Ubuntu Security Podcast

Latest Episodes:

Episode 183 Dec 02, 2022

Show notes

Overview This week we look at a recent report from Elastic Security Labs on the global Linux threat landscape, plus we look at a few of the security vulnerabilities patched by the team in the past 7 days. This week in Ubuntu Security Updates 81 unique CVEs addressed [USN-5638-3] Expat vulnerability 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) CVE-2022-43680 [USN-5739-1] MariaDB vulnerabilities 36 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) CVE-2022-32091 CVE-2022-32089 CVE-2022-32088 CVE-2022-32087 CVE-2022-32086 CVE-2022-32085 CVE-2022-32084 CVE-2022-32083 CVE-2022-32082 CVE-2022-32081 CVE-2022-27458 CVE-2022-27457 CVE-2022-27456 CVE-2022-27455 CVE-2022-27452 CVE-2022-27451 CVE-2022-27449 CVE-2022-27448 CVE-2022-27447 CVE-2022-27446 CVE-2022-27445 CVE-2022-27444 CVE-2022-27387 CVE-2022-27386 CVE-2022-27384 CVE-2022-27383 CVE-2022-27382 CVE-2022-27381 CVE-2022-27380 CVE-2022-27379 CVE-2022-27378 CVE-2022-27377 CVE-2022-27376 CVE-2022-21427 CVE-2021-46669 CVE-2018-25032 [USN-5740-1] X.Org X Server vulnerabilities 2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) CVE-2022-3551 CVE-2022-3550 [USN-5736-1] ImageMagick vulnerabilities 17 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Kinetic (22.10) CVE-2022-32547 CVE-2022-32546 CVE-2022-32545 CVE-2022-28463 CVE-2022-1114 CVE-2021-4219 CVE-2021-39212 CVE-2021-3574 CVE-2021-20313 CVE-2021-20312 CVE-2021-20309 CVE-2021-20246 CVE-2021-20245 CVE-2021-20244 CVE-2021-20243 CVE-2021-20241 CVE-2021-20224 [USN-5741-1] Exim vulnerability 1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) CVE-2022-3559 [USN-5742-1] JBIG-KIT vulnerability 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) CVE-2017-9937 [USN-5743-1] LibTIFF vulnerability 1 CVEs addressed in Xenial ESM (16.04 ESM) CVE-2022-3970 [USN-5744-1] libICE vulnerability 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS) CVE-2017-2626 [USN-5745-1, USN-5745-2] shadow vulnerability & regression 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) CVE-2013-4235 Upstream introduced a change in file-system handling in useradd that required newer glibc - broke on older Ubuntu releases so that update has been reverted for now on those releases - still is in place on Ubuntu 22.04 LTS / 22.10 [USN-5689-2] Perl vulnerability 1 CVEs addressed in Kinetic (22.10) CVE-2020-16156 [USN-5746-1] HarfBuzz vulnerability 1 CVEs addressed in Xenial ESM (16.04 ESM) CVE-2015-9274 [USN-5747-1] Bind vulnerabilities 2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM) CVE-2016-6170 CVE-2016-2775 [USN-5748-1] Sysstat vulnerability 1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) CVE-2022-39377 [USN-5728-3] Linux kernel (GCP) vulnerabilities 12 CVEs addressed in Bionic (18.04 LTS) CVE-2022-42719 CVE-2022-40768 CVE-2022-39188 CVE-2022-3635 CVE-2022-3625 CVE-2022-3028 CVE-2022-29901 CVE-2022-2978 CVE-2022-2153 CVE-2022-20422 CVE-2022-41222 CVE-2022-42703 2 high priority vulnerabilities both found by Jann Horn (GPZ) UAF in handling of anonymous VMA mappings UAF in memory management subsytem handling of TLBs both could be exploited by a local attacker to crash the kernel or get possible code execution within the kernel and hence escalate privileges [USN-5749-1] libsamplerate vulnerability 1 CVEs addressed in Xenial ESM (16.04 ESM) CVE-2017-7697 [USN-5750-1] GnuTLS vulnerability 1 CVEs addressed in Xenial ESM (16.04 ESM) CVE-2021-4209 [USN-5718-2] pixman vulnerability 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM) CVE-2022-44638 Goings on in Ubuntu Security Community A look at Elastic Security Labs Global Threat Report https://www.elastic.co/pdf/elastic-global-threat-report-vol-1-2022.pdf Summarises the findings of the Elastic telemetry, which incorporates data from their various products like Endgame, Endpoint and Security solution. 54% of malware on Windows, 39% on Linux, 6% on MacOS Of those, top 10 are: Meterpreter, Gafgyt, Mirai, Camelot, Generic, Dofloo, BPFDoor, Ransomexx, Neshta, Getshell We covered BPFDoor previously Of these 80% are trojan-based, 11% are cryptominers, 4% ransomware Trojans commonly used to deploy stager and dropper binaries as part of wider intrusion effort Cryptominers generally mining Monero - mostly composed of XMRig family Also covers details on Windows and MacOS - interestingly Windows still has lots of CobaltStrike, Metasploit and MimiKatz which are all ostensibly red-team tools - also see lots of keyloggers as well as credential stealers (crypto wallets) Mapped behaviour against MITRE ATT&CK - 34% doing defense evasion, 22% execution, 10% credential access, 8% persistence, 7% C², 6% privesc and 4% initial access of this, masquerading (as another legitimate process) and system binary proxy execution (using existing system binaries to perform malicious actions) accounts for 72% of defense evasion techniques Then dive into more detail on execution techniques (mostly native command and scripting interpreters - think PowerShell, Windows Script Host etc) and abusing Windows Management Instrumentation (WMI) - but won’t go too much into this here as this is the Ubuntu Security Podcast, not Windows ;) Also cover metrics from the various public clouds - AWS had 57% of detections whilst GCP and Azure each had ~22% - why does AWS have so much more? AWS has at least ⅓ of the global cloud market share whilst Azure has 20% and GCP only 11% Also perhaps AWS users prefer to use Elastic? Activities they see most in the clouds are Credential Access, Persistence, Defense Evasion, Initial Access 58% of initial access attempts use brute-force combined with password spraying Report then breaks down each cloud to look at the activities mostly performed in each AWS - access token stealing is top, Azure showed a large usage of valid account access to then attempt to retrieve other access tokens or do phishing, whilst for Google service account abuse was the top Perhaps is more indicative of what each cloud is used for - ie AWS general purpose, whilst Azure is AD and managed services, and Google is service workers Finally, the report does a deep dive on 4 different threat samples and then has forecasts and recommendations based on those Of these most are windows specific, but one does predict that Linux VMs used for backend DevOps in cloud environments will be an increased target This is not really surprising nor novel, and most OSS devs would likely expect this threat given the nature of modern CI/CD pipelines and the follow-up threat to code integrity / supply chain security etc (ie if an attacker can compromise these machines can then tamper with source code / build artefacts etc) As always, requires organisations to have a good security posture and practice good security hygiene - configure for least privilege, audit what you have, deploy defense-in-depth solutions, monitoring and logging so can help detect and have good incident response etc simple things too - deploy MFA, install security updates etc Get in contact security@ubuntu.com #ubuntu-security on the Libera.Chat IRC network ubuntu-hardened mailing list Security section on discourse.ubuntu.com @ubuntusecurity@fosstodon.org, @ubuntu_sec on twitter,

