Ubuntu Security Podcast

Latest Episodes:

Episode 133 Oct 01, 2021

Show notes

Overview

This week we look at a Wifi lookalike attack dubbed “SSID stripping” plus updates for ca-certificates, EDK II, Apache, the Linux kernel and even vim!

This week in Ubuntu Security Updates

28 unique CVEs addressed

[USN-5086-1] Linux kernel vulnerability [00:50]

Affecting Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
s390x BPF JIT verifier bypass - no CVE assigned

[USN-5085-1] SQL parse vulnerability [01:33]

1 CVEs addressed in Hirsute (21.04)
- CVE-2021-32839
ReDoS via exponential backtracking with a large amount of carriage-return, newline combinations

[USN-5087-1] WebKitGTK vulnerabilities [02:18]

1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
- CVE-2021-30858
UAF in underlying webkit - originally reported by Apple against their various operating systems - not actually against webkit directly…

[USN-5088-1] EDK II vulnerabilities [02:46]

4 CVEs addressed in Focal (20.04 LTS), Hirsute (21.04)
mix of issues in the embedded openssl in EDK-II plus 2 issues specific to EDK-II itself - one in the handling of Intel Boot Guard which is designed to detect attacks against the static root of trust, in particualr modifification of the initial boot block - an attacker with physical access to the SPI flash chip, could get code execution after the IBB has been validated by then injecting SPI transactions to modify the contents of the IBB in memory

[USN-5089-1, USN-5089-2] ca-certificates update [04:34]

Affecting Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
To also support older devices which don;t have that root cert and when LetsEncrypt started they got their issuing / intermediate cert (R3) signed by IdenTrust’s “DST Root CA X3” root certificate - “cross-signature”
DST Root CA X3 cert expired yesterday (30th Sept 2021)
So if you only had that then any HTTPS connections to a site using a LetsEncrypt cert would fail
Also to support various older Android devices which aren’t getting any updates anymore, IdenTrust issued an updated cross-signature expiring in Sept 2024 so that those Android devices would continue to trust the issuing cert
Nowadays LetsEncrypt has their own root cert “ISRG Root X1” - which is trusted by ca-certificates - this is present on all Ubuntu back to 12.04
But older versions of openssl (1.0.x - xenial, trusty, precise!?!) and gnutls etc would see the cross-signature with an expiry in the future and so return this as a valid chain to validate against - but then when validating the full chain, it would fail as the DST Root CA X3 cert at the root is now expired
Would cause connections to fail still
Solution is to blacklist the DST Root CA X3 as this then ensures the cross-signature is seen as invalid and instead the shorter chain back to LetsEncrypt’s own root cert is used to do the validation

[USN-5090-1, USN-5090-2, USN-5090-3, USN-5090-4] Apache HTTP Server vulnerabilities + regression [07:41]

5 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
HTTP/2 specific issue - crafted method would bypass validation and be forwarded by mod_proxy - so could lead to request splitting / cache poising
NULL pointer dereference triggerable via crafted request
OOB read in mod_proxy_uwsgi - crash / info leak
OOB write in ap_escape_quotes() if given malicious input - modules in apache itself don’t pass untrusted input to this but other 3rd party modules might
crafted request to mod_proxy - forward the request to an origin server as specified in the request - SSRF
- fix for this resulted in more stricter interpretation of SetHandler config option for mod_proxy that broke various configurations using unix sockets - these got interpreted more like URIs and so would be seen as invalid - broke Plesk and others - upstream then issued further fixes which we released in a follow-up

[USN-5091-1] Linux kernel vulnerabilities [09:44]

6 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS)
5.4 (focal / bionic hwe)

[USN-5092-1, USN-5092-2] Linux kernel vulnerabilities [09:56]

12 CVEs addressed in Focal (20.04 LTS), Hirsute (21.04)
5.11 (hirsute, focal hwe)
io_uring (5.1) - unprivileged user - trigger free of other kernel memory - code execution
3 issues in BPF verifier - spectre-like side-channel attacks to leak kernel memory
KVM guest could corrupt host memory on PowerPC - crash / code exec

[USN-5094-1] Linux kernel vulnerabilities [10:39]

6 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS)
4.15 (bionic, xenial hwe, trusty azure)

[USN-5093-1] Vim vulnerabilities [10:57]

3 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
Possible code-execution through 2 different heap buffer overflows and 1 UAF

Goings on in Ubuntu Security Community

SSID stripping attack against various OSes including Ubuntu [11:37]

https://aireye.tech/2021/09/13/the-ssid-stripping-vulnerability-when-you-dont-see-what-you-get/
Combination of lookalike AP name attacks and possible format-string vulns against Windows, MacOS, iOS, Android and Ubuntu
Lookalike SSIDs uses non-printable chars so that user only sees a chosen part of the SSID name rather than the entire thing so gets confused
Similar to domain-name lookalike attacks often used in phishing etc - not really a new problem
No real details on what in Ubuntu is affected (wpa_supplicant, NetworkManager, gnome-shell etc)
Best remediation would be to try and display all chars in some representable format to users but then could still get lookalike names that use these placeholder chars
Hard problem to solve well but given that this doesn’t allow to capture credentials anyway (assuming are using WPA2-PSK since 4-way handshake makes both the client and AP prove they know the PSK without revealing it to each other) then is not really much of a risk
- Only relevant then to unsecured networks but if you are connecting to an unsecured network then there is no security anyway

Hiring [15:54]

1 week break for the Ubuntu Security Podcast

Back in your feed in 2 weeks in the middle of October

Farewell Ubuntu Podcast

https://ubuntupodcast.org

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 132 Sep 24, 2021

Show notes

Overview

Extended Security Maintenance gets an extension, Linux disk encryption and authentication goes under the microscope and we cover security updates for libgcrypt, the Linux kernel, Python, and more.

This week in Ubuntu Security Updates

20 unique CVEs addressed

[USN-5078-2] Squashfs-Tools vulnerabilities [01:02]

2 CVEs addressed in Xenial ESM (16.04 ESM)
- CVE-2021-41072
- CVE-2021-40153
Episode 131

[USN-5080-1, USN-5080-2] Libgcrypt vulnerabilities [01:43]

2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
- CVE-2021-40528
- CVE-2021-33560
Side-channel attacks against the various ElGamal implementations in OpenPGP - https://eprint.iacr.org/2021/923 - researchers from IBM Research Europe
- Patent free public key encryption scheme - popular in OpenPGP - 1 in 6 registered OpenPGP keys have an ElGamal subkey
Various implementations of ElGamal are used in different OpenPGP implementations - Go stdlib, Crypto++ and gcrypt
libgcrypt has previously had other side-channel vulns found and was used in the development of FLUSH+RELOAD attack against GnuPG
This attack exploits the different configurations used in the various implementations to use timing differences to be able to recover plaintext
Fixed to remove support for smaller key lengths and add exponent blinding (combining the exponent with randomness to avoid it being inferred by timing analysis)

[USN-5071-2] Linux kernel (HWE) vulnerabilities [04:11]

5 CVEs addressed in Bionic (18.04 LTS)
AMD nested virtualisation vulns (Episode 130, Episode 131)
2 other KVM vulns - UAF
OOB write in joystick subsystem via a malicious ioctl()
- requires a joystick device to be present
- snaps joystick interface is not auto-connected by default

[USN-5071-3] Linux kernel (Raspberry Pi) vulnerabilities

2 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2021-3612
- CVE-2021-22543

[USN-5082-1] Linux kernel (OEM) vulnerabilities

3 CVEs addressed in Focal (20.04 LTS)
CAN BCM UAF (Episode 121), AMD nested virtualisation

[USN-5073-2] Linux kernel (GCP) vulnerabilities

5 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS)

