Sign up to save your podcasts
Or
Share Episode 218
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Episode 218
Overview
AppArmor unprivileged user namespace restrictions are back on the agenda this
week as we survey the latest improvements to this hardening feature in the
upcoming Ubuntu 24.04 LTS, plus we discuss SMTP smuggling in Postfix, runC
container escapes and Qualys’ recent disclosure of a privilege escalation
exploit for GNU libc and more.
This week in Ubuntu Security Updates
39 unique CVEs addressed
[USN-6591-2] Postfix update (00:48)
about a new technique for email spoofing, which they dubbed SMTP Smuggling
SMTP protocol is interpreted by outbound (originating) vs inbound
(receiving) SMTP servers. In particular the end-of-data sequence
. gets interpreted loosely so that it is possible to include
extra SMTP commands within the message data which would then go on to be
interpreted as an additional SMTP commands to be executed by the receiving
server and to cause it to receive two emails when only one was sent in the
first place, and where the usual SPF checks get bypassed for this second
email - so can bypass SPF/DMARC policies to spoof emails from various
domains
version 3.8.4 with an initial fix on 22nd December
option to increase interoperability whilst still preventing SMTP smuggling
[USN-6619-1] runC vulnerability (03:22)
allows an attacker to cause a newly spawned container to have a working
directory within the host filesystem namespace which in turn can allow the
attacker to escape the container - various ways this can be attacked, full
details on the upstream advisory
https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv
[USN-6620-1] GNU C Library vulnerabilities (04:17)
demonstrate they could exploit and up-to-date default install of Fedora 38 to
escalate privileges from a local unprivileged user to root.
allocated on the stack - snprintf() won’t overflow this but will return a
value larger than the fixed size buffer - as a result a heap buffer to then
contain this string would only get allocated with a size of 1 byte but then
the full expected data would get copied into it - and since the attacker
controls this value they can write arbitrary data to the heap by just using
a crafted program name (which is easy to do via the the exec command built
in to bash etc)
be abused in this way
[USN-6587-4] X.Org X Server regression (07:14)
[USN-6621-1] ImageMagick vulnerability (07:28)
crafted BMP file
[USN-6622-1] OpenSSL vulnerabilities (08:07)
time trying to check an invalid RSA or X9.42 DH keys
application state since the POLY1305 MAC implementation (hand-coded assembly)
saves the contents of the vector registers in a different order than when they
get restored - so some registers will be corrupted when returning to the
caller
instructions
[USN-6592-2] libssh vulnerabilities (09:27)
[USN-6623-1] Django vulnerability (09:34)
[USN-6609-3] Linux kernel (Oracle) vulnerabilities (09:45)
[USN-6610-2] Firefox regressions (09:57)
upstream 122.0 release has various minor regressions now fixed in this 122.0.1
release - including an issue if you happened to be using the Yaru-Remix theme
in Ubuntu
Goings on in Ubuntu Security Community
Updates for unprivileged user namespace restrictions in Ubuntu 24.04 LTS (10:32)
a different UID on a Linux system - in particular, can operate as uid 0 within
a namespace which is then constrained by the original parent namespace -
ie. as a normal unprivileged user, I could create a new user namespace and map
my UID to 0 within that namespace, which can then allow me to have say
CAP_NET_ADMIN within that namespace and so create firewall rules etc that only
affect applications within that namespace and not the host system
privileges, exposes additional kernel attack surface - various bugs have
been found in differetn kernel subsystems that allow an unprivileged user to
exploit the kernel as a result
unless an application was explicitly tagged via an associated AppArmor profile
particular adding a new default functionality where you can define in AppArmor
policy a different AppArmor profile which an application should transition
into when it creates a user namespace
ship a default “unconfined_userns” profile which allows an application to
create a userns but to not gain any additional capabilities within that by
default
of just failing when they try and create the userns, they instead are able to
create one but then if they try and gain additional capabilities (like
CAP_NET_ADMIN etc as mentioned before) this is then denied
really the user namespace itself that is the original issue, it is the ability
to gain additional capabilities within that which the unprivileged user did
not have originally
archive and across the Linux ecosystem to ensure we ship any required profiles
for them out-of-the-box so as many pieces of software continue to work as
expected with these restrictions in place
now in the apparmor package in noble-proposed pocket
testing completes
their current linux-unstable kernel (available via the Kernel Team’s unstable
PPA) which will land eventually land in 24.04 proper
for 24.04 LTS at release so we can close off one of the more prevalent sources
of kernel privilege escalation bugs in the past few years
Get in contact
View all episodes
By Ubuntu Security Team
4.8
1010 ratings
Overview
AppArmor unprivileged user namespace restrictions are back on the agenda this
week as we survey the latest improvements to this hardening feature in the
upcoming Ubuntu 24.04 LTS, plus we discuss SMTP smuggling in Postfix, runC
container escapes and Qualys’ recent disclosure of a privilege escalation
exploit for GNU libc and more.