Full show notes at the publisher

Episode 182 Nov 25, 2022

Show notes

Overview After a longer-than-expected break, the Ubuntu Security Podcast is back, covering some highlights of the various security items planned during the 23.04 development cycle, our entrance into the fediverse of Mastodon, some open positions on the team and some of the details of the various security updates from the past week. This week in Ubuntu Security Updates 67 unique CVEs addressed [USN-5726-1] Firefox vulnerabilities [00:45] 19 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2022-45417 CVE-2022-45416 CVE-2022-45415 CVE-2022-45412 CVE-2022-45421 CVE-2022-45420 CVE-2022-45419 CVE-2022-45418 CVE-2022-40674 CVE-2022-45413 CVE-2022-45411 CVE-2022-45410 CVE-2022-45409 CVE-2022-45408 CVE-2022-45407 CVE-2022-45406 CVE-2022-45405 CVE-2022-45404 CVE-2022-45403 Firefox 107.0 apparently includes support for power profiling in Intel CPUs as part of the developer tools [LSN-0090-1] Linux kernel vulnerability [01:16] 6 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-42722 CVE-2022-42721 CVE-2022-42720 CVE-2022-41674 CVE-2022-2602 CVE-2022-1015 Race condition in io_uring -> UAF (from Pwn2Own 2022) OOB write in netfilter - requires CAP_NET_ADMIN but this can be obtained from within an unprivileged user namespace Another example of why the Ubuntu Security team is pushing to disable the use of unprivileged user namespaces by arbitrary processes in future Ubuntu releases Livepatch version information per release canonical-livepatch status Kernel type 22.04 20.04 18.04 aws 90.3 90.2 — aws-5.15 — 90.3 — aws-5.4 — — 90.2 azure 90.2 90.2 — azure-5.4 — — 90.2 gcp 90.3 90.2 — gcp-5.15 — 90.3 — gcp-5.4 — — 90.2 generic-5.4 — 90.2 90.2 gke 90.3 90.2 — gke-5.15 — 90.3 — gke-5.4 — — 90.2 gkeop — 90.2 — gkeop-5.4 — — 90.2 ibm 90.2 90.2 — ibm-5.4 — — 90.2 linux 90.2 — — lowlatency 90.2 — — lowlatency-5.4 — 90.2 90.2 [USN-5727-1] Linux kernel vulnerabilities [02:31] 7 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS) CVE-2022-40768 CVE-2022-36879 CVE-2022-3635 CVE-2022-3028 CVE-2022-2978 CVE-2022-2153 CVE-2022-20422 [USN-5728-1] Linux kernel vulnerabilities 12 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2022-42719 CVE-2022-40768 CVE-2022-39188 CVE-2022-3635 CVE-2022-3625 CVE-2022-3028 CVE-2022-29901 CVE-2022-2978 CVE-2022-2153 CVE-2022-20422 CVE-2022-41222 CVE-2022-42703 [USN-5729-1] Linux kernel vulnerabilities 8 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-40768 CVE-2022-39190 CVE-2022-3635 CVE-2022-3625 CVE-2022-3028 CVE-2022-2978 CVE-2022-2905 CVE-2022-20422 [USN-5727-2] Linux kernel (GCP) vulnerabilities 7 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS) CVE-2022-40768 CVE-2022-36879 CVE-2022-3635 CVE-2022-3028 CVE-2022-2978 CVE-2022-2153 CVE-2022-20422 [USN-5728-2] Linux kernel vulnerabilities 12 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2022-42719 CVE-2022-40768 CVE-2022-39188 CVE-2022-3635 CVE-2022-3625 CVE-2022-3028 CVE-2022-29901 CVE-2022-2978 CVE-2022-2153 CVE-2022-20422 CVE-2022-41222 CVE-2022-42703 [USN-5729-2] Linux kernel vulnerabilities 8 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-40768 CVE-2022-39190 CVE-2022-3635 CVE-2022-3625 CVE-2022-3028 CVE-2022-2978 CVE-2022-2905 CVE-2022-20422 [USN-5730-1] WebKitGTK vulnerabilities [02:41] 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) CVE-2022-42824 CVE-2022-42823 CVE-2022-42799 CVE-2022-32923 CVE-2022-32888 Latest upstream version 2.38.2 fixing various web-engine related vulnerabilities [USN-5731-1] multipath-tools vulnerabilities [03:05] 2 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) CVE-2022-41974 CVE-2022-41973 2 issues