Sign up to save your podcasts
Or
Share Episode 220
Share to email
Share to Facebook
Share to X
Share to email
Share to Facebook
Share to X
Or
Episode 220
Overview
The Linux kernel.org CNA has assigned their first CVEs so we revisit this topic
to assess the initial impact on Ubuntu and the CVE ecosystem, plus we cover
security updates for Roundcube Webmail, less, GNU binutils and the Linux kernel
itself.
This week in Ubuntu Security Updates
64 unique CVEs addressed
[USN-6647-1] Linux kernel vulnerabilities (01:14)
namespace - DoS via exhausting system memory
[USN-6648-1] Linux kernel vulnerabilities (02:00)
splice a ktls socket can possibly escalate privileges
user - can be mitigated by blocklisting in /etc/modprobe.d/blacklist-rare-network.conf
# appletalk
alias net-pf-5 off
[USN-6650-1] Linux kernel (OEM) vulnerability (03:30)
[USN-6651-1] Linux kernel vulnerabilities (03:38)
[USN-6653-1] Linux kernel vulnerabilities
[USN-6652-1] Linux kernel (Azure) vulnerabilities (03:47)
[USN-6649-1] Firefox vulnerabilities (04:14)
[USN-6654-1] Roundcube Webmail vulnerability (04:35)
the ability to detect link references like [1] and linkify them to the
source - if an attacker used a form like [] this would be
included in the generated HTML without escaping and so could get arbitrary XSS
[USN-6655-1] GNU binutils vulnerabilities (05:54)
in general upstream does not consider binutils safe for analysing untrusted
inputs
[USN-6656-1] PostgreSQL vulnerability (06:31)
the owner of the materialized view - as such, if an attacker could get a user
or automated system to run such a command they could possibly execute
arbitrary SQL as the user rather than as the owner of the view as expected
[USN-6657-1] Dnsmasq vulnerabilities (07:10)
vulnerabilities from Episode 219
[USN-6658-1] libxml2 vulnerability (07:33)
[USN-6659-1] libde265 vulnerabilities (07:52)
[USN-6627-1] libde265 vulnerabilities from
Episode 219 - more fuzzing related fixes for usual sorts of issues
[USN-6660-1, USN-6661-1] OpenJDK 11 & 17 vulnerabilities (08:17)
[USN-6662-1] OpenJDK 21 vulnerabilities
[USN-6305-2] PHP vulnerabilities (08:37)
[USN-6663-1] OpenSSL update (08:40)
return random output instead of an exception when it detected wrong padding
for PKCS#1 v1.5 encryption - without this there is a timing side-channel which
can be used to infer the secret key and hence break confidentiality
[USN-6664-1] less vulnerability (09:40)
shell commands - env var that tells less to invoke a particular command as an
input post-processor (this is used in conjunction with LESSOPEN to
pre-processor the file before it is displayed by less - for instance, if you
wanted to use less to page through a HTML file you might perhaps use this to
run it via html2text first - then use LESSCLOSE to do any cleanup)
[USN-6644-2] LibTIFF vulnerabilities (10:51)
tiffcp tool (used to combine multiple TIFF files into a single one) and
finally a possible OOM issue in libtiff if an input file specified a very
large size but then failed to actually contain such data (ie the headers
specify a certain size but the file itself doesn’t contain that amount of
data)
Goings on in Ubuntu Security Community
Follow up to Linux kernel CNA (11:40)
popular static analysis tool which is not infallible. Others appear to come
directly from the GSD project (Global Security Database)
(https://lore.kernel.org/linux-cve-announce/2024022657-CVE-2019-25160-e487@gregkh/T/#u)
is the same as GSD-2022-1001715
firehose, currently it seems to be quite significant
week - in past weeks, I would normally spend about 30-minutes to 1 hour each
day doing this - and this week it has been at least 2 hours each day, mostly
due to the large influx of kernel CVEs
added support for automatically extracting the required git commits from the
CVE notifications and the kernel team already has tooling which checks if the
required commits are in the git trees of the various Ubuntu kernels
although my understanding is this is required - and so we can’t use this to help
the kernel CNA says this is not obvious - so then perhaps the solution is to
just assign them all to medium and deal with them as part of the usual kernel
SRU cycle
Get in contact
View all episodes
By Ubuntu Security Team
4.8
1010 ratings
Overview
The Linux kernel.org CNA has assigned their first CVEs so we revisit this topic
to assess the initial impact on Ubuntu and the CVE ecosystem, plus we cover
security updates for Roundcube Webmail, less, GNU binutils and the Linux kernel
itself.
