consider binutils safe for analysing untrusted inputs

[USN-6656-1] PostgreSQL vulnerability (06:31)

  • 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
  • Failed to properly drop privileges when handling REFRESH MATERIALIZED VIEW CONCURRENTLY commands - should drop privileges so that the SQL is executed as the owner of the materialized view - as such, if an attacker could get a user or automated system to run such a command they could possibly execute arbitrary SQL as the user rather than as the owner of the view as expected

[USN-6657-1] Dnsmasq vulnerabilities (07:10)

[USN-6658-1] libxml2 vulnerability (07:33)

  • 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
  • UAF if using DTD validation with XInclude expansion enabled

[USN-6659-1] libde265 vulnerabilities (07:52)

[USN-6660-1, USN-6661-1] OpenJDK 11 & 17 vulnerabilities (08:17)

[USN-6662-1] OpenJDK 21 vulnerabilities

[USN-6305-2] PHP vulnerabilities (08:37)

[USN-6663-1] OpenSSL update (08:40)

  • Affecting Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
  • Hardening update for openssl 3.0 / 1.0 - OpenSSL 3.2.0 introduced a change to return random output instead of an exception when it detected wrong padding for PKCS#1 v1.5 encryption - without this there is a timing side-channel which can be used to infer the secret key and hence break confidentiality

[USN-6664-1] less vulnerability (09:40)

  • 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
  • Failed to quote filenames when using LESSCLOSE - could then get arbitrary shell commands - env var that tells less to invoke a particular command as an input post-processor (this is used in conjunction with LESSOPEN to pre-processor the file before it is displayed by less - for instance, if you wanted to use less to page through a HTML file you might perhaps use this to run it via html2text first - then use LESSCLOSE to do any cleanup)

[USN-6644-2] LibTIFF vulnerabilities (10:51)

  • 3 CVEs addressed in Jammy (22.04 LTS)
  • Heap buffer overflow in libtiff itself, plus a heap buffer overflow in the tiffcp tool (used to combine multiple TIFF files into a single one) and finally a possible OOM issue in libtiff if an input file specified a very large size but then failed to actually contain such data (ie the headers specify a certain size but the file itself doesn’t contain that amount of data)

Goings on in Ubuntu Security Community

Follow up to Linux kernel CNA (11:40)

  • Since announcing kernel.org has now started assigning CVEs
  • First CVE assigned
  • Both historical and recent
    • 40 from 2024
    • 66 from 2023
    • 1 from 2022
    • 165 from 2021
    • 13 from 2020
    • 3 from 2019
  • As of Fri 01 Mar 2024 04:04:26 UTC have assigned 288 CVEs
    • 9 days, 15 hours and 11 minutes or so
    • 231 hours
    • Currently assigning more than 1 CVE per hour
  • Looking at these, 8 appear to be due to reported issues from Coverity - popular static analysis tool which is not infallible. Others appear to come directly from the GSD project (Global Security Database)
  • On a personal note - I have been doing the CVE Triage role on our team this week - in past weeks, I would normally spend about 30-minutes to 1 hour each day doing this - and this week it has been at least 2 hours each day, mostly due to the large influx of kernel CVEs
  • Perhaps the only way to solve this is better tooling - on our side, mdeslaur added support for automatically extracting the required git commits from the CVE notifications and the kernel team already has tooling which checks if the required commits are in the git trees of the various Ubuntu kernels
  • Hopefully that helps - but it doesn’t help to assign priorities to each CVE
  • The kernel CNA is not assigning CVSS scores and they don’t intend to - although my understanding is this is required - and so we can’t use this to help
  • So then we need to try and manually assess the impact of each CVE - but even the kernel CNA says this is not obvious - so then perhaps the solution is to just assign them all to medium and deal with them as part of the usual kernel SRU cycle

Get in contact