Ubuntu Security Podcast

Episode 150

Listen Later
Overview

Ubuntu 20.04.4 LTS is released, plus we talk about Google Project Zero’s

metrics report as well as security updates for the Linux kernel, expat,
c3p0, Cyrus SASL and more.

This week in Ubuntu Security Updates

62 unique CVEs addressed

[USN-5292-2, USN-5292-3] snapd vulnerabilities [00:44]
  • 4 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Focal (20.04 LTS)
    • CVE-2021-44731
    • CVE-2021-44730
    • CVE-2021-4120
    • CVE-2021-3155
    • Episode 149
      • [USN-5294-1, USN-5294-2] Linux kernel vulnerabilities [01:38]
      • 8 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS)
        • CVE-2022-22942
        • CVE-2022-0330
        • CVE-2021-43975
        • CVE-2021-4202
        • CVE-2021-4155
        • CVE-2021-4083
        • CVE-2021-39685
        • CVE-2021-22600
        • 5.4 - focal GA + clouds
        • Usual sorts of issues - double-free (UAF) in packet network protocol, OOB
          • R/W in USB Gadget, race condition in Unix domain sockets - UAF, XFS info
          leak, NFC race -> UAF, Intel GPU TLB flush missing - DoS/RCE, VMWare vGPU
          missing cleanup on errors - stale entries in fd table - info leak /
          privesc
          [USN-5295-1, USN-5295-2] Linux kernel (HWE) vulnerabilities [02:57]
          • 5 CVEs addressed in Impish (21.10), Focal (20.04 LTS)
            • CVE-2022-22942
            • CVE-2022-0330
            • CVE-2021-4155
            • CVE-2021-4083
            • CVE-2021-22600
            • 5.13 - impish GA + focal HWE
              • [USN-5297-1] Linux kernel (GKE) vulnerabilities [03:17]
              • 7 CVEs addressed in Focal (20.04 LTS)
                • CVE-2022-22942
                • CVE-2022-0330
                • CVE-2021-43975
                • CVE-2021-4202
                • CVE-2021-4155
                • CVE-2021-4083
                • CVE-2021-39685
                • 5.4 gke specific kernel - focal + bionic
                  • [USN-5298-1] Linux kernel vulnerabilities [03:29]
                  • 12 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS)
                    • CVE-2022-22942
                    • CVE-2022-0330
                    • CVE-2021-4202
                    • CVE-2021-4155
                    • CVE-2021-4083
                    • CVE-2021-39685
                    • CVE-2021-28715
                    • CVE-2021-28714
                    • CVE-2021-28713
                    • CVE-2021-28712
                    • CVE-2021-28711
                    • CVE-2021-22600
                    • 4.15 bionic GA + xenial HWE + trusty azure
                      • [USN-5299-1] Linux kernel vulnerabilities [03:46]
                      • 13 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
                        • CVE-2021-45485
                        • CVE-2021-42008
                        • CVE-2021-38204
                        • CVE-2021-3679
                        • CVE-2021-3612
                        • CVE-2021-3564
                        • CVE-2021-3483
                        • CVE-2021-34693
                        • CVE-2021-33034
                        • CVE-2021-28972
                        • CVE-2021-0129
                        • CVE-2020-26558
                        • CVE-2020-26147
                        • 4.4 - xenial GA + trusty ESM
                          • [USN-5302-1] Linux kernel (OEM) vulnerabilities [03:57]
                          • 6 CVEs addressed in Focal (20.04 LTS)
                            • CVE-2022-24959
                              • CVE-2022-24448
                              • CVE-2022-0435
                              • CVE-2021-44879
                              • CVE-2021-43976
                              • CVE-2022-0492
                              • 5.14 - focal OEM
                                • [USN-5288-1] Expat vulnerabilities [04:12]
                                • 12 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Impish (21.10)
                                  • CVE-2022-25236
                                  • CVE-2022-25235
                                  • CVE-2022-23990
                                  • CVE-2022-23852
                                  • CVE-2022-22827
                                  • CVE-2022-22826
                                  • CVE-2022-22825
                                  • CVE-2022-22824
                                  • CVE-2022-22823
                                  • CVE-2022-22822
                                  • CVE-2021-46143
                                  • CVE-2021-45960
                                  • XML parser written in C - used by a huge number of other applications
                                    • from audacity, avahi, ceph, dbus, gdb, git, fontconfig, python, mesa,
                                    squid and a lot more
                                  • 2 possible RCE vulns - possible to inject content into XML namespace
                                    • tags, and failure to validate encoding e.g. for UTF-8 in particular
                                    contexts
                                    • critical severity according to upstream since if expat passes malformed
                                      • data back to the application could result in memory corruption etc ->
                                      RCE (thanks to upstream for the heads-up on the possible impact of
                                      these)
                                    • Plus a bunch of DoS and other less severe bugs fixed too (stack
                                      • exhaustion, integer overflows when multi-gigabyte input is parsed etc)
                                      [USN-5293-1] c3p0 vulnerability [05:41]
                                      • 1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Impish (21.10)
                                        • CVE-2019-5427
                                        • JDBC connection pooling library
                                        • billion laughs attack (aka XML bomb) when parsing XML config via
                                          • recursive XML entity expansion - have one entity defined as 10 of the
                                          previous entity - then do this 10 times - 1 billion copies of the
                                          original entity - memory exhaustion
                                        • billion laughs comes from original PoC which used an entity called lol
                                          • which was defined as 10 copies of lol8 which was defined as 10 copies of
                                          lol7 etc…
                                          [USN-5301-1, USN-5301-2] Cyrus SASL vulnerability [06:44]