[USN-5073-3] Linux kernel (Raspberry Pi) vulnerabilities

3 CVEs addressed in Bionic (18.04 LTS)

[USN-5079-3] curl vulnerabilities [06:34]

3 CVEs addressed in Bionic (18.04 LTS)
Episode 131

[USN-5081-1] Qt vulnerabilities [06:49]

2 CVEs addressed in Bionic (18.04 LTS)
- CVE-2021-38593
- CVE-2020-17507
2 issues in graphics / image handling
- crafted XBM trigger OOB read -> crash
- OOB write when rendering SVG or other crafted vector content

[USN-5083-1] Python vulnerabilities [07:22]

2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
- CVE-2021-3737
- CVE-2021-3733
ReDOS - a malicious HTTP server which would send a crafted response for BasicAuth which would cause high CPU usage in trying to match the header value via a regex - fixed to use a simpler regex
Malicious server could cause a client to hang even if the client had set a timeout - server sends a ‘100 Continue’ response and the client would sit there waiting to receive more input which would never arrive (since server is malicious)

[USN-5084-1] LibTIFF vulnerability [08:32]

1 CVEs addressed in Focal (20.04 LTS)
- CVE-2020-19143
Buffer overflow via crafted TIFF file

[USN-5079-4] curl regression [08:42]

2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
- CVE-2021-22947
- CVE-2021-22946
Mistake in backporting patch would cause STARTTLS to fail when used for SMTP only - thanks for tuaris for metioning this on https://ubuntuforums.org/showthread.php?t=2467177 but next time please file a LP bug directly as you will get our attention much faster (and more reliably)

Goings on in Ubuntu Security Community

Authenticated boot and disk encryption on Linux [09:28]

http://0pointer.net/blog/authenticated-boot-and-disk-encryption-on-linux.html
systemd focused review of existing FDE in general purpose Linux distros with pointers to proposed mechanisms to implement authenticated FDE etc
- Laments lack of authenticated initrd, use of TPMs etc
- Proposal is quite different than traditional distros - immutable, authenticated /usr, encrypted, authenticated /etc, /var and per-user /home/user encryption using their own login password
UC20 already does TPM backed FDE with authentication

Ubuntu 14.04 and 16.04 ESM extended [14:16]

https://ubuntu.com/blog/ubuntu-14-04-and-16-04-lifecycle-extended-to-ten-years
Total of 10 years of support (5 LTS, 5 ESM)

RELEASE	RELEASE DATE	END OF LIFE*
Ubuntu 14.04 (Trusty Tahr)	April 2014	April 2024(from April 2022)
Ubuntu 16.04 (Xenial Xerus)	April 2016	April 2026(from April 2024)
Ubuntu 18.04 (Bionic Beaver)	April 2018	April 2028(unchanged)
Ubuntu 20.04 (Focal Fossa)	April 2020	April 2030(unchanged)

Use extra time to plan upgrades

Hiring [15:48]

Linux Cryptography and Security Engineer

https://canonical.com/careers/2612092/linux-cryptography-and-security-engineer-remote

Security Engineer - Ubuntu

https://canonical.com/careers/2925180/security-engineer-ubuntu-remote

Security Product Manager

https://canonical.com/careers/2278145/security-product-manager-remote

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 131 Sep 17, 2021

Show notes

Overview

OWASP Top 10 gets updated for 2021 and we look at security vulnerabilities in the Linux kernel, Ghostscript, Git, curl and more.

This week in Ubuntu Security Updates

26 unique CVEs addressed

[USN-5069-2] mod-auth-mellon vulnerability [00:43]

1 CVEs addressed in Hirsute (21.04)
- CVE-2021-3639
Episode 130 - failed to properly handle crafted redirect links -> open redirect

[USN-5070-1] Linux kernel vulnerabilities

10 CVEs addressed in Focal (20.04 LTS), Hirsute (21.04)

[USN-5071-1] Linux kernel vulnerabilities

5 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS)

[USN-5072-1] Linux kernel vulnerabilities

2 CVEs addressed in Focal (20.04 LTS)
- CVE-2021-3653
- CVE-2021-3656

[USN-5073-1] Linux kernel vulnerabilities [00:56]

5 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS)
2 different AMD specific issue in KVM subsystem with nested virtualisation - 1 mentioned last week in Episode 130 - would fail to validate particular operations which could be performed by a guest VM - in this case would allow a guest to enable the Advanced Virtual Interrupt Controller for a nested VM (ie L2 VM) - this would then allow the L2 VM to write to host memory -> code execution on the host
The other - L1 guest could disable interception of both VMLOAD/VMSAVE calls for a L2 guest - L2 guest could then read/write portions of host physical memory - code-exec on host

[LSN-0081-1] Linux kernel vulnerability [01:56]

4 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS)
(Episode 124) seq_file vuln - this virt file-system contained an unsigned integer conversion error - would result in a local user being able to cause an OOB write and hence possible code-exec in the kernel -> privesc
(Episode 127) netfilter setsockopt() - OOB write
AMD nested virtualisation issues above

[USN-5074-1] Firefox vulnerabilities [02:53]

3 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
Memory safety bugs -> possible memory corruption, possible bypass in mixed content blocking (ie http content on a https page)

[USN-5075-1] Ghostscript vulnerability [03:36]

1 CVEs addressed in Focal (20.04 LTS), Hirsute (21.04)
- CVE-2021-3781
Trivial bypass of sandbox - exploit was apparently known about since March and publicly available since end of August but only reported to GS upstream on 8th August - fix available since 9th, updates for Ubuntu published on 10th (rare Friday publication)

[USN-5076-1] Git vulnerability [04:55]

1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2021-40330
Possible cross-protocol requests by embedding a newline in the URL when cloning

[USN-5077-1, USN-5077-2] Apport vulnerabilities [05:34]

2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
- CVE-2021-3710
- CVE-2021-3709
Arbitrary file reads in apport crash handling - reads certain file when apps crash, can be tricked to read other files and include these in the crash report which can then be seen by the user, uploaded to errors.ubuntu.com etc

[USN-5078-1] Squashfs-Tools vulnerability [06:46]

1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
- CVE-2021-41072
Similar to Episode 129 - symlink and file of same name - when unsquash, write out symlink, then write out file traversing the symlink -> arbitrary file overwrite

[USN-5079-1, USN-5079-2] curl vulnerabilities [07:48]

3 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
- CVE-2021-22947
- CVE-2021-22946
- CVE-2021-22945 (non-ESM only)
MQTT OOB write (malicious MQTT server) (non-ESM)
Possible to cause to not upgrade to TLS even when specified -> info leak
STARTTLS -> could inject responses / intercept comms etc

Goings on in Ubuntu Security Community

OWASP Top 10 updated after 4 years [08:55]

https://owasp.org/Top10/
Last updated in Nov 2017
Increasing complexity of web-apps means vulns are now at the edges - ie. when combining two components, misconfigure one of them -> vuln in combination due to accidential misuse by the other component

Hiring [13:11]

Linux Cryptography and Security Engineer

https://canonical.com/careers/2612092/linux-cryptography-and-security-engineer-remote

Security Engineer - Ubuntu

https://canonical.com/careers/2925180/security-engineer-ubuntu-remote

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 130 Sep 10, 2021

Show notes

Overview

This week we discuss compiler warnings as build errors in the Linux kernel, plus we look at security updates for HAProxy, GNU cpio, PySAML2, mod-auth-mellon and more.