discovered by Qualys - one in handling of symlinks in /dev/shm and the other around the handling of UNIX domain sockets - could be combined together with another unspecified vulnerability in a different component installed by default on Ubuntu Server 22.04 to achieve privilege escalation to root - will be interesting to find out what this other vulnerability is in the future [USN-5638-2] Expat vulnerabilities [03:53] 2 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-43680 CVE-2022-40674 [USN-5638-1] Expat vulnerability from Episode 179 [USN-5732-1] Unbound vulnerability [04:02] 1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) CVE-2022-3204 [USN-5686-2, USN-5686-3] Git vulnerabilities 2 CVEs addressed in Xenial ESM (16.04 ESM), Kinetic (22.10) CVE-2022-39260 CVE-2022-39253 [USN-5686-1] Git vulnerabilities from Episode 181 [USN-5733-1] FLAC vulnerabilities 3 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2021-0561 CVE-2020-0499 CVE-2017-6888 [USN-5658-3] DHCP vulnerabilities 2 CVEs addressed in Trusty ESM (14.04 ESM) CVE-2022-2929 CVE-2022-2928 [USN-5716-2] SQLite vulnerability 1 CVEs addressed in Trusty ESM (14.04 ESM) CVE-2022-35737 [USN-5734-1] FreeRDP vulnerabilities [04:15] 8 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) CVE-2022-39347 CVE-2022-39320 CVE-2022-39319 CVE-2022-39318 CVE-2022-39317 CVE-2022-39316 CVE-2022-39283 CVE-2022-39282 [USN-5735-1] Sysstat vulnerability 1 CVEs addressed in Xenial ESM (16.04 ESM) CVE-2022-39377 [USN-5737-1] APR-util vulnerability 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM) CVE-2017-12618 Goings on in Ubuntu Security Community 23.04 Ubuntu Security roadmap [04:52] Since the last podcast in Episode 181, had both the 23.04 start-of-cycle product roadmap sprint and engineering sprints in Prague (followed by the Ubuntu Summit) Some of the highlights for the Ubuntu Security team’s 23.04 roadmap Tabletop exercises Improvements to OVAL data Various AppArmor improvements including user namespace mediation across the distro, plus working with upstream kernel developers on io_uring mediation Security improvements for Ubuntu Core including better integrity verification Usual security and other ongoing maintenance tasks CVE patching, MIR package reviews, Snap Store security reviews, FIPS maintenance and more A heap of customer specific / commercially sensitive stuff too Will talk more about a lot of these topics in future episodes Hiring [08:46] Security Engineer - Ubuntu https://canonical.com/careers/2925180 Engineer position in the security maintenance team Linux Cryptography and Security Engineer https://canonical.com/careers/4717512 Engineer in the security certifications team Ubuntu Security Manager https://canonical.com/careers/4192903 One requisition, looking to fill multiple different manager positions - Security Maintenance, Security Certifications and Security Technologies teams The Ubuntu Security Team is now part of the Mastodon Fediverse [10:10] @ubuntusecurity@fosstodon.org With all the recent drama on twitter, decided to establish a presence on the fosstodon.org Mastodon instance as well Mastodon is similar to twitter but instead of being one single centralised service, consists of multiple federated servers - so a user on one server can follow users on other servers - but allows different communities to have their own servers if desired Appears to be a good alternative to Twitter Will operate both and try to keep the two in-sync Get in contact security@ubuntu.com #ubuntu-security on the Libera.Chat IRC network ubuntu-hardened mailing list Security section on discourse.ubuntu.com @ubuntusecurity@fosstodon.org, @ubuntu_sec on twitter,

