This is the audio podcast version of Troy Hunt's weekly update video published here: https://www.troyhunt.com/tag/weekly-update/
…
continue reading
Alex Murray and Ubuntu Security Team에서 제공하는 콘텐츠입니다. 에피소드, 그래픽, 팟캐스트 설명을 포함한 모든 팟캐스트 콘텐츠는 Alex Murray and Ubuntu Security Team 또는 해당 팟캐스트 플랫폼 파트너가 직접 업로드하고 제공합니다. 누군가가 귀하의 허락 없이 귀하의 저작물을 사용하고 있다고 생각되는 경우 여기에 설명된 절차를 따르실 수 있습니다 https://ko.player.fm/legal.
Player FM -팟 캐스트 앱
Player FM 앱으로 오프라인으로 전환하세요!
Player FM 앱으로 오프라인으로 전환하세요!
Episode 220
Manage episode 403942457 series 2423058
Alex Murray and Ubuntu Security Team에서 제공하는 콘텐츠입니다. 에피소드, 그래픽, 팟캐스트 설명을 포함한 모든 팟캐스트 콘텐츠는 Alex Murray and Ubuntu Security Team 또는 해당 팟캐스트 플랫폼 파트너가 직접 업로드하고 제공합니다. 누군가가 귀하의 허락 없이 귀하의 저작물을 사용하고 있다고 생각되는 경우 여기에 설명된 절차를 따르실 수 있습니다 https://ko.player.fm/legal.
Overview
The Linux kernel.org CNA has assigned their first CVEs so we revisit this topic to assess the initial impact on Ubuntu and the CVE ecosystem, plus we cover security updates for Roundcube Webmail, less, GNU binutils and the Linux kernel itself.
This week in Ubuntu Security Updates
64 unique CVEs addressed
[USN-6647-1] Linux kernel vulnerabilities (01:14)
- 3 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- 4.15 - AWS/Azure/GCP/HWE/KVM/Oracle
- Memory leak in netfilter able to be abused via an unprivileged user namespace - DoS via exhausting system memory
[USN-6648-1] Linux kernel vulnerabilities (02:00)
- 4 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- 5.4 - IOT/Xilinx ZynqMP/IBM/Bluefield/GKEOP/Raspi/KVM/Oracle/AWS/GCP/Generic/LowLatency/OEM
- OOB write in KTLS reported by Jann Horn - if a user can get the kernel to splice a ktls socket can possibly escalate privileges
- UAF in AppleTalk network driver - could be abused by a local unprivileged user - can be mitigated by blocklisting in
/etc/modprobe.d/blacklist-rare-network.conf
# appletalk alias net-pf-5 off
[USN-6650-1] Linux kernel (OEM) vulnerability (03:30)
- 1 CVEs addressed in Jammy (22.04 LTS)
- NULL ptr deref in generic ID allocator
[USN-6651-1] Linux kernel vulnerabilities (03:38)
- 6 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
- ktls + appletalk
[USN-6653-1] Linux kernel vulnerabilities
- 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- ktls + appletalk
[USN-6652-1] Linux kernel (Azure) vulnerabilities (03:47)
- 15 CVEs addressed in Mantic (23.10)
- ktls + appletalk + NULL ptr deref in TLS impl ([LSN-0100-1] Linux kernel vulnerability from Episode 219)
[USN-6649-1] Firefox vulnerabilities (04:14)
- 12 CVEs addressed in Focal (20.04 LTS)
- 123.0
[USN-6654-1] Roundcube Webmail vulnerability (04:35)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- XSS able to abused by simple text/plain emails with crafted links - included the ability to detect link references like
[1]
and linkify them to the source - if an attacker used a form like[evil]
this would be included in the generated HTML without escaping and so could get arbitrary XSS - Since is in universe, this update is available via Ubuntu Pro
[USN-6655-1] GNU binutils vulnerabilities (05:54)
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- 3 instances of DoS via excessive memory consumption, one of NULL ptr deref - in general upstream does not consider binutils safe for analysing untrusted inputs
[USN-6656-1] PostgreSQL vulnerability (06:31)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Failed to properly drop privileges when handling
REFRESH MATERIALIZED VIEW CONCURRENTLY
commands - should drop privileges so that the SQL is executed as the owner of the materialized view - as such, if an attacker could get a user or automated system to run such a command they could possibly execute arbitrary SQL as the user rather than as the owner of the view as expected
[USN-6657-1] Dnsmasq vulnerabilities (07:10)
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- KeyTrap and NSEC3 proof related vuln in DNSSEC - [USN-6633-1] Bind vulnerabilities from Episode 219
[USN-6658-1] libxml2 vulnerability (07:33)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- UAF if using DTD validation with XInclude expansion enabled
[USN-6659-1] libde265 vulnerabilities (07:52)
- 13 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- Next lot of libde265 vulns after discussed previously in [USN-6627-1] libde265 vulnerabilities from Episode 219 - more fuzzing related fixes for usual sorts of issues