This week in Ubuntu Security Updates

15 unique CVEs addressed

[USN-5051-4] OpenSSL regression [00:51]

1 CVEs addressed in Trusty ESM (14.04 ESM)
- CVE-2021-3712
Episode 129
Original backport of patch contained a typo which introduced a regression where ASN1_STRINGs would fail to print in some cases

[USN-5062-1] Linux kernel vulnerability [01:20]

1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
- CVE-2021-3653
AMD specific issue in KVM subsystem with nested virtualisation - would fail to validate particular operations which could be performed by a guest VM - in this case would allow a guest to enable the Advanced Virtual Interrupt Controller for a nested VM (ie L2 VM) - this would then allow the L2 VM to write to host memory -> code execution on the host

[USN-5063-1] HAProxy vulnerabilities [02:40]

1 CVEs addressed in Focal (20.04 LTS), Hirsute (21.04)
- CVE-2021-40346
Integer overflow in handling of header name lengths - most significant bit of header name length could slip into the LSB of header value length - could then craft a valid request that would inject a dummy content-length on input, this would then be reproduced on the output as well as the original correct header length - can then get a “blind” request smuggling attack since the extra request bypasses ACL checking etc

[USN-5064-1] GNU cpio vulnerability [04:13]

1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
- CVE-2021-38185
Integer overflow -> heap buffer overflow in the handling of pattern files - this allows to specify a file which contains a list of patterns to match against filenames in the cpio archive which should be extracted - is not clear if can easily abuse this as a remote attacker since would need to be able to supply a crafted pattern file and have this get used but these are not often used in practice

[USN-5065-1] Open vSwitch vulnerability [05:08]

1 CVEs addressed in Focal (20.04 LTS), Hirsute (21.04)
- CVE-2021-36980
UAF in decoding of RAW_ENCAP actions - remote attacker could craft one -> crash / RCE..?

[USN-5066-1, USN-5066-2] PySAML2 vulnerability [05:39]

1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
- CVE-2021-21239
pysaml2 uses xmlsec1 binary to validate cryptographic signatures on SAML documents
By default xmlsec will accept any type of key found in the document to verify the signature - so an attacker could embed their own signature using just a HMAC and this would get validated as correct without even consulting the X509 cert which should be used to validate the document - simple fix to just change the CLI arguments to xmlsec1 to specify that it should validate based on x509 certs

[USN-5067-1] SSSD vulnerabilities [07:06]

4 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
Possible shell command injection via the sssctl binary using the logs-fetch and cache-expire subcommands - if could trick root into running crafted commands could then get root… - was as a result of using the system() syscall which evaluates a string to the shell - so allows shell command injection directly - was fixed to instead use fork() + execvp() on an array of arguments - which doesn’t go via the shell to run the specified subcommand
common pattern for security vulns, something we specifically look for when auditing packages as part of the security review for MIRs

[USN-5069-1] mod-auth-mellon vulnerability [08:54]

1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2021-3639
SAML2 auth module for Apache
Failed to filter URLS that start with /// - an attacker could craft a URL that specified a particular URL via the ReturnTo parameter and this would then automatically redirect the user to that crafted URL - so could be used for phishing attacks that look more trustworthy. ie. an attacker creates a phishing site that copies the victim site at their own domain. they then send an email to a user asking them to login and they specify a URL to the real victim site but with the ReturnTo parameter set to their own site - a user looking at this URL will see it specifies the real site so won’t be concerned - when they visit it they get automatically redirected to the victim site - so if they don’t then check the URL they will start logging into the fake phishing site and not the real one - fixed to just reject these URLs so they don’t get abused by the redirect process

[USN-5068-1] GD library vulnerabilities [10:24]

4 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
Crafted image files -> OOB read / write - crash / code exec
One in TGA handling but others in the proprietary GD/GD2 formats which upstream say is now deprecated so shouldn’t get a CVE - recommend if you are processing GD/GD2 image files from untrusted sources that you stop as upstream may stop issuing updates for these / may not get CVEs

Goings on in Ubuntu Security Community

Linux kernel enables -Werror [11:33]

Initially enabled by default, in response to patches from Kees Cook @ Google which introduced a bunch of new warnings - Linus wants a clean build
Lots of push back since this then immediately broke a heap of CI systems as there a lots of existing bits of kernel code that generates warnings - and depending on what config options you enable you compile different bits of code so can see or not see various warnings - and hence different architectures etc - even having a different locale / LANG setting can result in different compiler warnings as Kees found due to the nature of some of the tests
Given the huge codebase with so many different configurations is almost impossible to test them all and find all the various warnings, let alone actually fix them
For years folks have been trying to drive down the warnings but is still a hard and ongoing effort
As such, ended up changing this to a suggestion from Marco Elver (also at Google) to enable this when COMPILE_TEST is enabled - this used as a flag to tell the kernel to compile everything even if it is not being used - and is then often used by CI systems / developers which explicitly want to compile everything who work on detecting new warnings
Is a lofty goal and is very useful from a security PoV and is illustrative of many real world efforts that try and introduce static analysis etc for an existing codebase
Immediately get a high number of ’errors’ now that need to be addressed - was fine before? - so how to introduce these in a way that doesn’t impose a huge upfront cost but still incentivizes fixing them over time and allows to detect new issues
Is good to see a focus on this in a more tangible way from upstream as compiler warnings are there for a reason and should not be ignored

Hiring

Linux Cryptography and Security Engineer

https://canonical.com/careers/2612092/linux-cryptography-and-security-engineer-remote

Security Engineer - Ubuntu

https://canonical.com/careers/2925180/security-engineer-ubuntu-remote

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 129 Sep 03, 2021

Show notes

Overview

This week we look at a malware campaign associated with the popular Krita painting application, plus we cover security updates for MongoDB, libssh, Squashfs-Tools, Thunderbird and more.

This week in Ubuntu Security Updates

17 unique CVEs addressed

[USN-5037-2] Firefox regression [00:47]

Affecting Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
91.0.2 - upstream bug where as part of their advanced privacy protection, would purge cookies associated with ad trackers etc - but this would then clear authentication data as well and so would lose your master password for Lockwise - and hence prompt the re-enter it seemingly randomly.

[USN-5052-1] MongoDB vulnerability [01:31]

1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2019-2386
Failed to invalidate existing sessions of users who are logged in and their account is then deleted - so if the account is recreated before they perform some action, the session gets reassociated with the new account of the same name which may have higher privileges.

[USN-5051-2, USN-5051-3] OpenSSL vulnerability [02:14]

1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS)
- CVE-2021-3712
Episode 128 - ASN.1 string handling vuln

[USN-5053-1] libssh vulnerability [02:42]

1 CVEs addressed in Focal (20.04 LTS), Hirsute (21.04)
- CVE-2021-3634
Small SSH lib - used by libcurl, remmina and others
Heap buffer overflow when re-keying - so a malicious client / server could cause crash / RCE on other side

[USN-5055-1] GNOME grilo vulnerability [03:22]

1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
- CVE-2021-39365
GNOME media discovery framework
Failed to enable TLS certificate verification - so when connecting to a remote media source, an attacker could replace the TLS cert with their own self-signed one or similar and hence be able to intercept all encrypted comms - simple change to specify to the underlying network request library (libsoup) to check TLS certificate when making the connection

[USN-5056-1] APR vulnerability [04:18]

1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Hirsute (21.04)
- CVE-2021-35940
abstraction layer library across platform specific services / APIs
used by apache2, subversion and others
OOB read in time handling functions - would fail to validate parameters were within expected range (ie only 12 months in a year but uses a signed int to represent this)