Full show notes at the publisher

Episode 181 Oct 21, 2022

Show notes

Overview It’s the release of Ubuntu 22.10 Kinetic Kudu, and we give you all the details on what’s new and improved, with a particular focus on the security features, plus we cover a high priority vulnerability in libksba as well. This week in Ubuntu Security Updates 39 unique CVEs addressed [USN-5672-1] GMP vulnerability 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2021-43618 [USN-5673-1] unzip vulnerabilities 3 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-0530 CVE-2022-0529 CVE-2021-4217 [USN-5674-1] XML Security Library vulnerability 1 CVEs addressed in Xenial ESM (16.04 ESM) CVE-2017-1000061 [USN-5675-1] Heimdal vulnerabilities 4 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2022-3116 CVE-2021-3671 CVE-2019-12098 CVE-2018-16860 [USN-5677-1] Linux kernel vulnerabilities 11 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2022-36879 CVE-2022-33744 CVE-2022-33742 CVE-2022-33741 CVE-2022-33740 CVE-2022-3176 CVE-2022-26373 CVE-2022-26365 CVE-2022-2318 CVE-2022-20369 CVE-2021-4159 [USN-5678-1] Linux kernel vulnerabilities 9 CVEs addressed in Bionic (18.04 LTS) CVE-2022-33744 CVE-2022-33742 CVE-2022-33741 CVE-2022-33740 CVE-2022-26365 CVE-2022-2318 CVE-2022-32296 CVE-2022-1012 CVE-2022-0812 [USN-5679-1] Linux kernel (HWE) vulnerabilities 9 CVEs addressed in Xenial ESM (16.04 ESM) CVE-2022-33744 CVE-2022-33742 CVE-2022-33741 CVE-2022-33740 CVE-2022-26365 CVE-2022-2318 CVE-2022-32296 CVE-2022-1012 CVE-2022-0812 [USN-5676-1] PostgreSQL vulnerability 1 CVEs addressed in Xenial ESM (16.04 ESM) CVE-2022-1552 [USN-5680-1] gThumb vulnerabilities 2 CVEs addressed in Focal (20.04 LTS) CVE-2020-36427 CVE-2019-20326 [USN-5682-1] Linux kernel (AWS) vulnerabilities 11 CVEs addressed in Bionic (18.04 LTS) CVE-2022-36879 CVE-2022-33744 CVE-2022-33742 CVE-2022-33741 CVE-2022-33740 CVE-2022-3176 CVE-2022-26373 CVE-2022-26365 CVE-2022-2318 CVE-2022-20369 CVE-2021-4159 [USN-5683-1] Linux kernel (IBM) vulnerabilities 16 CVEs addressed in Jammy (22.04 LTS) CVE-2022-39189 CVE-2022-36946 CVE-2022-36879 CVE-2022-34495 CVE-2022-34494 CVE-2022-33744 CVE-2022-33743 CVE-2022-33742 CVE-2022-33741 CVE-2022-33740 CVE-2022-3176 CVE-2022-26373 CVE-2022-26365 CVE-2022-2318 CVE-2022-1882 CVE-2021-33655 [USN-5684-1] Linux kernel (Azure) vulnerabilities 9 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM) CVE-2022-33744 CVE-2022-33742 CVE-2022-33741 CVE-2022-33740 CVE-2022-26365 CVE-2022-2318 CVE-2022-32296 CVE-2022-1012 CVE-2022-0812 [USN-5570-2] zlib vulnerability 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-37434 [USN-5685-1] FRR vulnerabilities 2 CVEs addressed in Jammy (22.04 LTS) CVE-2022-37035 CVE-2022-37032 [USN-5686-1] Git vulnerabilities 2 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-39260 CVE-2022-39253 [USN-5687-1] Linux kernel (Azure) vulnerabilities 9 CVEs addressed in Bionic (18.04 LTS) CVE-2022-33744 CVE-2022-33742 CVE-2022-33741 CVE-2022-33740 CVE-2022-26365 CVE-2022-2318 CVE-2022-32296 CVE-2022-1012 CVE-2022-0812 [USN-5688-1] Libksba vulnerability [01:24] 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-3515 libksba library used to parse and build ASN.1 objects contained within S/MIME, X.509 certificates etc ASN.1 supports various encoding formats - BER, DER (basic and distinguised encoding rules respectively) Both use a tag-length-value scheme to encode objects When copying these objects around, would copy both a header as well as the object itself - if an object was really large, the sum of the header size plus the object would overflow - allowing a size check to be bypassed (since when overflowing wraps around to be a small sized integer) Integer overflow leading to a buffer overflow Considered a severe bug by upstream in Ubuntu is used by gpgsm (used to handled SMIME signed data) and dirmngr - responsible for parsing and loading CRLS and verifying certs used by TLS Goings on in Ubuntu Security Community Ubuntu 22.10 Kinetic Kudu release [04:02] https://ubuntu.com/blog/canonical-releases-ubuntu-22-10-kinetic-kudu kernel 5.19 security wise Faster RNG (entropy extraction switched from SHA1 to BLAKE2) Support for Intel Trust Domain Extensions (TDX) successor to SGX, builds on lessons learned virtualisation based confidential computing environment equivalent to an SGX enclave uses a new processor mode called SEAM allows to deploy legacy applications without having to adapt them a different programming model as was done for SGX AppArmor support for posix-mq and unprivileged user namespace mediation idea is that only applications which are running under an AppArmor profile with permission to user userns will be able to - unconfined will not - this kernel configuration is disabled by default but can be enabled via a sysctl: then unconfined applications will not be able to use them helps limit an attack surface for exploits - 4 out of 5 pwn2own exploits against Ubuntu this year used unprivileged userns as part of their attack chain sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=1 Desktop pipewire is now default instead of pulseaudio - improved bluetooth handling GNOME 43 - gedit replaced by gnome-text-editor, gnome-terminal still there but likely will be new gnome-console in 23.04 LibreOffice 7.4 FF 106/ TB 102 Updated bluez, CUPS, network-manager, Mesa 22 etc Server socket-activated SSH daemon to reduce memory footprint inside containers etc improved support for integration with Windows Server w/ LDAP channel binding and LDAP signing in cyrus-sasl2 bind9 support for remote TLS verification in both named and dig to allow to implement strict and mutual TLS authentication updated containerd, runc, docker.io updated qemu - improved emulation of RISC-V, s390x updated libvirt - ppc64 Power10 processor support For developers: debuginfod updated gcc, Go, Ruby and Rust toolchains Canonical Product Roadmap + Engineering Sprints + Ubuntu Summit [12:32] No podcast for the next 3 weeks Thanks and farewell to Shaun Murphy [13:45] Get in contact security@ubuntu.com #ubuntu-security on the Libera.Chat IRC network ubuntu-hardened mailing list Security section on discourse.ubuntu.com @ubuntu_sec on twitter

