Episode 228

Show Notes

Overview

The team is back from Madrid and this week we bring you some of our plans for the upcoming Ubuntu 24.10 release, plus we talk about Google’s kernelCTF project and Mozilla’s PDF.js sandbox when covering security updates for the Linux kernel, Firefox, Spreadsheet::ParseExcel, idna and more.

This week in Ubuntu Security Updates

121 unique CVEs addressed

[USN-6766-2] Linux kernel vulnerabilities (01:07)

92 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
5.15 - raspi kernel on 22.04 and OEM or optional HWE on 20.04
Linux kernel CNA has been quite busy assigning both historical and recent CVEs against the kernel
As discussed previously Linux kernel becomes a CNA from Episode 219 Follow up to Linux kernel CNA from Episode 220, the impact of these CVEs is often not apparent so it makes it quite hard to assign a proper priority - even the kernel CNA themselves are not assigning a CVSS score - so for now we have little information which we can glean for each of these
As such, the USNs contain quite little detail and are very generic - and for each we will be assigning just a medium priority unless we have some good evidence otherwise
One example here is CVE-2024-26808 - UAF in netfilter - was reported via Google’s kernelCTF (not to be confused with their kCTF which is their kubernetes-based CTF hosting platform - but which also has a vulnerabilities reward program (VRP)) - kernelCTF - program to offer rewards for exploits against the kernel - but not just any exploits - can’t use io_uring or nftables since they were disabled in their target kernel configuration due to high number of historical vulns in both subsystems
- base reward of $21k, $10k bonus if is reliable more than 90% of the time, additional $20k bonus if works without using unprivileged user namespaces, and a final additional $20k bonus if it is 0-day (ie not patched in the mainline tree and not disclosed anywhere - including via syzkaller)
So in this case, we rated this CVE with a high priority since it is known exploitable
- can see it listed in their public spreadsheet

[USN-6766-3] Linux kernel (AWS) vulnerabilities (04:48)

92 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
5.15 - AWS on both 22.04 and 20.04

[USN-6774-1] Linux kernel vulnerabilities (05:01)

13 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
6.5 - all on 23.10, HWE (all) on 22.04

[USN-6775-1] Linux kernel vulnerabilities

3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
5.15 all on 22.04, HWE (all) on 20.04

[USN-6775-2] Linux kernel vulnerabilities

3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
5.15 AWS/GKE

[USN-6776-1] Linux kernel vulnerabilities

4 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
5.4 all on 20.04, HWE (all) on 18.04

[USN-6773-1] .NET vulnerabilities (05:34)

2 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- CVE-2024-30046
- CVE-2024-30045
dotnet 7 and 8

[USN-6779-1] Firefox vulnerabilities (05:54)

14 CVEs addressed in Focal (20.04 LTS)
126.0
UAF due to multiple WebRTC threads trying to use an audio input device if it was just added
type confusion bug in handling of missing fonts -> arbitrary JS execution via PDF.js (this is in the context of PDF.js which uses the quickjs JS engine inside the standard ComponentUtils.Sandbox implementation - which is the same sandbox used to execute JS from websites etc in firefox) - unrelated to this vuln but PDFs can contain JavaScript (e.g. in a form, to calculate values based on user input)
- also PDF.js doesn’t implement the PDF APIs related to network or disk etc to avoid possible security issues

[USN-6782-1] Thunderbird vulnerabilities (07:29)

6 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
115.11.0
same PDF.js issues and others as above from Firefox

[USN-6781-1] Spreadsheet::ParseExcel vulnerability (07:51)

1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- CVE-2023-7101
RCE vuln via the use of eval() on untrusted user input - high profile, disclosed by Mandiant - high profile since it affected Barracuda email gateway devices and was publicly reported as being exploited against these by a Chinese APT group

[USN-6780-1] idna vulnerability (08:59)

1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10), Noble (24.04 LTS)
- CVE-2024-3651
Python module for handling internationalised domain names (RFC 5895)
CPU-based DoS due to inefficient algorithm when encoding a domain name

Goings on in Ubuntu Security Community

Ubuntu Security Plans for 24.10 Development Cycle (09:33)

Progressing the FIPS certification for 24.04 though NIST
Implementation of OpenVEX and OSV data formats for machine readable vulnerability information
- Historically have generated OVAL data for this purpose
- XML-based format, existed for over 20 years
- more recently, OpenVEX and OSV have appeared which also serve the same purpose and have a more vibrant community around them
- Similarly, next version of the SPDX format will also support vulnerability descriptions too
- Finally, given the recent announcement that CIS has relinquished the role in sponsoring OVAL project and there doesn’t appear to be any other sponsor on the horizon, thought it was prudent to develop a “second-supplier” approach given this uncertain future for OVAL upstream
- likely will have more to say on this in the future
Improvements to the process the team uses for working with the snap store and doing reviews etc
AppArmor profile development across the 24.10 release