[USN-5054-1] uWSGI vulnerability [05:38]

1 CVEs addressed in Bionic (18.04 LTS)
- CVE-2020-11984
Buffer overflow in handling of large HTTP request headers - protocol represents header name/values and overall length in a uint16_t = so can only handle up to 16K headers so if more than that would cause an integer overflow and hence a buffer overread where it would read other memory instead of the actual request body

[USN-5057-1] Squashfs-Tools vulnerability [06:34]

1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
- CVE-2021-40153
Failed to reject filenames in squashfs image containing relative path components - using a crafted mksquashfs could create such an image and then unsquashfs would happy create that file, outside of the extracted directory - path traversal vuln

[USN-5058-1] Thunderbird vulnerabilities [08:14]

10 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
78.13
STARTTLS vuln - would accept IMAP responses received before had finished STARTTLS handshake - PiTM inject content etc - plus various vulns from Firefox re web rendering etc

[USN-5060-1, USN-5060-2] NTFS-3G vulnerabilities [09:51]

Affecting Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
A heap of vulns - 21 in total - integer overflows, buffer overflows etc - code execution, DoS etc - unlike say EXT4 and other drivers, this is FUSE so impact is limited to only user-level code execution, not root / in-kernel

Goings on in Ubuntu Security Community

Krita Ransomware Email Campaign [11:17]

Emails sent to popular youtubers / facebook / instagrammers purportedly from Krita asking to collaborate on a paid advertising and a link to download some media pack - proposed videos to show on your youtube channel etc
The link is to krita.app or perhaps krita.io - not the official “krita.org” domain - looks the same as the real krita.org but is only just the homepage, other pages have redirects to the real krita.org
Download contains an encrypted zip file (alarm bell**)
Video part has 3 seeming videos - 2 .mp4.scr files and one actual mp4 - (second alarm bell**) .scr is really an exe - and a few vendors on VT already detects these as malicious - but a lot don’t
Interesting to see an open source app being used to target content creators - seems both krita.app / krita.io now redirect to krita.org and the mediabank.zip is now longer up either
https://krita.org/en/item/warning-scam-mails-about-krita-and-youtube-coming-from-krita-io/

Hiring [15:50]

Linux Cryptography and Security Engineer

https://canonical.com/careers/2612092/linux-cryptography-and-security-engineer-remote

Security Engineer - Ubuntu

https://canonical.com/careers/2925180/security-engineer-ubuntu-remote

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 128 Aug 27, 2021

Show notes

Overview

This week we dive into Trend Micro’s recent Linux Threat Report and the release of Ubuntu 20.04.3 LTS, plus we detail security updates for Inetutils telnetd, the Linux kernel and OpenSSL.

This week in Ubuntu Security Updates

9 unique CVEs addressed

[USN-5048-1] Inetutils vulnerability [00:45]

1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2020-10188
Buffer overflow in inetutils telnetd - originally CVE was found in netkit telnetd - but subsequently the GNU inetutils version was also found to contain basically the same vulnerable function. Very detailed blog post re exploiting this on Fedora, great example if you are interested in vuln hunting etc - patched but why run telnetd?
https://appgateresearch.blogspot.com/2020/02/bravestarr-fedora-31-netkit-telnetd_28.html

[USN-5050-1] Linux kernel vulnerabilities [02:03]

6 CVEs addressed in Focal (20.04 LTS)
2 bluetooth HCI UAFs, NFC NULL ptr deref, Xen PV UAF from guest->host, 2 other bluetooth vulns - info leak - all covered in previous episodes

[USN-5051-1] OpenSSL vulnerabilities [02:49]

2 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
- CVE-2021-3712
- CVE-2021-3711
High profile vuln in SM2 algorithm impl in openssl - (Chinese and later ISO standard elliptic curve algo used for both signature and encryption)
- Usual scheme is to call the API function EVP_PKEY_decrypt() twice - call first time to get the required buffer size to hold the decrypted plaintext - second time to do the actual decryption passing a buffer of the specified length to hold the result
- Bug meant the returned length in first call would be smaller than required -> up to 62 byte buffer overflow using attacker controlled data
- Depending on application, could be heap or stack buffer
- Possible RCE
Buffer overread in handling of ASN.1 strings
- ASN1 strings in openssl are represented as the bytes plus a length - unlike normal C strings, bytes array of the string is NOT NUL terminated in general
- However some internal functions would actually add a NUL byte - and other functions ended up assuming ASN1 strings would all be NUL terminated - plus various functions to parse ASN1 data would also add NUL terminators too - so if had an application that was manually constructing ASN1 strings without adding a NUL terminator, this could result in a buffer overread if these were passed to a function which expected a NUL (ie functions which print the contents etc)
- Again depends on application that uses OpenSSL - so not all will be vulnerable - but fixed to ensure all internal functions which handle ASN1 strings in OpenSSL respect the length field and not assume is NUL terminated

Goings on in Ubuntu Security Community

Ubuntu 20.04.3 LTS released [05:58]

https://lists.ubuntu.com/archives/ubuntu-announce/2021-August/000271.html
Desktop installer uses HWE stack by default - Server uses GA but can select HWE during install process
Includes all security etc updates so less to download during / after install
Flavours have also updated
If already running 20.04 then no need to do anything - you already have this :)

Trend Micro Linux Threat Report 2021 1H [07:20]

https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/linux-threat-report-2021-1h-linux-threats-in-the-cloud-and-security-recommendations
Report which collates data from Trend Micro™ Smart Protection Network™ (SPN) (data lake) - collects data across all Trend Micro products plus various honeypots and other sensors etc - measure of real-world malware prevalence and vuln exploitation in enterprises
Linux makes up 61% of Cloud One users - cloud native product for protection of cloud deployments
Ubuntu makes up 16% of that (RH 30%, AWS Linux 18%)
Top threats:
- Coinminers, Web shells, Ransomware, Trojans, other
- For systems which contained these:
  - 51% CentOS, 31% CloudLinux, 10% Ubuntu, 3% RHEL
Intrusion Protection System (IPS) hits:
- 36% Amazon Linux, 23% RHEL 7, 8% CentOS 7, 7% RHEL 6, Amazon Linux, Ubuntu 18.04, 4% Ubuntu 20.04, 16.04
Top 15 vulns with known exploits:
- 5 were in Apache Struts2 - incl. vuln used in Equifax breach in 2017
- 1 each in Drupal, Oracle WebLogic, WordPress file manager plugin, vBulletin, Eclipse Jetty, Alibaba Nacos, Atlassian Jira, NginX, Liferay
  - Most of these are not shipped in Ubuntu but clearly orgs are deploying these sorts of applications on Ubuntu/RHEL etc
Of 20k vulns from 2020, only ~200 were observed with known public exploits
- roughly the same as above but more of the sorts of things we ship and support in Ubuntu
  - struts, netty, drupal, dnsmasq, JIRA, WebLogic, Wordpress, nginx, apache httpd, ISC BIND, openssl, tomcat
76% are attacks against web apps
Looking at OWASP top 10 - of all attack by volume, only 21% fit into OWASP top 10 - ie. SQL injection, command injection, XSS, insecure deserialisation, XML EE,
- Looking at attacks outside OWASP top 10
  - Brute force ~40% of all attacks
  - Directory traversal 21%
  - Request smuggling
Also briefly mentions how to secure Linux but only talks technologies - iptables, seccomp, AppArmor, SELinux etc - and on practical guidance mentions Antimalware (ie Trend 😉), IPS/IDS, application whitelisting, vuln patching, activity monitoring etc
Plus looks a bit at containers - ranks vulns in 15 most popular official docker images - Python comes in on top with 482 vulns, Node 470, Wordpress 402, Golang 288, nginx 118, postgres 86, influxdb 85, apache httpd 84, mysql 76…
- Not surprising perhaps that the more general purpose images have more vulns - more code, more vulns, also perhaps a larger attack surface etc too