Full show notes at the publisher

Episode 180 Oct 14, 2022

Show notes

Overview Ubuntu Pro beta is announced and we cover all the details with Lech Sandecki and Eduardo Barretto, plus we cover security updates for DHCP, kitty, Thunderbird, LibreOffice, the Linux kernel, .NET 6 and more. This week in Ubuntu Security Updates 49 unique CVEs addressed [USN-5658-1] DHCP vulnerabilities [00:53] 2 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-2929 CVE-2022-2928 2 different DoS against ISC DHCP server a client could send a lease query to the server which would fail to properly decrement a reference count and hence eventually could overflow the reference counter -> abort -> DoS memory leak could be triggered by a client sending a crafted DHCP packet with a FQDN label longer than 64 bytes - eventually would run out of memory -> crash -> DoS [USN-5659-1] kitty vulnerabilities [01:45] 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-41322 CVE-2020-35605 Cross-platform, fast, feature-rich, GPU based terminal Includes support for image display, but if it failed to read an image file then would display an error message containing the file name - as such, could craft the name of the filename to then inject terminal control characters and hence arbitrary input into the shell itself and hence execute arbitrary code Also supports showing desktop notifications via OSC escape codes - ie. a shell script or even a file could output these and kitty would interpret that to show a desktop notification. Also includes support for actions on notifications through a named notification id. However, would also fail to sanitize these ids, again allowing terminal control characters to be injected and hence arbitrary code to be executed if the user were to then click on a notification popup requires an attacker can get the user to display arbitrary content, and then for the user to click the notification [USN-5657-1] Graphite2 vulnerability [03:16] 1 CVEs addressed in Xenial ESM (16.04 ESM) CVE-2018-7999 NULL pointer deref via crafted ttf [USN-5663-1] Thunderbird vulnerabilities [03:27] 12 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-36059 CVE-2022-3033 CVE-2022-3034 CVE-2022-3032 CVE-2022-38478 CVE-2022-38477 CVE-2022-38476 CVE-2022-38473 CVE-2022-38472 CVE-2022-36319 CVE-2022-36318 CVE-2022-2505 102.2.2 DoS against the inbuilt Matrix client 2 different methods to cause TB to make a network request when an email was opened - both via html within an iframe - allows sender to track whether the email was opened etc Various web framework issues via rendering untrusted content - DoS, mount pointer and addressbar spoofing, RCE etc [USN-5371-3] nginx vulnerability [04:22] 3 CVEs addressed in Xenial ESM (16.04 ESM) CVE-2021-3618 CVE-2020-36309 CVE-2020-11724 HTTP request smuggling, first covered back in [USN-5371-1] nginx vulnerabilities in Episode 157 [USN-5666-1] OpenSSH vulnerability [04:35] 1 CVEs addressed in Xenial ESM (16.04 ESM) CVE-2021-41617 Failed to properly drop permissions when executing helper commands for AuthorizedKeysCommand and AuthorizedPrincipalsCommand and so would run these with group membership of the sshd process itself (even if configured to run as a different user) As such is a form of privilege escalation - low impact since is a non-default configuration [USN-5665-1] PCRE vulnerabilities [05:19] 2 CVEs addressed in Xenial ESM (16.04 ESM) CVE-2017-7186 CVE-2017-6004 2 different OOB read via crafted regexs -> DoS [USN-5661-1] LibreOffice vulnerabilities [05:31] 3 CVEs addressed in Focal (20.04 LTS) CVE-2022-26307 CVE-2022-26306 CVE-2022-26305 Document macros have been a common attack vector for Microsoft Office To mitigate this, can configure to only execute macros which have a trusted