                                          • 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Impish (21.10)
                                            • CVE-2022-24407
                                            • SASL implementation for Cyrus IMAP server, used also by exim, ldap-utils,
                                              • mutt, php, postfix and others
                                            • SQL plugin failed to properly validate input - SQL injection
                                              • [USN-5300-1] PHP vulnerabilities [07:23]
                                              • 6 CVEs addressed in Xenial ESM (16.04 ESM)
                                                • CVE-2021-21707
                                                • CVE-2017-9119
                                                • CVE-2017-9120
                                                • CVE-2017-9118
                                                • CVE-2017-8923
                                                • CVE-2015-9253
                                                • php 7 - 4 different DoS vulns, 1 memory corruption - crash/RCE and one
                                                  • info leak
                                                  Goings on in Ubuntu Security Community
                                                  GPZ report on vulnerability metrics [07:48]
                                                  • https://googleprojectzero.blogspot.com/2022/02/a-walk-through-project-zero-metrics.html
                                                  • Looks at vulns which GPZ has reported between Jan 2019 - Dec 2021 and how
                                                    • fast they get patched
                                                  • 376 vulns
                                                    • 351 (93%) fixed, 14 (4%) wontfix, 11 (3%) unfixed
                                                    • 96 (26%) Microsoft, 85 (23%) Apple, 60 (16%) Google
                                                    • Strict 90-day deadline to fix and ship (with additional 14-day grace
                                                      • period)
                                                    • When looking at vulns, group by Vendor - Apple, MS, Google, Linux
                                                      • (kernel), Adobe, Mozilla, Samsung, Oracle and Others
                                                      • Others: includes both vendors: Apache, AWS, Canonical, Intel, Qualcomm,
                                                        • RedHat etc, but also individual OSS projects: c-ares, git, glibc,
                                                        gnupg, libseccomp, systemd and more
                                                      • Time-to-patch:
                                                        • Linux - 25 days on average
                                                        • Google + Others - 44 days
                                                        • Mozilla - 61
                                                        • Adobe - 65
                                                        • Apple - 69
                                                        • Microsoft - 83
                                                        • Oracle - 109
                                                        • If look by year - shows most vendors have gotten faster over time - but
                                                          • in particular Linux and Others are twice as fast in 2021 cf. 2019
                                                          • Good news for Ubuntu users as these encompass the Linux relevant vulns
                                                          • Also look into stats on Phone - comparing iOS, Android (Samsung), Android
                                                            • (Google) - and all have a TTP of ~70 days
                                                          • Then also dig into specifics of timelines for OSS projects, focusing on
                                                            • browsers since can break down the process into 2 discrete steps:
                                                            • time from report to a public patch being available
                                                            • time from public patch to release
                                                            • And compare these across Chrome, WebKit and Firefox
                                                              • Chrome is fastest overall at 30 days total, Firefox 38 days, WebKit 73
                                                              • When looking at the two steps:
                                                                • Chrome has a very short initial patch time - 5 days - but both WebKit
                                                                  • and Firefox are respectible with 12 and 17 days respectively
                                                                • But release cycle of WebKit is so long (61 days)compared to Chrome
                                                                  • (25) and Firefox (21) that this significantly delays the time to
                                                                  fixes being available to users
                                                                • Also puts them at more risk, since once a patch is publicly
                                                                  • available, it is usually not too hard to engineer a PoC for motivated
                                                                  researchers, so they then have 2 months to use this on average before
                                                                  it is patched
                                                                • WebKit is used for all web rendering on iOS so iPhone users are then
                                                                  • vulnerable for quite a while no matter what browser they use -
                                                                  hopefully Apple get faster at doing WebKit releases
                                                                • Compared to Firefox and Chrome - both 4 week cycle now
                                                                • Is not enough to develop fixes - you actually have to get them into
                                                                  • the hands of users to protect them
                                                                  Ubuntu 20.04.4 LTS Released [15:27]
                                                                  • https://lists.ubuntu.com/archives/ubuntu-announce/2022-February/000277.html

