Sign up to save your podcasts
Or
Share Episode 171
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Episode 171
Overview
This week we dig into what community sponsored security updates are all
about, plus Ubuntu 22.04.1 LTS gets delayed by a week and we cover security
updates for MySQL, the Linux kernel, Samba, Net-SNMP and more.
This week in Ubuntu Security Updates
75 unique CVEs addressed
[USN-5535-1] Intel Microcode vulnerabilities [00:43]
[USN-5537-1, USN-5537-2] MySQL vulnerabilities [01:22]
and possible incompatible changes
[USN-5538-1] libtirpc vulnerability [01:59]
python, samba, yp-tools and lots more
file descriptor open and eventually would exhaust available fds so could
then not accept new connections (since it would also not handle the case
of no available fds either and would spin in a busy loop trying to accept
new connections) - CPU-based DoS
[USN-5536-1] Firefox vulnerabilities [02:47]
Mozilla
[USN-5544-1] Linux kernel vulnerabilities [03:06]
RPC and floppy driver
(which can be done via mapping to root in an unprivileged user
namespace) -> privesc
[USN-5545-1] Linux kernel (OEM) vulnerability [03:49]
LTS respectively
[USN-5539-1] Linux kernel vulnerabilities [04:11]
driver, 1 in 6pack and mkiss protocol drivers, 1 in 8 Devices USB2CAN and
1 in floppy driver
then corrupt host memory
[USN-5541-1] Linux kernel (Azure) vulnerabilities [05:04]
previous episodes - cgroup process migration privesc, UAF in FUSE etc
[USN-5540-1] Linux kernel vulnerabilities [05:26]
code-exec
[USN-5542-1] Samba vulnerabilities [06:06]
changing passwords
your own key that was destined for another user and therefore change
their password (including domain admin)
version used in 18.04 LTS (4.7.6) compared to the current upstream
release (4.16.x) it is not possible to backport these patches without a
reasonable risk of introducing a regression - as such users of samba in
18.04 LTS who are concerned about these vulnerabilities are advised to
upgrade to Ubuntu 20.04 LTS or newer to continue receiving security
support for samba
[USN-5543-1] Net-SNMP vulnerabilities [07:25]
overflows) which could be triggered via crafted SNMP requests -> crash
(DoS), RCE
[USN-5463-2] NTFS-3G vulnerabilities [07:45]
arbitrary memory R/W, intercept traffic between FUSE and kernel -> info
leak etc
Goings on in Ubuntu Security Community
An overview of the community security updates sponsoring process [08:20]
subscribes the Ubuntu Security Sponsors team and attaches a debdiff
in the Ubuntu archive and the new updated version being proposed
which fixed the vulnerability, as well as a new changelog entry
describing this update
of their software when patching security vulnerabilies, in Ubuntu we
will not just upgrade to this new version (in the lifetime of a
stable release) to fix the vulnerability - instead we will just
cherry-pick the minimal change required to fix the issue and apply
this ontop of the older version of the software which is maintained
for the life a given Ubuntu release
upstream features getting introduced etc
patches that get applied ontop of the upstream source tarball within a
debian package
debian/patches directory as well as a corresponding entry for it in the
debian/patches/series file, and then a new debian/changelog entry
project may be needed - these can then be included as additional patch
files too
to the above - in particular to check that the original upstream patch
was used and no other changes were introduced (again to make sure we
keep the risk of regression low and so we have provenance of the code
which has been introduced)
Ubuntu Security Proposed PPA - this is a publicly accessible PPA which
allows the resulting candidate packages to be tested by the Security
Team member as well as the community member
archive along with an associated USN
https://bugs.launchpad.net/ubuntu/+source/spip/+bug/1971185 which
corresponded to USN-5482-1 - SPIP for bionic
build and testing environments to make the process a lot easier - in
particular the umt tool which can be used for managing most of these
steps (ie. downloading source packages, adding a new changelog entry,
building the package locally in a schroot, testing the package locally in
a VM etc)
Ubuntu 22.04.1 release delayed [17:00]
essentially was a bug in snapd when being installed in OEM mode
on by the end user they are offered to setup the machine (create a
local user account, set timezone/language etc)
snaps which are seeded (ie. shipped on the ISO and installed OOTB) would
not run
crucial applications (ie web browser and app store)
the multi-user target wants them which ensures they are mounted during
normal boot (equivalent to runlevel 2 - ie. not a rescue shell or
shutdown etc) - so basically any normal boot of the system and they
should be mounted
has set the boot target to it’s own oem-config.target so it can run first
(to create a new user etc) - and then once it is done it sets the target
to the usual graphical.target which includes multi-user.target
to try and automatically install theme snaps and the like to match the
system theme - gets started as part of the oem-config and it then
pokes the snapd.socket which causes snapd.service to be started - yet the
snap mount units are not in place, so snapd can’t see any of the expected
snaps, as such it fails to correctly generate their state information
defined or connected and so cannot access anything and fail - and even a
reboot doesn’t help as the old invalid state is still kept even though
the snaps are now mounted correctly
multi-user.target but default.target so they get mounted no matter what
target is being booted into
Get in contact
View all episodes
By Ubuntu Security Team
4.8
1010 ratings
Overview
This week we dig into what community sponsored security updates are all
about, plus Ubuntu 22.04.1 LTS gets delayed by a week and we cover security
updates for MySQL, the Linux kernel, Samba, Net-SNMP and more.
