Overview
This week we look at some details of the 32 unique CVEs addressed across the supported Ubuntu releases and talk open source software supply chain integrity and how this relates to Ubuntu compared to the recent npm event-stream compromise.
This week in Ubuntu Security Updates
[USN-3826-1] QEMU vulnerabilities
10 CVEs addressed in Trusty, Xenial, Bionic, CosmicCVE-2018-19364CVE-2018-18954CVE-2018-18849CVE-2018-17963CVE-2018-17962CVE-2018-17958CVE-2018-16847CVE-2018-12617CVE-2018-11806CVE-2018-108397 medium, 3 low priorityInteger overflow in virtual network interface driver, able to be triggeredby user process in guest -> crash -> DoS
Heap based buffer overflow in SLiRP, user-based networking stack (default)during reassembly of fragmented datagrams
Integer overflow when reading large blocks from files - nice PoC on githubNVMe emulator missing checks on read / write parameters - OOB heap bufferr/w - guest user/process could trigger -> DoS (crash) or possible arbitrary
code execution on host as qemu process
Integer type mismatch in rtl8139 and pcnet drivers - (from size_t to int) - unsignedto signed - INT_MAX -> -ve -> OOB read - crash / DoS
Copy-pasta?[USN-3827-1, USN-3827-2] Samba vulnerabilities
4 CVEs addressed in Precise ESM, Trusty, Xenial, Bionic, CosmicCVE-2018-16851CVE-2018-1685CVE-2018-16841CVE-2018-14629CNAME records could point to themselves - infinite recursion in internal AD DNS serverUsers can add CNAME records -> user triggerableFix ensures CNAMEs can’t refer to themselvesIf using smartcard authentication for AD, double free could occur due to mismatch in certificate vs authentication request parameterstalloc - robust against heap corruption - assert() fail - exit - DoSNull pointer dereference when reading more than 256MB of LDAP entries - DoS crash[USN-3828-1] WebKitGTK+ vulnerabilities
3 CVEs addressed in Bionic, CosmicCVE-2018-4386CVE-2018-4372CVE-2018-4345Minimal details provided by upstream webkit regarding these advisories:XSS due to improper URL validationMultiple memory corruption issues which could lead to arbitrary code execution[USN-3816-3] systemd regression
3 CVEs addressed in XenialCVE-2018-15687CVE-2018-15686CVE-2018-6954Episode 12 & 13 - backport of large upstream patches to better handle symlink resolution in systemd-tmpfilesNew code uses openat with O_PATH flag internallyO_PATH was only introduced in Linux kernel 2.6.39Fails on pre-2.6.39 kernels - eg. OpenVZSo if running an Ubuntu Xenial kernel on OpenVZ systemd would fail to work correctlyOpenVZ have released updated kernel as well to support O_PATH[USN-3829-1] Git vulnerabilities
2 CVEs addressed in Trusty, Xenial, Bionic, CosmicCVE-2018-19486CVE-2017-15298Previously would execute commands from CWD, rather than from PATHCould allow arbitrary code execution if using a malicious repositoryDoS due to large memory usage (Git Bomb) with specially crafted repositorySmall repo with only 12 unique objects inside but that which are duplicated across the repo treeGit would usually crash due to running out of memory BUT if did manage tosurvive and write to disk could consume a lot of disk space too
Only Trusty and Xenial affected (fixed already in Bionic etc)[USN-3830-1] OpenJDK regression
Recent OpenJDK update (Episode 10) add stricter checking for JAR filesAs a result, failed to find JAR files during build resulting in failed project buildsNew option should have been disabled by default to give time for other packages to be updated etc to deal wth new behaviourIs now :)[USN-3831-1] Ghostscript vulnerabilities
4 CVEs addressed in Trusty, Xenial, Bionic, CosmicCVE-2018-19477CVE-2018-19476CVE-2018-19475CVE-2018-19409Even more gs - (Episode 10, 7, 5)[USN-3795-3] libssh regression
CVE-2018-10933 - covered in Episode 8Upstream fix introduced a regression which broke server-side keyboard authenticationServer-side, not client-sideNot a common scenario used so unlikely to affect many users as need to usemultiple interactive keyboard-based prompts to trigger (say password and
token)
Server would be stuckBackport upstream fix[USN-3832-1, USN-3833-1] Linux kernel (AWS) vulnerabilities
6 CVEs addressed in Cosmic, first 2 in Bionic as wellCVE-2018-6559CVE-2018-18955CVE-2018-18653CVE-2018-18445CVE-2018-18281CVE-2018-17972Philipp Wendler discovered Ubuntu specific flaw in the way user namespaces interact with overlayfsAllows regular users to list contents of directories which they do not have read-access to (ie could list /root)Create a user and a mount namespace and then mount an overlay via overlayfs within itWithin the overlayed mount, if say contained “root” and was mounted at thefilesystem root (/), overlayfs would get confused about which permissions
to use when running and would not use the real underlying permissions but
would instead use the user supplied ones from the overlayed fs
Relates to the fix for a previous CVE (CVE-2015-1328)This fix got dropped during Bionic development cycle so reintroduced this similar vulnerabilityNew test added to Ubuntu kernel test suite to ensure this does not regress again in the futureOpen Source Software Supply Chain Integrity
NPM package (event-stream) got hijacked to inject code to target users of copay (Bitcoin wallet)Author of event-stream had lost interest, was emailed by a small contributor to take over maintenance and gave them ownership of the repoPushed a small change to add a new dependency to the packageThis then contained code to try and bundle itself with target application - copay-dashTargetted software supply chain at 2 points - event-stream repo / package AND getting into the build-system for copay-dash as a resultSo would bundle bitcoin wallet stealing code into copay-dash2 software supply chain attacksHard to fix first one since maintainers can lost interest and hand over to anyoneNew owner may not have trust the old one didnpm doesn’t care - is uncuratedCopay bundled and distributed dependencies so perhaps should have some responsibility to check those etcUbuntu is based on Debian and both are curated reposPackages are maintained by trusted developersMuch harder to mount a similar attach on Ubuntu / Debian archives due tobarrier to entry as a trusted developer
Smaller dependency chains as well compared to npm so harder to hide such an attack as wellSnap store is a different story thoughBottom line - have to trust your software suppliersUbuntu - Canonical / trusted maintainersSnap store - individual publishersGet in contact
#ubuntu-security on the Libera.Chat IRC network@ubuntu_sec on twitter
View all episodes
