Sign up to save your podcasts
Or
Share Episode 217
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Episode 217
Overview
For the first episode of 2024 we take a look at the case of a raft of bogus FOSS
CVEs reported on full-disclosure as well as AppSec tools in Ubuntu and the EOL
announcement for 23.04, plus we cover vulnerabilities in the Linux kernel, Puma,
Paramiko and more.
This week in Ubuntu Security Updates
81 unique CVEs addressed
[USN-6601-1] Linux kernel vulnerability (01:16)
and hence all receive the same data via multicasting - often used for things
like video streaming) - race condition between two different threads in the
handling of a timer which could cause the timer to be registered on an object
that is then later freed by another thread - when the timer then fires the
thread will try and access the object which has now been freed
[USN-6602-1] Linux kernel vulnerabilities (02:23)
processing them - direct memory corruption able to be triggered by a local
user - and on older kernels like the 4.4 kernel shipped in Ubuntu 16.04 this
can be done from userspace directly
info leak ([USN-6383-1] Linux kernel vulnerabilities from Episode 210)
[USN-6603-1] Linux kernel (AWS) vulnerabilities
[USN-6604-1] Linux kernel vulnerabilities
[USN-6604-2] Linux kernel (Azure) vulnerabilities
[USN-6605-1] Linux kernel vulnerabilities
[USN-6605-2] Linux kernel (KVM) vulnerabilities
[USN-6606-1] Linux kernel (OEM) vulnerabilities (03:04)
exploit (ie to create a netfilter chain etc) but this can easily be obtained
in an unprivileged user namespace -> privesc for unprivileged local user
[USN-6608-1] Linux kernel vulnerabilities
[USN-6609-1] Linux kernel vulnerabilities
[USN-6609-2] Linux kernel (NVIDIA) vulnerabilities
[USN-6607-1] Linux kernel (Azure) vulnerabilities (03:32)
[USN-6596-1] Apache::Session::LDAP vulnerability (03:45)
Perl module which by default doesn’t do this and requires applications to
explicitly instruct it to do so
[USN-6597-1] Puma vulnerability (04:24)
parse packets with chunked transfer encoding
allow a CPU or network-bandwidth based DoS attack
[USN-6598-1] Paramiko vulnerability (04:58)
itself which allows an attacker who can interpose on the connection to drop
the EXT_INFO message which is sent during the handshake to negotiate various
protocol extensions in a way that neither the client or server will notice
(since they can just send an empty ignored packet with the same sequence
number). This can be done quite easily by an attacker since during this stage
of the connection there is no encryption in place. End result is the attacker
can cause either a loss of integrity (since this won’t be detected by the
other party) or potentially to compromise the key exchange itself and hence
cause a loss of confidentiality as well
[USN-6599-1] Jinja2 vulnerabilities
[USN-6600-1] MariaDB vulnerabilities
[USN-6611-1] Exim vulnerability
[USN-6610-1] Firefox vulnerabilities
[USN-6613-1] Ceph vulnerability
[USN-6612-1] TinyXML vulnerability
[USN-6614-1] amanda vulnerability
[USN-6615-1] MySQL vulnerabilities
[USN-6616-1] OpenLDAP vulnerability
[USN-6587-3] X.Org X Server regression
[USN-6618-1] Pillow vulnerabilities
[USN-6617-1] libde265 vulnerabilities
Goings on in Ubuntu Security Community
Ubuntu 23.04 (Lunar Lobster) EOL (06:48)
bug fix) and will be archived to old-releases.ubuntu.com in the coming weeks
it does get archived the process to upgrade becomes harder (since you have to
manually update your apt sources to refer to the old-releases server first)
July this year
Awesome AppSec in Ubuntu (08:22)
security researchers
or a security researcher trying to find vulns or even a security engineer
wanting tools to help with vulnerabililty management, there is likely
something in the list for you
full-disclosure spammed with zombie CVEs (09:52)
go-to place to discuss and disclose vulnerabilities
to 15-30 which was the usual number posted for any month in 2023)
reports across a large range of OSS projects, including Redis Raft, TinyDTLS,
Mesa, ncurses, vim, GTK and more - and almost all of them were described as
NULL pointer dereferences or buffer overflows etc
these issues had been raised privately with any of these projects but also
that most of the CVE descriptions appeared to be quite bogus - e.g. for a CVE
in Mesa, where Meng describes them as a NULL pointer deref the associated
issue that the CVE points to in the upstream mesa gitlab describes a possible
OOB read but where there is no good evidence that this is able to be
influenced by the caller and hence there is no evidence that there is a
security issue here at all
upstream issue trackers that mention possible security issues OR upstream
commits that mention words like NULL pointer dereference but without any
consideration as to whether these are actual vulnerabilities
pointer, if the caller cannot influence that to occur then there is no way
to trigger it and so it is not an actual vulnerability
value - also they waste the time of OSS developers to respond to these reports
as well as distros and others to investigate them etc
Get in contact
View all episodes
By Ubuntu Security Team
4.8
1010 ratings
Overview
For the first episode of 2024 we take a look at the case of a raft of bogus FOSS
CVEs reported on full-disclosure as well as AppSec tools in Ubuntu and the EOL
announcement for 23.04, plus we cover vulnerabilities in the Linux kernel, Puma,
Paramiko and more.