[USN-6660-1, USN-6661-1] OpenJDK 11 & 17 vulnerabilities (08:17)
- 6 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- 11.0.22; 17.0.10
[USN-6662-1] OpenJDK 21 vulnerabilities
- 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- 21.0.2
[USN-6305-2] PHP vulnerabilities (08:37)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
[USN-6663-1] OpenSSL update (08:40)
- Affecting Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Hardening update for openssl 3.0 / 1.0 - OpenSSL 3.2.0 introduced a change to return random output instead of an exception when it detected wrong padding for PKCS#1 v1.5 encryption - without this there is a timing side-channel which can be used to infer the secret key and hence break confidentiality
[USN-6664-1] less vulnerability (09:40)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Failed to quote filenames when using
LESSCLOSE
- could then get arbitrary shell commands - env var that tells less to invoke a particular command as an input post-processor (this is used in conjunction withLESSOPEN
to pre-processor the file before it is displayed by less - for instance, if you wanted to use less to page through a HTML file you might perhaps use this to run it viahtml2text
first - then useLESSCLOSE
to do any cleanup)
[USN-6644-2] LibTIFF vulnerabilities (10:51)
- 3 CVEs addressed in Jammy (22.04 LTS)
- Heap buffer overflow in libtiff itself, plus a heap buffer overflow in the tiffcp tool (used to combine multiple TIFF files into a single one) and finally a possible OOM issue in libtiff if an input file specified a very large size but then failed to actually contain such data (ie the headers specify a certain size but the file itself doesn’t contain that amount of data)
Goings on in Ubuntu Security Community
Follow up to Linux kernel CNA (11:40)
- Since announcing kernel.org has now started assigning CVEs
- First CVE assigned
- https://lore.kernel.org/linux-cve-announce/2024022058-outsell-equator-e1c5@gregkh/T/#u
CVE-2023-52433: netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
- CVE-2023-52433
- Assigned on 2024-02-20 12:53 UTC
- Both historical and recent
- 40 from 2024
- 66 from 2023
- 1 from 2022
- 165 from 2021
- 13 from 2020
- 3 from 2019
- As of
Fri 01 Mar 2024 04:04:26 UTC
have assigned 288 CVEs- 9 days, 15 hours and 11 minutes or so
- 231 hours
- Currently assigning more than 1 CVE per hour
- Looking at these, 8 appear to be due to reported issues from Coverity - popular static analysis tool which is not infallible. Others appear to come directly from the GSD project (Global Security Database)
- e.g. CVE-2019-25160 (https://lore.kernel.org/linux-cve-announce/2024022657-CVE-2019-25160-e487@gregkh/T/#u) is the same as GSD-2022-1001715
- As I mentioned in Episode 219, GSD has over 13573 Linux kernel issues
- Whilst I also said that I hoped that the kernel CNA wouldn’t be so much of a firehose, currently it seems to be quite significant
- On a personal note - I have been doing the CVE Triage role on our team this week - in past weeks, I would normally spend about 30-minutes to 1 hour each day doing this - and this week it has been at least 2 hours each day, mostly due to the large influx of kernel CVEs
- Perhaps the only way to solve this is better tooling - on our side, mdeslaur added support for automatically extracting the required git commits from the CVE notifications and the kernel team already has tooling which checks if the required commits are in the git trees of the various Ubuntu kernels
- Hopefully that helps - but it doesn’t help to assign priorities to each CVE
- The kernel CNA is not assigning CVSS scores and they don’t intend to - although my understanding is this is required - and so we can’t use this to help
- So then we need to try and manually assess the impact of each CVE - but even the kernel CNA says this is not obvious - so then perhaps the solution is to just assign them all to medium and deal with them as part of the usual kernel SRU cycle
Get in contact
231 에피소드
Manage episode 403942457 series 2423058
Alex Murray and Ubuntu Security Team에서 제공하는 콘텐츠입니다. 에피소드, 그래픽, 팟캐스트 설명을 포함한 모든 팟캐스트 콘텐츠는 Alex Murray and Ubuntu Security Team 또는 해당 팟캐스트 플랫폼 파트너가 직접 업로드하고 제공합니다. 누군가가 귀하의 허락 없이 귀하의 저작물을 사용하고 있다고 생각되는 경우 여기에 설명된 절차를 따르실 수 있습니다 https://ko.player.fm/legal.