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 127 Aug 20, 2021

Show notes

Overview

This week we look at security updates for Firefox, PostgreSQL, MariaDB, HAProxy, the Linux kernel and more, plus we cover some current openings on the team - come join us ☺

This week in Ubuntu Security Updates

35 unique CVEs addressed

[USN-5037-1] Firefox vulnerabilities [00:39]

10 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
91.0
- Better support for clearing cookies to stop possible hidden data leaks as part of the Total Cookie Protection
- Private browsing to use attempt HTTPS by default than fallback to HTTP
- Various security fixes:
  - race condition on DNS resolution specific to Linux -> memory corruption -> crash / RCE
  - also specific to Linux - subsequent permissions dialogs would accept input in the location of the original one - so could possibly trick a user into accepting a permission without their direct knowledge
  - various other memory corruption issues in JIT etc

[USN-3809-2] OpenSSH regression [02:54]

2 CVEs addressed in Bionic (18.04 LTS)
- CVE-2016-10708
- CVE-2018-15473
Episode 11 - possible user enumeration since as a result of patching CVE-2018-15473 the behaviour when trying to log in changed depending on whether the specific user account existed or not - due to a mistake made when backporting the upstream patch

[USN-5038-1] PostgreSQL vulnerabilities [03:38]

2 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
- CVE-2021-3449
- CVE-2021-3677
2 possible remote crasher bugs - one through just sending a crafted TLS ClientHello message -> NULL ptr deref -> crash, the other via the planner which is used to try and optimise SQL queries - possible OOB read

[USN-5022-2] MariaDB vulnerabilities [04:19]

2 CVEs addressed in Focal (20.04 LTS), Hirsute (21.04)
- CVE-2021-2389
- CVE-2021-2372
Episode 124 in MySQL - only 2 of these also were relevant to MariaDB
Like MySQL, update to latest point release in each series - 10.5.12 for hirsute, 10.3.31 for focal - includes both bug and security fixes

[USN-5042-1] HAProxy vulnerabilities [05:07]

Affecting Focal (20.04 LTS), Hirsute (21.04)
HTTP/2 handling issues in HAProxy
Researchers investigated HTTP/2 handling in various gateway / proxies and found multiple issues - HTTP/2 desync attacks - allow to possibly hijack clients, poison caches, and steal credentials
Initially HAProxy upstream thought they were safe but then found after more analysis they were vulnerable to a few of the possible issues
- Can be mitigated by disabling HTTP/2 or just install these updates :)

[USN-5043-1] Exiv2 vulnerabilities [06:04]

11 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
Slew of issues discovered by Kevin Backhouse from Github security team
C++ - so usual mix of issues - OOB read, NULL ptr deref, floating point exception (div/0), infinte loop, assertion failure - all DoS

[USN-5039-1] Linux kernel vulnerability [06:49]

1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)
- CVE-2021-22555
netfilter setsockopt()

[LSN-0080-1] Linux kernel vulnerability [07:08]

1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2021-22555

[USN-5044-1] Linux kernel vulnerabilities [07:39]

3 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS)
4.15 bionic + ESM HWE
2 bluetooth UAF and 1 NFC NULL ptr deref

[USN-5045-1] Linux kernel vulnerabilities [08:06]

4 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS)
5.4 focal + bionic hwe
same as above plus CAN BCM uninitialised memory - info leak to local attacker

[USN-5046-1] Linux kernel vulnerabilities [08:31]

6 CVEs addressed in Focal (20.04 LTS), Hirsute (21.04)
5.11 hirsute + focal hwe
bluetooth UAF, NFC NULL ptr deref, access control issue in bluetooth - could allow a local attacker in range to expose info, xen PV issue - attacker in guest could DoS/RCE on host

Goings on in Ubuntu Security Community

Hiring [09:10]

Linux Cryptography and Security Engineer

https://canonical.com/careers/2612092/linux-cryptography-and-security-engineer-remote

Security Engineer - Ubuntu

https://canonical.com/careers/2925180/security-engineer-ubuntu-remote

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 126 Aug 13, 2021

Show notes

Overview

This week Ubuntu 20.04 LTS was FIPS 140-2 certified plus the AppArmor project made some point releases, and we released security updates for Docker, Perl, c-ares, GPSd and more.

This week in Ubuntu Security Updates

2 unique CVEs addressed

[USN-5031-1] openCryptoki vulnerability [00:54]

Affecting Hirsute (21.04)
PKCS#11 daemon
Bug fix that was deemed to have security implications - so was going to be done via SRU for 21.04 but instead we published via -security to ensure all users received it
Thanks to Simon Chopin from Foundations team for preparing this update

[USN-5032-1, USN-5032-2] Docker vulnerabilities [02:29]

Affecting Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
Backport of the 20.10.7 version from 21.10 to older releases - this includes a bunch of security fixes as well
Unfortunately as this is a version upgrade there are some changes that may break existing containers - in particular, drops support for the aufs storage driver so if you were using this you should upgrade your configuration to use the overlayfs2 storage driver instead - https://docs.docker.com/storage/storagedriver/overlayfs-driver/ - this is a bit involved since you need to export your images, switch the storage driver, then load the images back one after another
Thanks for Lucas Kanashiro from Server team for preparing this update

[USN-5033-1] Perl vulnerability [03:32]

1 CVEs addressed in Hirsute (21.04)
- CVE-2021-36770
Perl Encode library could end up running arbitrary Perl code from the current working directory - was introduced by a change in Encode 3.05 in perl 5.32/5.34 so only affected >= 21.04

[USN-5034-1, USN-5034-2] c-ares vulnerability [03:59]

1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
- CVE-2021-3672
Lib for async name resolution
Failed to properly validate certain hostnames returned from DNS servers - could allow a remote attacker to possibly perform domain hijacking attacks

[USN-5035-1] GPSd vulnerability [04:28]

Affecting Focal (20.04 LTS), Hirsute (21.04)
incorrectly handled certain leap second events which would result in the time jumping back 1024 weeks on 2021-10-31
Upstream don’t consider this a security issue per-se but given how pervasive gpsd is used for handling GPS receivers which are often used for high precision timing or positioning systems (self-driving cars?) - this could have real-world security implications
Backported the fix from upstream - note this only affected gpsd >= 3.20 so older versions in 18.04 LTS etc were not affected
https://lwn.net/Articles/865044/

Goings on in Ubuntu Security Community

AppArmor 3.0.2 / 3.0.3 released [06:39]

Includes bug fixes for various issues plus updates to the policies for things like PHP 8, widevine DRM in firefox, support reading of crypto policies for SSL-using applications
Expected to land 3.0.3 for Ubuntu 21.10 (impish) before FF next week
https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.2
https://gitlab.com/apparmor/apparmor/-/wikis/Release_Notes_3.0.3

FIPS 140-2 certification for Ubuntu 20.04 LTS! [07:44]