This week in Ubuntu Security Updates
75 unique CVEs addressed
[USN-5535-1] Intel Microcode vulnerabilities [00:43]
[USN-5537-1, USN-5537-2] MySQL vulnerabilities [01:22]
and possible incompatible changes
[USN-5538-1] libtirpc vulnerability [01:59]
python, samba, yp-tools and lots more
file descriptor open and eventually would exhaust available fds so could
then not accept new connections (since it would also not handle the case
of no available fds either and would spin in a busy loop trying to accept
new connections) - CPU-based DoS
[USN-5536-1] Firefox vulnerabilities [02:47]
Mozilla
[USN-5544-1] Linux kernel vulnerabilities [03:06]
RPC and floppy driver
(which can be done via mapping to root in an unprivileged user
namespace) -> privesc
[USN-5545-1] Linux kernel (OEM) vulnerability [03:49]
LTS respectively
[USN-5539-1] Linux kernel vulnerabilities [04:11]
driver, 1 in 6pack and mkiss protocol drivers, 1 in 8 Devices USB2CAN and
1 in floppy driver
then corrupt host memory
[USN-5541-1] Linux kernel (Azure) vulnerabilities [05:04]
previous episodes - cgroup process migration privesc, UAF in FUSE etc
[USN-5540-1] Linux kernel vulnerabilities [05:26]
code-exec
[USN-5542-1] Samba vulnerabilities [06:06]
changing passwords
your own key that was destined for another user and therefore change
their password (including domain admin)
version used in 18.04 LTS (4.7.6) compared to the current upstream
release (4.16.x) it is not possible to backport these patches without a
reasonable risk of introducing a regression - as such users of samba in
18.04 LTS who are concerned about these vulnerabilities are advised to
upgrade to Ubuntu 20.04 LTS or newer to continue receiving security
support for samba
[USN-5543-1] Net-SNMP vulnerabilities [07:25]
overflows) which could be triggered via crafted SNMP requests -> crash
(DoS), RCE
[USN-5463-2] NTFS-3G vulnerabilities [07:45]
arbitrary memory R/W, intercept traffic between FUSE and kernel -> info
leak etc
Goings on in Ubuntu Security Community
An overview of the community security updates sponsoring process [08:20]
subscribes the Ubuntu Security Sponsors team and attaches a debdiff
in the Ubuntu archive and the new updated version being proposed
which fixed the vulnerability, as well as a new changelog entry
describing this update
of their software when patching security vulnerabilies, in Ubuntu we
will not just upgrade to this new version (in the lifetime of a
stable release) to fix the vulnerability - instead we will just
cherry-pick the minimal change required to fix the issue and apply
this ontop of the older version of the software which is maintained
for the life a given Ubuntu release
upstream features getting introduced etc
patches that get applied ontop of the upstream source tarball within a
debian package
debian/patches directory as well as a corresponding entry for it in the
debian/patches/series file, and then a new debian/changelog entry
project may be needed - these can then be included as additional patch
files too
to the above - in particular to check that the original upstream patch
was used and no other changes were introduced (again to make sure we
keep the risk of regression low and so we have provenance of the code
which has been introduced)
Ubuntu Security Proposed PPA - this is a publicly accessible PPA which
allows the resulting candidate packages to be tested by the Security
Team member as well as the community member
archive along with an associated USN
https://bugs.launchpad.net/ubuntu/+source/spip/+bug/1971185 which
corresponded to USN-5482-1 - SPIP for bionic
build and testing environments to make the process a lot easier - in
particular the umt tool which can be used for managing most of these
steps (ie. downloading source packages, adding a new changelog entry,
building the package locally in a schroot, testing the package locally in
a VM etc)
Ubuntu 22.04.1 release delayed [17:00]
essentially was a bug in snapd when being installed in OEM mode
on by the end user they are offered to setup the machine (create a
local user account, set timezone/language etc)
snaps which are seeded (ie. shipped on the ISO and installed OOTB) would
not run
crucial applications (ie web browser and app store)
the multi-user target wants them which ensures they are mounted during
normal boot (equivalent to runlevel 2 - ie. not a rescue shell or
shutdown etc) - so basically any normal boot of the system and they
should be mounted
has set the boot target to it’s own oem-config.target so it can run first
(to create a new user etc) - and then once it is done it sets the target
to the usual graphical.target which includes multi-user.target
to try and automatically install theme snaps and the like to match the
system theme - gets started as part of the oem-config and it then
pokes the snapd.socket which causes snapd.service to be started - yet the
snap mount units are not in place, so snapd can’t see any of the expected
snaps, as such it fails to correctly generate their state information
defined or connected and so cannot access anything and fail - and even a
reboot doesn’t help as the old invalid state is still kept even though
the snaps are now mounted correctly
multi-user.target but default.target so they get mounted no matter what
target is being booted into
Get in contact