This week in Ubuntu Security Updates
64 unique CVEs addressed
[USN-6647-1] Linux kernel vulnerabilities (01:14)
namespace - DoS via exhausting system memory
[USN-6648-1] Linux kernel vulnerabilities (02:00)
splice a ktls socket can possibly escalate privileges
user - can be mitigated by blocklisting in /etc/modprobe.d/blacklist-rare-network.conf
# appletalk
alias net-pf-5 off
[USN-6650-1] Linux kernel (OEM) vulnerability (03:30)
[USN-6651-1] Linux kernel vulnerabilities (03:38)
[USN-6653-1] Linux kernel vulnerabilities
[USN-6652-1] Linux kernel (Azure) vulnerabilities (03:47)
[USN-6649-1] Firefox vulnerabilities (04:14)
[USN-6654-1] Roundcube Webmail vulnerability (04:35)
the ability to detect link references like [1] and linkify them to the
source - if an attacker used a form like [] this would be
included in the generated HTML without escaping and so could get arbitrary XSS
[USN-6655-1] GNU binutils vulnerabilities (05:54)
in general upstream does not consider binutils safe for analysing untrusted
inputs
[USN-6656-1] PostgreSQL vulnerability (06:31)
the owner of the materialized view - as such, if an attacker could get a user
or automated system to run such a command they could possibly execute
arbitrary SQL as the user rather than as the owner of the view as expected
[USN-6657-1] Dnsmasq vulnerabilities (07:10)
vulnerabilities from Episode 219
[USN-6658-1] libxml2 vulnerability (07:33)
[USN-6659-1] libde265 vulnerabilities (07:52)
[USN-6627-1] libde265 vulnerabilities from
Episode 219 - more fuzzing related fixes for usual sorts of issues
[USN-6660-1, USN-6661-1] OpenJDK 11 & 17 vulnerabilities (08:17)
[USN-6662-1] OpenJDK 21 vulnerabilities
[USN-6305-2] PHP vulnerabilities (08:37)
[USN-6663-1] OpenSSL update (08:40)
return random output instead of an exception when it detected wrong padding
for PKCS#1 v1.5 encryption - without this there is a timing side-channel which
can be used to infer the secret key and hence break confidentiality
[USN-6664-1] less vulnerability (09:40)
shell commands - env var that tells less to invoke a particular command as an
input post-processor (this is used in conjunction with LESSOPEN to
pre-processor the file before it is displayed by less - for instance, if you
wanted to use less to page through a HTML file you might perhaps use this to
run it via html2text first - then use LESSCLOSE to do any cleanup)
[USN-6644-2] LibTIFF vulnerabilities (10:51)
tiffcp tool (used to combine multiple TIFF files into a single one) and
finally a possible OOM issue in libtiff if an input file specified a very
large size but then failed to actually contain such data (ie the headers
specify a certain size but the file itself doesn’t contain that amount of
data)
Goings on in Ubuntu Security Community
Follow up to Linux kernel CNA (11:40)
popular static analysis tool which is not infallible. Others appear to come
directly from the GSD project (Global Security Database)
(https://lore.kernel.org/linux-cve-announce/2024022657-CVE-2019-25160-e487@gregkh/T/#u)
is the same as GSD-2022-1001715
firehose, currently it seems to be quite significant
week - in past weeks, I would normally spend about 30-minutes to 1 hour each
day doing this - and this week it has been at least 2 hours each day, mostly
due to the large influx of kernel CVEs
added support for automatically extracting the required git commits from the
CVE notifications and the kernel team already has tooling which checks if the
required commits are in the git trees of the various Ubuntu kernels
although my understanding is this is required - and so we can’t use this to help
the kernel CNA says this is not obvious - so then perhaps the solution is to
just assign them all to medium and deal with them as part of the usual kernel
SRU cycle
Get in contact