Sign up to save your podcasts
Or
Share Episode 125
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Episode 125
Overview
This week we discuss new kernel memory hardening and security development
proposals from Ubuntu Security Alumnus Kees Cook, plus we look at details
of security updates for WebKitGTK, libsndfile, GnuTLS, exiv2 and more.
This week in Ubuntu Security Updates
22 unique CVEs addressed
[USN-5024-1] WebKitGTK vulnerabilities [00:57]
[USN-4944-2] MariaDB regression [01:30]
with MySQL but failed to include the caching_sha2_password.so module
which is the standard module used to authenticate in MySQL - as such
clients would not be able to connect since they expect to use this method
to authenticate by default. Upstream MariaDB fixed this in newer versions
and this update backports that fix to the version in Ubuntu 20.04
[USN-5025-1, USN-5025-2] libsndfile vulnerability [02:25]
OSSFuzz
[USN-5026-1, USN-5026-2] QPDF vulnerabilities [02:58]
bail out if encounters too many successive errors as PDF is damaged in
this case anyway
[USN-5027-1, USN-5027-2] PEAR vulnerability [03:50]
module - since PEAR uses this directly when handling archives, it was
also vulnerable so could be made to overwrite arbitrary local files on
archive extraction and hence get code execution
[USN-5029-1] GnuTLS vulnerabilities [04:22]
to predict the behaviour of glibc’s memory allocator as well as GnuTLS’s
own internal allocator but could possibly be used for RCE
[USN-5028-1] Exiv2 vulnerability [04:57]
[USN-5030-1] Perl DBI module vulnerabilities [05:24]
to files outside the original data source directory - was still
potentially vulnerable - fixed to parse attributes more strictly to avoid
this
as a database driver - unlikely to actually be triggered in practice -
used a fixed size stack buffer and memcpy()’d into it without checking
bounds - fixed to allocate the buffer on the heap to the exact required
size
Goings on in Ubuntu Security Community
Upstream kernel memcpy() hardening [06:31]
overwriting following structure members
the bounds of a given structure (when the structure size can be known at
either compile or run-time) - but can’t handle detecting overwriting of
extra members within a structure
allow this to be done in certain circumstances without triggering
warnigns - ie in some cases want to actually overwrite following
structure members like when handling network packets etc
easy to statically determine all these call sites, for now this proposal
is warn-only - but in the future the hope is to make it enforcing so it
can actually stop possible buffer overflows
memcpy() overflows so shows likely real-world promise as an extra
defensive measure
Linux kernel security done right [09:29]
kernel or one of the stable trees - instead of each manually backporting
patches etc - duplicated work
hardening etc - which benefit everyone - ie by working upstream on a
common platform this reduces duplicated efforts and gains many
efficiencies
Hiring [11:50]
Linux Cryptography and Security Engineer
Security Engineer - Ubuntu
Security - Product Manager
Get in contact
View all episodes
By Ubuntu Security Team
4.8
1010 ratings
Overview
This week we discuss new kernel memory hardening and security development
proposals from Ubuntu Security Alumnus Kees Cook, plus we look at details
of security updates for WebKitGTK, libsndfile, GnuTLS, exiv2 and more.
This week in Ubuntu Security Updates
22 unique CVEs addressed
[USN-5024-1] WebKitGTK vulnerabilities [00:57]
[USN-4944-2] MariaDB regression [01:30]
with MySQL but failed to include the caching_sha2_password.so module
which is the standard module used to authenticate in MySQL - as such
clients would not be able to connect since they expect to use this method
to authenticate by default. Upstream MariaDB fixed this in newer versions
and this update backports that fix to the version in Ubuntu 20.04
[USN-5025-1, USN-5025-2] libsndfile vulnerability [02:25]
OSSFuzz
[USN-5026-1, USN-5026-2] QPDF vulnerabilities [02:58]
bail out if encounters too many successive errors as PDF is damaged in
this case anyway
[USN-5027-1, USN-5027-2] PEAR vulnerability [03:50]
module - since PEAR uses this directly when handling archives, it was
also vulnerable so could be made to overwrite arbitrary local files on
archive extraction and hence get code execution
[USN-5029-1] GnuTLS vulnerabilities [04:22]
to predict the behaviour of glibc’s memory allocator as well as GnuTLS’s
own internal allocator but could possibly be used for RCE
[USN-5028-1] Exiv2 vulnerability [04:57]
[USN-5030-1] Perl DBI module vulnerabilities [05:24]
to files outside the original data source directory - was still
potentially vulnerable - fixed to parse attributes more strictly to avoid
this
as a database driver - unlikely to actually be triggered in practice -
used a fixed size stack buffer and memcpy()’d into it without checking
bounds - fixed to allocate the buffer on the heap to the exact required
size
Goings on in Ubuntu Security Community
Upstream kernel memcpy() hardening [06:31]
overwriting following structure members
the bounds of a given structure (when the structure size can be known at
either compile or run-time) - but can’t handle detecting overwriting of
extra members within a structure
allow this to be done in certain circumstances without triggering
warnigns - ie in some cases want to actually overwrite following
structure members like when handling network packets etc
easy to statically determine all these call sites, for now this proposal
is warn-only - but in the future the hope is to make it enforcing so it
can actually stop possible buffer overflows
memcpy() overflows so shows likely real-world promise as an extra
defensive measure
Linux kernel security done right [09:29]
kernel or one of the stable trees - instead of each manually backporting
patches etc - duplicated work
hardening etc - which benefit everyone - ie by working upstream on a
common platform this reduces duplicated efforts and gains many
efficiencies
Hiring [11:50]
Linux Cryptography and Security Engineer
Security Engineer - Ubuntu
Security - Product Manager
Get in contact