                                                                    • The Ubuntu team is pleased to announce the release of Ubuntu 20.04.4 LTS

                                                                    (Long-Term Support) for its Desktop, Server, and Cloud products, as well
                                                                    as other flavours of Ubuntu with long-term support.

                                                                    Like previous LTS series, 20.04.4 includes hardware enablement stacks

                                                                    for use on newer hardware. This support is offered on all architectures.

                                                                    Ubuntu Server defaults to installing the GA kernel; however you may

                                                                    select the HWE kernel from the installer bootloader.

                                                                    As usual, this point release includes many updates, and updated

                                                                    installation media has been provided so that fewer updates will need to
                                                                    be downloaded after installation. These include security updates and
                                                                    corrections for other high-impact bugs, with a focus on maintaining
                                                                    stability and compatibility with Ubuntu 20.04 LTS.

                                                                    Kubuntu 20.04.4 LTS, Ubuntu Budgie 20.04.4 LTS, Ubuntu MATE 20.04.4 LTS,

                                                                    Lubuntu 20.04.4 LTS, Ubuntu Kylin 20.04.4 LTS, Ubuntu Studio 20.04.4 LTS,
                                                                    and Xubuntu 20.04.4 LTS are also now available. More details can be found
                                                                    in their individual release notes:

                                                                    https://wiki.ubuntu.com/FocalFossa/ReleaseNotes#Official_flavours

                                                                    Maintenance updates will be provided for 5 years for Ubuntu Desktop,

                                                                    Ubuntu Server, Ubuntu Cloud, and Ubuntu Core. All the remaining
                                                                    flavours will be supported for 3 years. Additional security support is
                                                                    available with ESM (Extended Security Maintenance).

                                                                    • https://wiki.ubuntu.com/FocalFossa/ReleaseNotes
                                                                    • https://wiki.ubuntu.com/FocalFossa/ReleaseNotes/ChangeSummary/20.04.4
                                                                      • Get in contact
                                                                      • [email protected]
                                                                      • #ubuntu-security on the Libera.Chat IRC network
                                                                      • ubuntu-hardened mailing list
                                                                      • Security section on discourse.ubuntu.com
                                                                      • @ubuntu_sec on twitter
                                                                        • ...more
                                                                        View all episodesView all episodes
                                                                        Download on the App Store
                                                                        Ubuntu Security PodcastBy Ubuntu Security Team
                                                                        • 4.8
                                                                        • 4.8
                                                                        • 4.8
                                                                        • 4.8
                                                                        • 4.8

                                                                        4.8

                                                                        10 ratings