This week in Ubuntu Security Updates
39 unique CVEs addressed
[USN-6591-2] Postfix update (00:48)
about a new technique for email spoofing, which they dubbed SMTP Smuggling
SMTP protocol is interpreted by outbound (originating) vs inbound
(receiving) SMTP servers. In particular the end-of-data sequence
. gets interpreted loosely so that it is possible to include
extra SMTP commands within the message data which would then go on to be
interpreted as an additional SMTP commands to be executed by the receiving
server and to cause it to receive two emails when only one was sent in the
first place, and where the usual SPF checks get bypassed for this second
email - so can bypass SPF/DMARC policies to spoof emails from various
domains
version 3.8.4 with an initial fix on 22nd December
option to increase interoperability whilst still preventing SMTP smuggling
[USN-6619-1] runC vulnerability (03:22)
allows an attacker to cause a newly spawned container to have a working
directory within the host filesystem namespace which in turn can allow the
attacker to escape the container - various ways this can be attacked, full
details on the upstream advisory
https://github.com/opencontainers/runc/security/advisories/GHSA-xr7r-f8xq-vfvv
[USN-6620-1] GNU C Library vulnerabilities (04:17)
demonstrate they could exploit and up-to-date default install of Fedora 38 to
escalate privileges from a local unprivileged user to root.
allocated on the stack - snprintf() won’t overflow this but will return a
value larger than the fixed size buffer - as a result a heap buffer to then
contain this string would only get allocated with a size of 1 byte but then
the full expected data would get copied into it - and since the attacker
controls this value they can write arbitrary data to the heap by just using
a crafted program name (which is easy to do via the the exec command built
in to bash etc)
be abused in this way
[USN-6587-4] X.Org X Server regression (07:14)
[USN-6621-1] ImageMagick vulnerability (07:28)
crafted BMP file
[USN-6622-1] OpenSSL vulnerabilities (08:07)
time trying to check an invalid RSA or X9.42 DH keys
application state since the POLY1305 MAC implementation (hand-coded assembly)
saves the contents of the vector registers in a different order than when they
get restored - so some registers will be corrupted when returning to the
caller
instructions
[USN-6592-2] libssh vulnerabilities (09:27)
[USN-6623-1] Django vulnerability (09:34)
[USN-6609-3] Linux kernel (Oracle) vulnerabilities (09:45)
[USN-6610-2] Firefox regressions (09:57)
upstream 122.0 release has various minor regressions now fixed in this 122.0.1
release - including an issue if you happened to be using the Yaru-Remix theme
in Ubuntu
Goings on in Ubuntu Security Community
Updates for unprivileged user namespace restrictions in Ubuntu 24.04 LTS (10:32)
a different UID on a Linux system - in particular, can operate as uid 0 within
a namespace which is then constrained by the original parent namespace -
ie. as a normal unprivileged user, I could create a new user namespace and map
my UID to 0 within that namespace, which can then allow me to have say
CAP_NET_ADMIN within that namespace and so create firewall rules etc that only
affect applications within that namespace and not the host system
privileges, exposes additional kernel attack surface - various bugs have
been found in differetn kernel subsystems that allow an unprivileged user to
exploit the kernel as a result
unless an application was explicitly tagged via an associated AppArmor profile
particular adding a new default functionality where you can define in AppArmor
policy a different AppArmor profile which an application should transition
into when it creates a user namespace
ship a default “unconfined_userns” profile which allows an application to
create a userns but to not gain any additional capabilities within that by
default
of just failing when they try and create the userns, they instead are able to
create one but then if they try and gain additional capabilities (like
CAP_NET_ADMIN etc as mentioned before) this is then denied
really the user namespace itself that is the original issue, it is the ability
to gain additional capabilities within that which the unprivileged user did
not have originally
archive and across the Linux ecosystem to ensure we ship any required profiles
for them out-of-the-box so as many pieces of software continue to work as
expected with these restrictions in place
now in the apparmor package in noble-proposed pocket
testing completes
their current linux-unstable kernel (available via the Kernel Team’s unstable
PPA) which will land eventually land in 24.04 proper
for 24.04 LTS at release so we can close off one of the more prevalent sources
of kernel privilege escalation bugs in the past few years
Get in contact