signature Failed to properly validate these (would only verify that the certificate for the signature had the same serial number and issuer string of the trusted certificate) - instead has to actually compare the hash of the certificate itself as well Also has its own password database for storing authentication info for various web connections A couple issues existing when encrypting the master key which result in it being much easier to crack the encryption via a brute force attack than should otherwise be - a local attacker with access to a user’s LibreOffice config (and hence PW DB) could potentially get access to their credentials as used by LO [USN-5660-1] Linux kernel (GCP) vulnerabilities [07:02] 6 CVEs addressed in Bionic (18.04 LTS) CVE-2022-36946 CVE-2022-2503 CVE-2022-1729 CVE-2022-32296 CVE-2022-1012 CVE-2021-33655 5.4 GCP on Ubuntu 18.04 LTS Most of these have seen in previous weeks - framebuffer driver OOB when changing font/screen sizes -> DoS/codeexec, perf race-condition -> UAF -> DoS/codeexec, netfilter remote DoS via crafted packet causing truncation below packet header size, lack of good enough IP source port randomisation allows a malicious TCP server to identify a host by the chosen source port, dm-verity DoS/code execution by bypassing LoadPin restrictions to load untrusted kernel modules / firmware (but requires root privileges in the first place) x*** [USN-5667-1] Linux kernel vulnerabilities [08:01] 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-39189 CVE-2022-36879 CVE-2022-3176 CVE-2022-26373 CVE-2022-1882 5.15 22.04 GA / 20.04 HWE - generic/clouds/lowlatency/raspi etc race condition -> UAF in internal pipe impl -> DoS/codeexec speculative execution vuln - Enhanced Indirect Branch Restricted Speculation (eIBRS) on some processors did not properly handle RET instructions in some cases - local attacker could read sensitive info as a result io_uring UAF netlink xfrm ref counting bug -> underflow -> OOPS -> DoS Unpriv guest user can compromise guest kernel since KVM failed to properly handle TLB flushing in some cases [USN-5668-1] Linux kernel vulnerabilities [09:07] 11 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2022-36879 CVE-2022-33744 CVE-2022-33742 CVE-2022-33741 CVE-2022-33740 CVE-2022-3176 CVE-2022-26373 CVE-2022-26365 CVE-2022-2318 CVE-2022-20369 CVE-2021-4159 5.4 20.04 GA / 18.04 HWE More of the same [USN-5669-1, USN-5669-2] Linux kernel vulnerabilities [09:18] 9 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS) CVE-2022-33744 CVE-2022-33742 CVE-2022-33741 CVE-2022-33740 CVE-2022-26365 CVE-2022-2318 CVE-2022-32296 CVE-2022-1012 CVE-2022-0812 4.15 18.04 GA / 16.04 ESM HWE [USN-5670-1] .NET 6 vulnerability [09:27] 1 CVEs addressed in Jammy (22.04 LTS) CVE-2022-41032 Patch Tuesday! EoP via NuGet Client to allow a local attacker to get code execution [USN-5671-1] AdvanceCOMP vulnerabilities [09:44] 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS) CVE-2019-8383 CVE-2019-8379 recompression utils NULL ptr deref + heap buffer overflow could be triggered by opening a crafted files Goings on in Ubuntu Security Community Ubuntu Pro Beta overview with Lech Sandecki and Eduardo Barretto [10:08] Hinted at briefly back in Preparing for the release of Ubuntu Pro [09:44] https://ubuntu.com/blog/ubuntu-pro-beta-release https://ubuntu.com/pro https://youtu.be/tHXL2_QTRwo We want your feedback: https://discourse.ubuntu.com/c/ubuntu-pro/116 Lech is hosting a webinar on 25th October 2022 16:00 UTC (5pm UK time, 12pm EDT) https://ubuntu.com/engage/introduction-to-ubuntu-pro Get in contact security@ubuntu.com #ubuntu-security on the Libera.Chat IRC network ubuntu-hardened mailing list Security section on discourse.ubuntu.com @ubuntu_sec on twitter