Overview
The Linux kernel.org CNA has assigned their first CVEs so we revisit this topic to assess the initial impact on Ubuntu and the CVE ecosystem, plus we cover security updates for Roundcube Webmail, less, GNU binutils and the Linux kernel itself.
This week in Ubuntu Security Updates
64 unique CVEs addressed
[USN-6647-1] Linux kernel vulnerabilities (01:14)
- 3 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM)
- 4.15 - AWS/Azure/GCP/HWE/KVM/Oracle
- Memory leak in netfilter able to be abused via an unprivileged user namespace - DoS via exhausting system memory
[USN-6648-1] Linux kernel vulnerabilities (02:00)
- 4 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
- 5.4 - IOT/Xilinx ZynqMP/IBM/Bluefield/GKEOP/Raspi/KVM/Oracle/AWS/GCP/Generic/LowLatency/OEM
- OOB write in KTLS reported by Jann Horn - if a user can get the kernel to splice a ktls socket can possibly escalate privileges
- UAF in AppleTalk network driver - could be abused by a local unprivileged user - can be mitigated by blocklisting in
/etc/modprobe.d/blacklist-rare-network.conf
# appletalk alias net-pf-5 off
[USN-6650-1] Linux kernel (OEM) vulnerability (03:30)
- 1 CVEs addressed in Jammy (22.04 LTS)
- NULL ptr deref in generic ID allocator
[USN-6651-1] Linux kernel vulnerabilities (03:38)
- 6 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10)
- ktls + appletalk
[USN-6653-1] Linux kernel vulnerabilities
- 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- ktls + appletalk
[USN-6652-1] Linux kernel (Azure) vulnerabilities (03:47)
- 15 CVEs addressed in Mantic (23.10)
- ktls + appletalk + NULL ptr deref in TLS impl ([LSN-0100-1] Linux kernel vulnerability from Episode 219)
[USN-6649-1] Firefox vulnerabilities (04:14)
- 12 CVEs addressed in Focal (20.04 LTS)
- 123.0
[USN-6654-1] Roundcube Webmail vulnerability (04:35)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- XSS able to abused by simple text/plain emails with crafted links - included the ability to detect link references like
[1]
and linkify them to the source - if an attacker used a form like[evil]
this would be included in the generated HTML without escaping and so could get arbitrary XSS - Since is in universe, this update is available via Ubuntu Pro
[USN-6655-1] GNU binutils vulnerabilities (05:54)
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- 3 instances of DoS via excessive memory consumption, one of NULL ptr deref - in general upstream does not consider binutils safe for analysing untrusted inputs
[USN-6656-1] PostgreSQL vulnerability (06:31)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Failed to properly drop privileges when handling
REFRESH MATERIALIZED VIEW CONCURRENTLY
commands - should drop privileges so that the SQL is executed as the owner of the materialized view - as such, if an attacker could get a user or automated system to run such a command they could possibly execute arbitrary SQL as the user rather than as the owner of the view as expected
[USN-6657-1] Dnsmasq vulnerabilities (07:10)
- 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- KeyTrap and NSEC3 proof related vuln in DNSSEC - [USN-6633-1] Bind vulnerabilities from Episode 219
[USN-6658-1] libxml2 vulnerability (07:33)
- 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- UAF if using DTD validation with XInclude expansion enabled
[USN-6659-1] libde265 vulnerabilities (07:52)
- 13 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS)
- Next lot of libde265 vulns after discussed previously in [USN-6627-1] libde265 vulnerabilities from Episode 219 - more fuzzing related fixes for usual sorts of issues
[USN-6660-1, USN-6661-1] OpenJDK 11 & 17 vulnerabilities (08:17)
- 6 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- 11.0.22; 17.0.10
[USN-6662-1] OpenJDK 21 vulnerabilities
- 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- 21.0.2
[USN-6305-2] PHP vulnerabilities (08:37)