Enables organisations to run and develop applications and solutions for the US public sector and Federal government including regulated industries such as healthcare and finance
FIPS 140-2, Level 1 certification crypto modules in Ubuntu 20.04 LTS, including OpenSSL 1.1.1
- Linux kernel (crypto subsystem)
- OpenSSL
- Libgcrypt (used for LUKS for FDE so provides fully certified FDE implementation)
- StrongSwan (IPsec based VPN) *under validation
Available through Ubuntu Advantage and Ubuntu Pro - On public clouds, Ubuntu Pro for AWS and Ubuntu Pro for Azure include subscriptions to Canonical’s FIPS 140-2 repositories, alongside expanded security and hardening.
Future is FIPS 140-3 - aligns with ISO/IEC 19790 (Security requirements for cryptographic modules)
- Existing certifications under FIPS 140-2 have a sunset date of five years from the validation date
- Canonical is preparing Ubuntu for the new certification, and intends to provide FIPS 140-3 certified cryptographic packages on a future release of Ubuntu.
https://ubuntu.com/blog/fips-certification-ubuntu-20-04-lts
Full list of certifications at https://ubuntu.com/security/certifications

Ubuntu 20.04.3 LTS release delayed until August 26th [10:11]

Next point release for 20.04 LTS series - respin of install media with latest security updates etc - includes newest shim - this is now unified across various Ubuntu releases - installation media with this new version fails to boot on certain Dell and Sony Vaio machines - fix for this is in progress, plus the current RISC-V HWE kernel build PANIC’s under certain scenarios
Release team decided to delay the release by 1 week to ensure these bugs can be fixed and new media spun up and tested adequetly before the release
https://discourse.ubuntu.com/t/focal-fossa-20-04-3-lts-point-release-status-tracking/22948

Hiring [11:27]

Linux Cryptography and Security Engineer

https://canonical.com/careers/2612092/linux-cryptography-and-security-engineer-remote

Security Engineer - Ubuntu

https://canonical.com/careers/2925180/security-engineer-ubuntu-remote

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 125 Aug 06, 2021

Show notes

Overview

This week we discuss new kernel memory hardening and security development proposals from Ubuntu Security Alumnus Kees Cook, plus we look at details of security updates for WebKitGTK, libsndfile, GnuTLS, exiv2 and more.

This week in Ubuntu Security Updates

22 unique CVEs addressed

[USN-5024-1] WebKitGTK vulnerabilities [00:57]

13 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
Every 5-10 weeks so time for another one
Usual web / js engine issues - XSS, DoS, RCE etc

[USN-4944-2] MariaDB regression [01:30]

Affecting Focal (20.04 LTS)
Update announced back in Episode 115 - MariaDB intends to be compatible with MySQL but failed to include the caching_sha2_password.so module which is the standard module used to authenticate in MySQL - as such clients would not be able to connect since they expect to use this method to authenticate by default. Upstream MariaDB fixed this in newer versions and this update backports that fix to the version in Ubuntu 20.04

[USN-5025-1, USN-5025-2] libsndfile vulnerability [02:25]

1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
- CVE-2021-3246
Heap buffer overflow in wav decoder - possible RCE / DoS - found by OSSFuzz

[USN-5026-1, USN-5026-2] QPDF vulnerabilities [02:58]

2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2021-36978
- CVE-2018-18020
DoS due to recursive parsing in the face of errors - fixed to instead bail out if encounters too many successive errors as PDF is damaged in this case anyway
Heap buffer overflow from crafted PDF - also found by OSSFuzz

[USN-5027-1, USN-5027-2] PEAR vulnerability [03:50]

1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
- CVE-2021-32610
Symlink path traversal in handling of tar archives in the Archive_Tar module - since PEAR uses this directly when handling archives, it was also vulnerable so could be made to overwrite arbitrary local files on archive extraction and hence get code execution

[USN-5029-1] GnuTLS vulnerabilities [04:22]

2 CVEs addressed in Focal (20.04 LTS)
- CVE-2021-20232
- CVE-2021-20231
2 possible UAF in certain scenarious - hard to exploit as need to be able to predict the behaviour of glibc’s memory allocator as well as GnuTLS’s own internal allocator but could possibly be used for RCE

[USN-5028-1] Exiv2 vulnerability [04:57]

1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04)
- CVE-2021-31291
More exiv2 (last seen in Episode 115 and Episode 117)
Heap buffer overflow in handling of jpeg image metadata - DoS / RCE

[USN-5030-1] Perl DBI module vulnerabilities [05:24]

2 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2020-14393
- CVE-2014-10402
Incomplete fix for previous Perl DBI CVE-2014-10401 - would allow access to files outside the original data source directory - was still potentially vulnerable - fixed to parse attributes more strictly to avoid this
Possible stack buffer overflow if using a really long perl package name as a database driver - unlikely to actually be triggered in practice - used a fixed size stack buffer and memcpy()’d into it without checking bounds - fixed to allocate the buffer on the heap to the exact required size

Goings on in Ubuntu Security Community

Upstream kernel memcpy() hardening [06:31]

https://lwn.net/Articles/864521/
Ubuntu Security Alumnus Kees Cook
Aiming to make memcpy() within the kernel detect when overwriting following structure members
Current kernel memcpy() is able to already detect when writing outside the bounds of a given structure (when the structure size can be known at either compile or run-time) - but can’t handle detecting overwriting of extra members within a structure
Uses the built-in features of GCC plus some C macro smarts to actually allow this to be done in certain circumstances without triggering warnigns - ie in some cases want to actually overwrite following structure members like when handling network packets etc
Most cases are only able to be detected at runtime and since it is not easy to statically determine all these call sites, for now this proposal is warn-only - but in the future the hope is to make it enforcing so it can actually stop possible buffer overflows
Also had this been present it would have detected the 11 previously known memcpy() overflows so shows likely real-world promise as an extra defensive measure

Linux kernel security done right [09:29]

https://security.googleblog.com/2021/08/linux-kernel-security-done-right.html
More from Kees
Makes a strong case for having vendors track either latest released kernel or one of the stable trees - instead of each manually backporting patches etc - duplicated work
Then could devote engineers to working more upstream on testing, hardening etc - which benefit everyone - ie by working upstream on a common platform this reduces duplicated efforts and gains many efficiencies

Hiring [11:50]

Linux Cryptography and Security Engineer

https://canonical.com/careers/2612092/linux-cryptography-and-security-engineer-remote