Full show notes at the publisher

Episode 179 Sep 30, 2022

Show notes

Overview Finer grained control for unprivileged user namespaces is on the horizon for Ubuntu 22.10, plus we cover security updates for PCRE, etcd, OAuthLib, SoS, Squid and more. This week in Ubuntu Security Updates 37 unique CVEs addressed [USN-5626-2] Bind vulnerabilities [00:40] 2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM) CVE-2022-38177 CVE-2022-2795 [USN-5626-1] Bind vulnerabilities from Episode 178 [USN-5627-1] PCRE vulnerabilities [01:01] 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-1587 CVE-2022-1586 2 OOB read with crafted regexes - possible info leak [USN-5628-1] etcd vulnerabilities [01:19] 4 CVEs addressed in Focal (20.04 LTS) CVE-2020-15114 CVE-2020-15113 CVE-2020-15112 CVE-2020-15106 distributed key/value store used by kubernetes all these vulns come from a security audit conducted by Trail of Bits in January of 2020. performed both manual and automated review -> go-sec, errcheck, ineffassign etc also fuzzed the WAL file handling (write-ahead logging - used to record transactions that have been committed but not yet applied to the main database) 2 issues in WAL file handling (crash), plus one in handling of directory permissions for a directory that may already exist (info leak) and one in setup of endpoints that could allow a DoS [USN-5630-1, USN-5639-1] Linux kernel vulnerabilities [02:45] 6 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2022-36946 CVE-2022-2503 CVE-2022-1729 CVE-2022-32296 CVE-2022-1012 CVE-2021-33655 5.4 Raspi HWE 18.04 LTS / Azure CVM 20.04 LTS Same set of vulnerabilities covered in last weeks episode - [USN-5622-1] Linux kernel vulnerabilities [USN-5633-1, USN-5635-1, USN-5640-1, USN-5644-1] Linux kernel vulnerabilities [03:09] 11 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-36946 CVE-2022-34495 CVE-2022-34494 CVE-2022-33744 CVE-2022-33743 CVE-2022-33742 CVE-2022-33741 CVE-2022-33740 CVE-2022-26365 CVE-2022-2318 CVE-2021-33655 5.15 Raspi + GKE/GCP + Oracle + GCP (20.04) [USN-5634-1] Linux kernel (OEM) vulnerability [03:23] 1 CVEs addressed in Jammy (22.04 LTS) CVE-2022-36946 5.17 OEM netfilter remote DoS via crafted packet with a very short payload [USN-5632-1] OAuthLib vulnerability [03:40] 1 CVEs addressed in Jammy (22.04 LTS) CVE-2022-36087 OAuth implementation for Python3 - used by various other applications like keystone, django, duplicity DoS via a malicious redirect URL specifying an IPv6 address - could trigger an exception -> application crash -> DoS [USN-5631-1] libjpeg-turbo vulnerabilities [04:05] 4 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2021-46822 CVE-2020-35538 CVE-2020-17541 CVE-2018-11813 Various issues in handling of crafted JPEG/PPM files - stack buffer overflow, heap buffer overflow, NULL pointer dereference, resource consumption based DoS in cjpeg utility - crafted file with a valid Targa header but incomplete data - would keep trying pixel after reaching EOF - internally used getc() which returns the special value EOF when the end of file is reached - this is actually -1 but requires the caller to check for this special value - if not, would interpret this as pixel data (all bits set -> 255,255,255 -> white) resulting in JPEG file that was possibly thousands of times bigger than the input file - fixed to use existing input routines to read the data which already check for EOF condition [USN-5629-1] Python vulnerability [05:54] 1 CVEs addressed in Xenial ESM (16.04 ESM) CVE-2021-28861 Open redirect in http.server through a URI which has multiple / at the beginning - a URI such as //path gets treated as an absolute URI rather than a path - could then end up sending a 301 location header with a misleading target Upstream dispute this - state that it should not be used in production as it only implements basic security checks [USN-5636-1] SoS vulnerability [06:39] 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-2806 sosreport - used to gather details of a system etc for debug/analysis Redacts passwords - previously used a hardcoded list of possible things that could contain passwords - instead now looks for anything with the name password and redacts that [USN-5637-1] libvpx vulnerability [07:45] 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM) CVE-2020-0034 OOB read -> info leak / crash [USN-5638-1] Expat vulnerability [07:55] 1 CVEs addressed in Xenial ESM (16.04 ESM) CVE-2022-40674 UAF with crafted XML content -> crash / RCE [USN-5641-1] Squid vulnerabilities [08:06] 2 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-41318 CVE-2022-41317 Failed to properly handle ACLs for cache manager, allowing a trusted client to read other client ids / credentials and internal network structure Integer overflow -> buffer overread when using SSPI/SMB authentication helpers for NTLM authentication - since this is in handling of credentials, could allow an attacker to read decrypted user credentials or other memory regions from Squid [USN-5642-1] WebKitGTK vulnerabilities [08:57] 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-32886 Buffer overflow when handling malicious web content -> RCE [USN-5643-1] Ghostscript vulnerabilities [09:18] 2 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-2085 CVE-2020-27792 2 issues in PDF file handling NULL pointer dereference -> DoS heap buffer overflow -> DoS / RCE Goings on in Ubuntu Security Community Ubuntu 22.10 (Kinetic Kudu) Beta Released [09:45] https://lists.ubuntu.com/archives/ubuntu-announce/2022-September/000284.html Includes details on how to upgrade - as per when we covered the Ubuntu 22.04.1 release - if you do want to upgrade to the beta, and you are using 22.04 desktop, then first log out, switch to a virtual console (Ctrl-Alt-F2) and run it from there as less chance that it takes down your whole graphical session and hence the upgrade process partway through Will cover in more detail when the final release comes out in a few weeks Preview of planned unprivileged user namespace restrictions in Ubuntu 22.10 [11:05] Often has been a source of increased attack surface for the kernel Disabling of unpriv userns has often been recommended to mitigate various kernel vulns This is done via sysctl in Ubuntu: sudo sysctl kernel.unprivileged_userns_clone=0 Big hammer - either on or off Various applications have legitimate uses of unpriv userns flatpak / bubblewrap etc some of these ship a helper application which is setuid root so they can still use user namespaces but this then creates another attack surface - the setuid-root binary instead it would be better to have a way to only allow particular applications to use unprivileged user namespaces and then deny it to others would provide much finer grained control to this potentially risky feature AppArmor developers have added support for just this all unconfined applications would be denied and only confined applications which have the userns permission would be allowed For now, it is planned to have this disabled by default for 22.10 AppArmor will have a sysctl to enable it so can be tested Security team will work on getting the various packages within the Ubuntu archive that require unprivileged user namespaces to be confined by AppArmor and hence allowed to use them during the next development cycle With any luck, 23.04 will ship with this enabled along with AppArmor confinement for things like bubblewrap etc that require this capability Snaps will get it for free since they are confined by AppArmor out of the box John Johansen is working with the kernel team to land this in the kernel for 22.10 Georgia Garcia is working on the userspace side to add support for creating policy that specifies the userns permission in apparmor package too Hopefully can all land both via the FeatureFreezeException (FFe) process Ubuntu Security Podcast on break for 1 week Get in contact security@ubuntu.com #ubuntu-security on the Libera.Chat IRC network ubuntu-hardened mailing list Security section on discourse.ubuntu.com @ubuntu_sec on twitter