- 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS)
[USN-6663-1] OpenSSL update (08:40)
- Affecting Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Hardening update for openssl 3.0 / 1.0 - OpenSSL 3.2.0 introduced a change to return random output instead of an exception when it detected wrong padding for PKCS#1 v1.5 encryption - without this there is a timing side-channel which can be used to infer the secret key and hence break confidentiality
[USN-6664-1] less vulnerability (09:40)
- 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
- Failed to quote filenames when using
LESSCLOSE
- could then get arbitrary shell commands - env var that tells less to invoke a particular command as an input post-processor (this is used in conjunction withLESSOPEN
to pre-processor the file before it is displayed by less - for instance, if you wanted to use less to page through a HTML file you might perhaps use this to run it viahtml2text
first - then useLESSCLOSE
to do any cleanup)
[USN-6644-2] LibTIFF vulnerabilities (10:51)
- 3 CVEs addressed in Jammy (22.04 LTS)
- Heap buffer overflow in libtiff itself, plus a heap buffer overflow in the tiffcp tool (used to combine multiple TIFF files into a single one) and finally a possible OOM issue in libtiff if an input file specified a very large size but then failed to actually contain such data (ie the headers specify a certain size but the file itself doesn’t contain that amount of data)
Goings on in Ubuntu Security Community
Follow up to Linux kernel CNA (11:40)
- Since announcing kernel.org has now started assigning CVEs
- First CVE assigned
- https://lore.kernel.org/linux-cve-announce/2024022058-outsell-equator-e1c5@gregkh/T/#u
CVE-2023-52433: netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
- CVE-2023-52433
- Assigned on 2024-02-20 12:53 UTC
- Both historical and recent
- 40 from 2024
- 66 from 2023
- 1 from 2022
- 165 from 2021
- 13 from 2020
- 3 from 2019
- As of
Fri 01 Mar 2024 04:04:26 UTC
have assigned 288 CVEs- 9 days, 15 hours and 11 minutes or so
- 231 hours
- Currently assigning more than 1 CVE per hour
- Looking at these, 8 appear to be due to reported issues from Coverity - popular static analysis tool which is not infallible. Others appear to come directly from the GSD project (Global Security Database)
- e.g. CVE-2019-25160 (https://lore.kernel.org/linux-cve-announce/2024022657-CVE-2019-25160-e487@gregkh/T/#u) is the same as GSD-2022-1001715
- As I mentioned in Episode 219, GSD has over 13573 Linux kernel issues
- Whilst I also said that I hoped that the kernel CNA wouldn’t be so much of a firehose, currently it seems to be quite significant
- On a personal note - I have been doing the CVE Triage role on our team this week - in past weeks, I would normally spend about 30-minutes to 1 hour each day doing this - and this week it has been at least 2 hours each day, mostly due to the large influx of kernel CVEs
- Perhaps the only way to solve this is better tooling - on our side, mdeslaur added support for automatically extracting the required git commits from the CVE notifications and the kernel team already has tooling which checks if the required commits are in the git trees of the various Ubuntu kernels
- Hopefully that helps - but it doesn’t help to assign priorities to each CVE
- The kernel CNA is not assigning CVSS scores and they don’t intend to - although my understanding is this is required - and so we can’t use this to help
- So then we need to try and manually assess the impact of each CVE - but even the kernel CNA says this is not obvious - so then perhaps the solution is to just assign them all to medium and deal with them as part of the usual kernel SRU cycle
Get in contact
231 에피소드
모든 에피소드
×플레이어 FM에 오신것을 환영합니다!
플레이어 FM은 웹에서 고품질 팟캐스트를 검색하여 지금 바로 즐길 수 있도록 합니다. 최고의 팟캐스트 앱이며 Android, iPhone 및 웹에서도 작동합니다. 장치 간 구독 동기화를 위해 가입하세요.