Security Engineer - Ubuntu

https://canonical.com/careers/2925180/security-engineer-ubuntu-remote

Security - Product Manager

https://canonical.com/careers/2278145/security-product-manager-remote

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 124 Jul 30, 2021

Show notes

Overview It’s another week when too many security updates are never enough as we cover 240 CVE fixes across Avahi, QEMU, the Linux kernel, containerd, binutils and more, plus the Ubuntu 20.10 Groovy Gorilla end-of-life. This week in Ubuntu Security Updates 240 unique CVEs addressed [USN-5008-1, USN-5008-2] Avahi vulnerabilities [00:36] 2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10), Hirsute (21.04) CVE-2021-3502 CVE-2021-3468 2 DoS via local users - first via abusing the Avahi daemon’s unix socket -> hang second by calling asking the avahi daemon to resolve a crafted domain name either via the DBus API or the local socket - assert() -> crash [USN-5006-2] PHP vulnerabilities [01:12] 5 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM) CVE-2021-21705 CVE-2021-21704 CVE-2021-21702 CVE-2020-7071 CVE-2020-7068 Episode 123 [USN-5009-1] libslirp vulnerabilities [01:31] 6 CVEs addressed in Focal (20.04 LTS), Groovy (20.10), Hirsute (21.04) CVE-2021-3595 CVE-2021-3594 CVE-2021-3593 CVE-2021-3592 CVE-2020-29130 CVE-2020-29129 TCP/IP emulation library using by QEMU etc Info leaks from the host to the guest via buffer over-reads in handling of various network packet types (UDP etc) [USN-5010-1] QEMU vulnerabilities [02:07] 21 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10), Hirsute (21.04) CVE-2021-3595 CVE-2021-3594 CVE-2021-3593 CVE-2021-3592 CVE-2021-3608 CVE-2021-3607 CVE-2021-3582 CVE-2021-3546 CVE-2021-3545 CVE-2021-3544 CVE-2021-3527 CVE-2021-3416 CVE-2021-3409 CVE-2021-20257 CVE-2021-20221 CVE-2020-35517 CVE-2021-3392 CVE-2020-35505 CVE-2020-35504 CVE-2020-29443 CVE-2020-15469 Usual mix of vulns in emulation of various devices etc - generally allows a malicious guest to cause QEMU to crash on the host -> DoS MMIO, ATAPI, SCSI, ARM Generic Interrupt Controller, e1000 Mishandling in virtio-fs shared filesystem daemon allows malicious guest to read/write host devices A few others possibly result on code-exec on the host as the QEMU daemon BUT on Ubuntu QEMU is confined via AppArmor by default so this limits the possible impact [LSN-0078-1] Linux kernel vulnerability [03:14] 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2021-3609 Livepatch for CAN BCM UAF -> arbitrary code exec (Episode 121) [USN-5014-1] Linux kernel vulnerability [03:49] 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Hirsute (21.04) CVE-2021-33909 high priority respin seq_file vuln - this virt file-system contained an unsigned integer conversion error - would result in a local user being able to cause an OOB write and hence possible code-exec in the kernel -> privesc [USN-5015-1] Linux kernel (OEM) vulnerabilities [04:28] 5 CVEs addressed in Focal (20.04 LTS) CVE-2021-3587 CVE-2021-3573 CVE-2021-3564 CVE-2021-28691 CVE-2021-33909 5.10 oem seq_file vuln plus a couple UAF in bluetooth, NULL ptr deref in NFC, UAF in Xen networking - guest to host crash/code-exec etc [USN-5016-1] Linux kernel vulnerabilities [04:54] 5 CVEs addressed in Focal (20.04 LTS), Groovy (20.10) CVE-2021-3506 CVE-2021-33034 CVE-2021-32399 CVE-2021-23134 CVE-2021-33909 5.8 - hirsute, focal hwe seq_file vuln plus, NFC UAF, Bluetooth UAFs, F2FS OOB read [USN-5017-1] Linux kernel vulnerabilities [05:26] 3 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2021-0129 CVE-2020-26558 CVE-2021-33909 5.4 - focal, bionic hwe, oem, aws, azure, gcp, gke etc seq_file vuln plus a few bluetooth info leaks [USN-5018-1] Linux kernel vulnerabilities [05:49] 12 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS) CVE-2021-33034 CVE-2021-32399 CVE-2021-31829 CVE-2021-23134 CVE-2021-0129 CVE-2020-26558 CVE-2020-26147 CVE-2020-26139 CVE-2020-24587 CVE-2020-24586 CVE-2021-33200 CVE-2021-33909 4.15 - bionic, xenial hwe, trusty azure seq_file vuln plus various other fixes from recent kernels - eBPF privesc, Wifi FRAGATTACKs fixes, bluetooth info leaks and UAFs and NFC UAF [LSN-0079-1] Linux kernel vulnerability [06:21] 2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2021-33909 CVE-2021-3600 seq_file vuln plus eBPF codeexec [USN-5019-1] NVIDIA graphics drivers vulnerabilities [06:43] 3 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10), Hirsute (21.04) CVE-2021-1095 CVE-2021-1094 CVE-2021-1093 2 DoS - one by triggering an assert(), the other by dereferencing an untrusted pointer - kernel crash in either case OOB array access (OOB read) - info leak or crash -> DoS [USN-5012-1] containerd vulnerabilities [07:23] 1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10), Hirsute (21.04) CVE-2021-32760 When extracting a container image, would try and set the owner/permissions on the resulting extracted files - if these files were symlinks pointing to existing files on the host then would change perms of those files instead - fixed to ensure it does not follow symlinks when applying this permissions changes [USN-5013-1, USN-5013-2] systemd vulnerabilities [08:00] 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10), Hirsute (21.04) CVE-2020-13529 CVE-2021-33910 When parsing mount paths, would allocate memory for the path on the stack - if a local attacker can mount a file-system with a very long path name, would overflow the entire stack memory and cause systemd to crash - as systemd is PID1 this effectively crashes the whole system Remote attacker could cause sytemd DHCP client to force assign a different address and hence could cause a networking DoS against a remote server on the same network by making it unroutable etc [USN-4336-2] GNU binutils vulnerabilities [09:12] 147 CVEs addressed in Xenial ESM (16.04 ESM) CVE-2019-9077 CVE-2019-9075 CVE-2019-9074 CVE-2019-9073 CVE-2019-9071 CVE-2019-9070 CVE-2019-17451 CVE-2019-17450 CVE-2019-14444 CVE-2019-14250 CVE-2019-12972 CVE-2018-9138 CVE-2018-8945 CVE-2018-7643 CVE-2018-7642 CVE-2018-7569 CVE-2018-7568 CVE-2018-7208 CVE-2018-6759 CVE-2018-6543 CVE-2018-6323 CVE-2018-20671 CVE-2018-20623 CVE-2018-20002 CVE-2018-19932 CVE-2018-19931 CVE-2018-18701 CVE-2018-18700 CVE-2018-18607 CVE-2018-18606 CVE-2018-18605 CVE-2018-18484 CVE-2018-18483 CVE-2018-18309 CVE-2018-17985 CVE-2018-17794 CVE-2018-17360 CVE-2018-17359 CVE-2018-17358 CVE-2018-13033 CVE-2018-12934 CVE-2018-12700 CVE-2018-12699 CVE-2018-12698 CVE-2018-12697 CVE-2018-12641 CVE-2018-10535 CVE-2018-10534 CVE-2018-10373 CVE-2018-10372 CVE-2018-1000876 CVE-2017-9954 CVE-2017-9756 CVE-2017-9755 CVE-2017-9754 CVE-2017-9753 CVE-2017-9752 CVE-2017-9751 CVE-2017-9750 CVE-2017-9749 CVE-2017-9748 CVE-2017-9747 CVE-2017-9746 CVE-2017-9745 CVE-2017-9744 CVE-2017-9742 CVE-2017-9044 CVE-2017-9042 CVE-2017-9041 CVE-2017-9040 CVE-2017-9039 CVE-2017-9038 CVE-2017-8421 CVE-2017-8398 CVE-2017-8397 CVE-2017-8396 CVE-2017-8395 CVE-2017-8394 CVE-2017-8393 CVE-2017-7614 CVE-2017-7302 CVE-2017-7301 CVE-2017-7300 CVE-2017-7299 CVE-2017-7227 CVE-2017-7226 CVE-2017-7225 CVE-2017-7224 CVE-2017-7223 CVE-2017-7210 CVE-2017-7209 CVE-2017-6969 CVE-2017-6966 CVE-2017-6965 CVE-2017-17125 CVE-2017-17124 CVE-2017-17123 CVE-2017-17121 CVE-2017-17080 CVE-2017-16832 CVE-2017-16831 CVE-2017-16828 CVE-2017-16827 CVE-2017-16826 CVE-2017-15996 CVE-2017-15939 CVE-2017-15938 CVE-2017-15225 CVE-2017-15025 CVE-2017-15024 CVE-2017-15022 CVE-2017-15021 CVE-2017-15020 CVE-2017-14940 CVE-2017-14939 CVE-2017-14938 CVE-2017-14932 CVE-2017-14930 CVE-2017-14529 CVE-2017-14333 CVE-2017-14130 CVE-2017-14129 CVE-2017-14128 CVE-2017-13710 CVE-2017-12967 CVE-2017-12799 CVE-2017-12459 CVE-2017-12458 CVE-2017-12457 CVE-2017-12456 CVE-2017-12455 CVE-2017-12454 CVE-2017-12453 CVE-2017-12452 CVE-2017-12451 CVE-2017-12450 CVE-2017-12449 CVE-2017-12448 CVE-2016-6131 CVE-2016-4493 CVE-2016-4492 CVE-2016-4491 CVE-2016-4490 CVE-2016-4489 CVE-2016-4488 CVE-2016-4487 CVE-2016-2226 Most CVEs fixed in a single update? binutils gets a lot of CVEs which are generally low priority - ie. objdump could crash or get code-exec if run on untrusted input - but since is installed in a lot of common developer scenarious we often get requests about these CVEs - even though they are unlikely to actually be able to be exploited in most scenarios Thanks to Leo on our team (and Marc for the original backport of a lot of these patches) [USN-5020-1] Ruby vulnerabilities [10:24] 3 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10), Hirsute (21.04) CVE-2021-32066 CVE-2021-31810 CVE-2021-31799 RCE, port scans / banner extractions, interpose on connections to bypass TLS [USN-5021-1] curl vulnerabilities [10:46] 3 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04) CVE-2021-22924 CVE-2021-22925 CVE-2021-22898 Failed to initialise data when handling TELNET connections - if these structures happened to contain sensitive info -> info leak Could reuse connections from the connection pool in the wrong circumstances, leading to reusing wrong connection and sending data to wrong host [USN-5022-1] MySQL vulnerabilities [11:36] 31 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04) CVE-2021-2441 CVE-2021-2440 CVE-2021-2437 CVE-2021-2429 CVE-2021-2427 CVE-2021-2426 CVE-2021-2425 CVE-2021-2424 CVE-2021-2422 CVE-2021-2418 CVE-2021-2417 CVE-2021-2410 CVE-2021-2402 CVE-2021-2399 CVE-2021-2390 CVE-2021-2389 CVE-2021-2387 CVE-2021-2385 CVE-2021-2384 CVE-2021-2383 CVE-2021-2374 CVE-2021-2372 CVE-2021-2370 CVE-2021-2367 CVE-2021-2357 CVE-2021-2356 CVE-2021-2354 CVE-2021-2352 CVE-2021-2342 CVE-2021-2340 CVE-2021-2339 8.0.26 (focal, hirsute) 5.7.35 (bionic) [USN-5023-1] Aspell vulnerability [12:00] 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Hirsute (21.04) CVE-2019-25051 Heap buffer overflow - fixed to actually validate size before using Goings on in Ubuntu Security Community Ubuntu 20.10 Groovy Gorilla EOL [12:25] as of July 22, 2021, Ubuntu 20.10 is no longer supported. No more package updates will be accepted to 20.10 Will be archived to old-releases.ubuntu.com in the coming weeks Upgrade to Hirsute - https://help.ubuntu.com/community/HirsuteUpgrades https://lists.ubuntu.com/archives/ubuntu-security-announce/2021-July/006117.html Get in contact security@ubuntu.com #ubuntu-security on the Libera.Chat IRC network ubuntu-hardened mailing list Security section on discourse.ubuntu.com @ubuntu_sec on twitter