This week in Ubuntu Security Updates
81 unique CVEs addressed
[USN-6601-1] Linux kernel vulnerability (01:16)
and hence all receive the same data via multicasting - often used for things
like video streaming) - race condition between two different threads in the
handling of a timer which could cause the timer to be registered on an object
that is then later freed by another thread - when the timer then fires the
thread will try and access the object which has now been freed
[USN-6602-1] Linux kernel vulnerabilities (02:23)
processing them - direct memory corruption able to be triggered by a local
user - and on older kernels like the 4.4 kernel shipped in Ubuntu 16.04 this
can be done from userspace directly
info leak ([USN-6383-1] Linux kernel vulnerabilities from Episode 210)
[USN-6603-1] Linux kernel (AWS) vulnerabilities
[USN-6604-1] Linux kernel vulnerabilities
[USN-6604-2] Linux kernel (Azure) vulnerabilities
[USN-6605-1] Linux kernel vulnerabilities
[USN-6605-2] Linux kernel (KVM) vulnerabilities
[USN-6606-1] Linux kernel (OEM) vulnerabilities (03:04)
exploit (ie to create a netfilter chain etc) but this can easily be obtained
in an unprivileged user namespace -> privesc for unprivileged local user
[USN-6608-1] Linux kernel vulnerabilities
[USN-6609-1] Linux kernel vulnerabilities
[USN-6609-2] Linux kernel (NVIDIA) vulnerabilities
[USN-6607-1] Linux kernel (Azure) vulnerabilities (03:32)
[USN-6596-1] Apache::Session::LDAP vulnerability (03:45)
Perl module which by default doesn’t do this and requires applications to
explicitly instruct it to do so
[USN-6597-1] Puma vulnerability (04:24)
parse packets with chunked transfer encoding
allow a CPU or network-bandwidth based DoS attack
[USN-6598-1] Paramiko vulnerability (04:58)
itself which allows an attacker who can interpose on the connection to drop
the EXT_INFO message which is sent during the handshake to negotiate various
protocol extensions in a way that neither the client or server will notice
(since they can just send an empty ignored packet with the same sequence
number). This can be done quite easily by an attacker since during this stage
of the connection there is no encryption in place. End result is the attacker
can cause either a loss of integrity (since this won’t be detected by the
other party) or potentially to compromise the key exchange itself and hence
cause a loss of confidentiality as well
[USN-6599-1] Jinja2 vulnerabilities
[USN-6600-1] MariaDB vulnerabilities
[USN-6611-1] Exim vulnerability
[USN-6610-1] Firefox vulnerabilities
[USN-6613-1] Ceph vulnerability
[USN-6612-1] TinyXML vulnerability
[USN-6614-1] amanda vulnerability
[USN-6615-1] MySQL vulnerabilities
[USN-6616-1] OpenLDAP vulnerability
[USN-6587-3] X.Org X Server regression
[USN-6618-1] Pillow vulnerabilities
[USN-6617-1] libde265 vulnerabilities
Goings on in Ubuntu Security Community
Ubuntu 23.04 (Lunar Lobster) EOL (06:48)
bug fix) and will be archived to old-releases.ubuntu.com in the coming weeks
it does get archived the process to upgrade becomes harder (since you have to
manually update your apt sources to refer to the old-releases server first)
July this year
Awesome AppSec in Ubuntu (08:22)
security researchers
or a security researcher trying to find vulns or even a security engineer
wanting tools to help with vulnerabililty management, there is likely
something in the list for you
full-disclosure spammed with zombie CVEs (09:52)
go-to place to discuss and disclose vulnerabilities
to 15-30 which was the usual number posted for any month in 2023)
reports across a large range of OSS projects, including Redis Raft, TinyDTLS,
Mesa, ncurses, vim, GTK and more - and almost all of them were described as
NULL pointer dereferences or buffer overflows etc
these issues had been raised privately with any of these projects but also
that most of the CVE descriptions appeared to be quite bogus - e.g. for a CVE
in Mesa, where Meng describes them as a NULL pointer deref the associated
issue that the CVE points to in the upstream mesa gitlab describes a possible
OOB read but where there is no good evidence that this is able to be
influenced by the caller and hence there is no evidence that there is a
security issue here at all
upstream issue trackers that mention possible security issues OR upstream
commits that mention words like NULL pointer dereference but without any
consideration as to whether these are actual vulnerabilities
pointer, if the caller cannot influence that to occur then there is no way
to trigger it and so it is not an actual vulnerability
value - also they waste the time of OSS developers to respond to these reports
as well as distros and others to investigate them etc
Get in contact