Episode 43

Posted on Wednesday, Aug 21, 2019
This week we cover vulnerabilities in Ghostscript, the Linux kernel, nginx and more, and we follow up last weeks interview with another interview with Jamie Strandboge, this time talking about the history of the Ubuntu Security team.

Show Notes

Overview

This week we cover vulnerabilities in Ghostscript, the Linux kernel, nginx and more, and we follow up last weeks interview with another interview with Jamie Strandboge, this time talking about the history of the Ubuntu Security team.

This week in Ubuntu Security Updates

53 unique CVEs addressed

[USN-4091-1] poppler vulnerability

  • 1 CVEs addressed in Bionic, Disco
  • Divide by zero when texture surface specified with 0 length or width - found via fuzzing - handled by checking first for zero-length and returning an error -> DoS

[USN-4092-1] Ghostscript vulnerability

[USN-4070-2, USN-4070-3] MariaDB vulnerabilities

[USN-4093-1] Linux kernel vulnerabilities

  • 7 CVEs addressed in Bionic (HWE), Disco
  • Latest speculative execution side-channel attack - SWAPGS
    • https://www.bitdefender.com/business/swapgs-attack.html
    • Userspace can speculatively execute SWAPGS, allowing it to potentially read kernel memory by speculatively swapping out userspace for kernel memory - requires an appropriate gadget in the kernel
    • Linux not believed to be affected, since no appropriate gadget is available, however we have proactively included the upstream fix which is to add LFENCE calls around SWAPGS to ensure SWAPGS occurs before any subsequent memory reads to / from userspace
  • 2 different memory corruption issues in the Marvell Wifi driver - wouldn’t do bounds checking on structures passed to it from user-space - could allow DoS via crash or RCE
  • NULL ptr dereferences:
    • NFC subsystem, able to be triggered from userspace (using netlink)
    • PowerPC specific - could occur on memory allocation failures (failed to check NULL return value)
  • 2 by Jann Horn:
    • ptrace would record process credentials incorrectly, so that a local user can escalate to root in scenarios where a parent process drops privileges and then calls execve of an attacker controlled application
    • UAF in handling of local descriptor table entries

[USN-4094-1] Linux kernel vulnerabilities

[USN-4095-1] Linux kernel vulnerabilities

[USN-4095-2] Linux kernel (Xenial HWE) vulnerabilities

[USN-4096-1] Linux kernel (AWS) vulnerability

[USN-4097-1, USN-4097-2] PHP vulnerabilities

  • 2 CVEs addressed in Precise ESM, Trusty ESM, Xenial, Bionic, Disco
  • PHP EXIF parser would read past enf of supplied data - OOB read - crash -> DoS

[USN-4098-1] wpa_supplicant and hostapd vulnerability

  • 1 CVEs addressed in Bionic, Disco
  • Side-channel attack when using brainpool curves for ECC in WPA3 - observe timing differences between various operations over long enough time to infer the resulting encryption key - hard to achieve same level of side-channel robustness as other ECC groups - recommended to disable Brainpool curves in the context of SAE and EAP-pwd - https://w1.fi/security/2019-6/sae-eap-pwd-side-channel-attack-update.txt

[USN-4099-1] nginx vulnerabilities

[USN-4101-1] Firefox vulnerability

  • 1 CVEs addressed in Xenial, Bionic, Disco
  • Upstream 68.0.2 release
  • Able to copy passwords from the Saved Logins dialog without entering Master Password - allows a local user with physical access to obtain passwords etc

Goings on in Ubuntu Security Community

History of Ubuntu Security with Jamie Strandboge and Joe McManus

Get in contact