Full show notes at the publisher

Our TOPPODCAST Picks

Follow Us

Stay Connected

Overview

This week in Ubuntu Security Updates

[USN-5086-1] Linux kernel vulnerability [00:50]

[USN-5085-1] SQL parse vulnerability [01:33]

[USN-5087-1] WebKitGTK vulnerabilities [02:18]

[USN-5088-1] EDK II vulnerabilities [02:46]

[USN-5089-1, USN-5089-2] ca-certificates update [04:34]

[USN-5090-1, USN-5090-2, USN-5090-3, USN-5090-4] Apache HTTP Server vulnerabilities + regression [07:41]

[USN-5091-1] Linux kernel vulnerabilities [09:44]

[USN-5092-1, USN-5092-2] Linux kernel vulnerabilities [09:56]

[USN-5094-1] Linux kernel vulnerabilities [10:39]

[USN-5093-1] Vim vulnerabilities [10:57]

Goings on in Ubuntu Security Community

SSID stripping attack against various OSes including Ubuntu [11:37]

Hiring [15:54]

Linux Cryptography and Security Engineer

Security Engineer - Ubuntu

Security Product Manager

1 week break for the Ubuntu Security Podcast

Farewell Ubuntu Podcast

Get in contact

Overview

This week in Ubuntu Security Updates

[USN-5078-2] Squashfs-Tools vulnerabilities [01:02]

[USN-5080-1, USN-5080-2] Libgcrypt vulnerabilities [01:43]

[USN-5071-2] Linux kernel (HWE) vulnerabilities [04:11]

[USN-5071-3] Linux kernel (Raspberry Pi) vulnerabilities

[USN-5082-1] Linux kernel (OEM) vulnerabilities

[USN-5073-2] Linux kernel (GCP) vulnerabilities

[USN-5073-3] Linux kernel (Raspberry Pi) vulnerabilities

[USN-5079-3] curl vulnerabilities [06:34]

[USN-5081-1] Qt vulnerabilities [06:49]

[USN-5083-1] Python vulnerabilities [07:22]

[USN-5084-1] LibTIFF vulnerability [08:32]

[USN-5079-4] curl regression [08:42]

Goings on in Ubuntu Security Community

Authenticated boot and disk encryption on Linux [09:28]

Ubuntu 14.04 and 16.04 ESM extended [14:16]

Hiring [15:48]

Linux Cryptography and Security Engineer

Security Engineer - Ubuntu

Security Product Manager

Get in contact

Overview

This week in Ubuntu Security Updates

[USN-5069-2] mod-auth-mellon vulnerability [00:43]

[USN-5070-1] Linux kernel vulnerabilities

[USN-5071-1] Linux kernel vulnerabilities

[USN-5072-1] Linux kernel vulnerabilities

[USN-5073-1] Linux kernel vulnerabilities [00:56]

[LSN-0081-1] Linux kernel vulnerability [01:56]

[USN-5074-1] Firefox vulnerabilities [02:53]

[USN-5075-1] Ghostscript vulnerability [03:36]

[USN-5076-1] Git vulnerability [04:55]

[USN-5077-1, USN-5077-2] Apport vulnerabilities [05:34]

[USN-5078-1] Squashfs-Tools vulnerability [06:46]

[USN-5079-1, USN-5079-2] curl vulnerabilities [07:48]

Goings on in Ubuntu Security Community

OWASP Top 10 updated after 4 years [08:55]

Hiring [13:11]

Linux Cryptography and Security Engineer

Security Engineer - Ubuntu

Get in contact

Overview

This week in Ubuntu Security Updates

[USN-5051-4] OpenSSL regression [00:51]

[USN-5062-1] Linux kernel vulnerability [01:20]

[USN-5063-1] HAProxy vulnerabilities [02:40]

[USN-5064-1] GNU cpio vulnerability [04:13]

[USN-5065-1] Open vSwitch vulnerability [05:08]

[USN-5066-1, USN-5066-2] PySAML2 vulnerability [05:39]

[USN-5067-1] SSSD vulnerabilities [07:06]

[USN-5069-1] mod-auth-mellon vulnerability [08:54]

[USN-5068-1] GD library vulnerabilities [10:24]

Goings on in Ubuntu Security Community

Linux kernel enables -Werror [11:33]