Ubuntu Security Podcast

Episode 78

Listen Later
Overview

SRBDS aka CrossTalk, the latest Intel speculative execution attack, is the

big news this week in security updates for Ubuntu, as well as fixes for
GnuTLS, Firefox and more, plus Alex and Joe talk about using STRIDE for
threat modelling of software products.

This week in Ubuntu Security Updates

39 unique CVEs addressed

[USN-4381-2] Django vulnerabilities [01:00]
  • 2 CVEs addressed in Trusty ESM (14.04 ESM)
    • CVE-2020-13596
    • CVE-2020-13254
    • Episode 77
      • [USN-4382-1] FreeRDP vulnerabilities [01:28]
      • 14 CVEs addressed in Xenial (16.04 LTS)
        • CVE-2020-13398
        • CVE-2020-13397
        • CVE-2020-13396
        • CVE-2020-11526
        • CVE-2020-11525
        • CVE-2020-11523
        • CVE-2020-11522
        • CVE-2020-11521
        • CVE-2020-11058
        • CVE-2020-11049
        • CVE-2020-11048
        • CVE-2020-11046
        • CVE-2020-11045
        • CVE-2020-11042
        • Episode 77 covered a similar update for FreeRDP2 in 18.04 LTS, 19.10, 20.04 LTS
        • This is the corresponding update for FreeRDP 1 in 16.04 LTS
          • [USN-4383-1] Firefox vulnerabilities [02:09]
          • 8 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
            • CVE-2020-12399
            • CVE-2020-12411
            • CVE-2020-12410
            • CVE-2020-12409
            • CVE-2020-12408
            • CVE-2020-12407
            • CVE-2020-12406
            • CVE-2020-12405
            • 77.0.1
              • [USN-4384-1] GnuTLS vulnerability [02:54]
              • 1 CVEs addressed in Eoan (19.10), Focal (20.04 LTS)
                • CVE-2020-13777
                • Rare Friday update - high priority GnuTLS vulnerability - would use an
                  • all-zero key for encrypting TLS session ticket
                • TLS1.3 -> enables a middleperson attack against resumed sessions
                • TLS1.2 -> enables passive decryption of traffic to/from servers when the
                  • client supports session tickets
                  [USN-4386-1] libjpeg-turbo vulnerability [04:19]
                  • 1 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
                    • CVE-2020-13790
                    • Heap buffer over-read via crafted PPM file -> info disclosure / crash
                      • [USN-4385-1] Intel Microcode vulnerabilities [04:49]
                      • 3 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Eoan (19.10), Focal (20.04 LTS)
                        • CVE-2020-0549
                        • CVE-2020-0548
                        • CVE-2020-0543
                        • Latest Intel microarchitectural cache side-channel vulnerabilities - L1D
                          • cache, vector registers, special registers
                        • https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SRBDS
                        • Special register buffer data sampling (SRBDS) -> RDRAND, RDSEED etc ->
                          • aka CrossTalk -> micro-arch buffer is shared across cores so old values
                          could be read by other processors
                        • microcode clears buffers -> performance decrease for RDRAND etc as a
                          • result -> kernel update contains support for a kernel command-line arg to
                          disable this mitigation
                          [USN-4387-1] Linux kernel vulnerabilities [07:25]
                          • 5 CVEs addressed in Bionic (18.04 LTS), Eoan (19.10)
                            • CVE-2020-12659
                            • CVE-2020-12464
                            • CVE-2020-12114
                            • CVE-2020-0543
                            • CVE-2020-0067
                            • 5.3
                            • Kernel command-line option to disable SRBDS mitigation
                            • F2FS bounds check fail on xattrs -> OOB read -> info leak
                            • USB scatter-gather UAF -> malicious USB device -> crash / RCE
                            • XDP socket fail to validate userspace metadata -> OOB write -> requires
                              • CAP_NET_ADMIN
                              [USN-4388-1] Linux kernel vulnerabilities [08:40]
                              • 6 CVEs addressed in Bionic (18.04 LTS)
                                • CVE-2020-1749
                                • CVE-2020-12659
                                • CVE-2020-12464
                                • CVE-2020-12114
                                • CVE-2020-0543
                                • CVE-2020-0067
                                • 5.0 gke & oem
                                  • [USN-4389-1] Linux kernel vulnerabilities [08:54]
                                  • 6 CVEs addressed in Focal (20.04 LTS)
                                    • CVE-2020-10751
                                    • CVE-2020-12659
                                    • CVE-2020-12464
                                    • CVE-2020-12114
                                    • CVE-2020-0543
                                    • CVE-2020-0067
                                    • 5.4
                                      • [USN-4390-1] Linux kernel vulnerabilities [09:02]
                                      • 6 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS)
                                        • CVE-2020-10751
                                        • CVE-2020-1749
                                        • CVE-2020-12464
                                        • CVE-2020-12114
                                        • CVE-2020-0543
                                        • CVE-2020-0067
                                        • 4.15 (14.04 ESM azure, 16.04 LTS - hwe, 18.04 LTS
                                          • all)
                                        • As above + IPsec fail to encrypt IPv6 in some conditions -> info leak
                                          • [USN-4391-1] Linux kernel vulnerabilities [09:35]
                                          • 8 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS)
                                            • CVE-2020-10751
                                            • CVE-2020-1749
                                            • CVE-2020-12826
                                            • CVE-2020-12769
                                            • CVE-2020-12464
                                            • CVE-2020-12114
                                            • CVE-2020-0543
                                            • CVE-2019-19319
                                            • 4.4
                                              • [USN-4392-1] Linux kernel vulnerabilities [09:46]
                                              • 3 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM)
                                                • CVE-2020-12114
                                                • CVE-2020-0543
                                                • CVE-2020-12654
                                                • 3.13
                                                  • [USN-4393-1] Linux kernel vulnerabilities [09:46]
                                                  • 2 CVEs addressed in Precise ESM (12.04 ESM)
                                                    • CVE-2020-0543
                                                    • CVE-2020-12654
                                                    • 3.2
                                                      • Goings on in Ubuntu Security Community
                                                      Joe and Alex discuss Threat Modelling via STRIDE [10:12]
                                                      • https://en.wikipedia.org/wiki/STRIDE_(security)
                                                      • https://threatmodelingbook.com/
                                                        • Get in contact
                                                        • [email protected]
                                                        • #ubuntu-security on the Libera.Chat IRC network
                                                        • ubuntu-hardened mailing list
                                                        • Security section on discourse.ubuntu.com
                                                        • @ubuntu_sec on twitter
                                                          • ...more
                                                          View all episodesView all episodes
                                                          Download on the App Store
                                                          Ubuntu Security PodcastBy Ubuntu Security Team
                                                          • 4.8
                                                          • 4.8
                                                          • 4.8
                                                          • 4.8
                                                          • 4.8

                                                          4.8

                                                          10 ratings