Full show notes at the publisher

Episode 178 Sep 23, 2022

Show notes

Overview You can’t test your way out of security vulnerabilities (at least when writing your code in C), plus we cover security updates for Intel Microcode, vim, Wayland, the Linux kernel, SQLite and more. This week in Ubuntu Security Updates 68 unique CVEs addressed [USN-5606-2] poppler regression [00:45] Affecting Xenial ESM (16.04 ESM), Bionic (18.04 LTS) [USN-5606-1] poppler vulnerability from Episode 177 - integer overflow in JBIG2 decoder When backporting the series of patches, missed one that updated the CMakeLists.txt to ensure a new header file that was added as part of the security update is actually installed by the libpoppler-dev package - without this if installed the update and then tried to recompile something locally it would fail [USN-5612-1] Intel Microcode vulnerability [01:29] 1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-21233 Latest upstream Intel Microcode release (IPU 2022.2) - only security relevant for SGX [USN-5613-1, USN-5613-2] Vim vulnerabilities [01:54] 7 CVEs addressed in Trusty ESM (14.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-1621 CVE-2022-1620 CVE-2022-1619 CVE-2022-1616 CVE-2022-1420 CVE-2022-1154 CVE-2022-0943 Various buffer overflows and the like that could be triggered when editing crafted files - have said in the past that vim is fast becoming one of the most security-patched packages in Ubuntu - all driven by their bug-bounty https://huntr.dev/repos/vim/vim/ [USN-5614-1] Wayland vulnerability [02:17] 1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2021-3782 Reference count overflow - used a 32-bit int to count the number of references - but on a 64-bit machine it is quite possible that a malicious client could allocate a huge amount of buffers to overflow and then possibly get a UAF - highly unlikely to be able to exploit in practice since would also need a large number of connections to the compositor as well - fixed by limiting the max number of objects that can be allocated [USN-5615-1] SQLite vulnerabilities [03:01] 3 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2021-20223 CVE-2020-35527 CVE-2020-35525 NULL ptr deref, OOB read, unicode parsing issue - disputed by upstream as an actual vuln Has such a large amount of tests - https://www.sqlite.org/testing.html for 151 KSLOC has 92,038 KSLOC of tests -> 608 times as much code in tests that the actual library itself 4 different test harnesses, 100% branch coverage, OOM tests, I/O error tests, fuzz tests, boundary conditions, regression tests, valgrind, UB etc yet still has new vulns discovered every now and then you can’t test your way out of security issues - at least when you write your code in C which has just too many different operations that have UB you can perhaps do it via formal methods (seL4 etc) but is very expensive.. $200-400/LoC eg. to formally prove SQLite would then cost ~$18.4M-$36.8M use rust? would hopefully help at least for the first 2 issues - can still have logic flaws and hence security vulns (eg. failing to properly validate a TLS cert or similar) [USN-5616-1] Linux kernel (Intel IoTG) vulnerabilities [06:00] 10 CVEs addressed in Jammy (22.04 LTS) CVE-2022-2959 CVE-2022-2873 CVE-2022-2503 CVE-2022-1973 CVE-2022-1943 CVE-2022-1852 CVE-2022-1729 CVE-2022-32296 CVE-2022-1012 CVE-2021-33061 5.15 Some of these have covered previously Intel 10GbE PCI Express driver, IP source port randomisation failure, perf UAF, KVM NULL ptr deref, various file-system OOB R/W etc [USN-5621-1] Linux kernel vulnerabilities [06:32] 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS) 4.15 GA 18.04 LTS, HWE 16.04 ESM CVE-2022-36946 CVE-2021-33655 console framebuffer and netfilter OOB writes covered in previous episodes [USN-5622-1] Linux kernel vulnerabilities [06:57] 6 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2022-36946 CVE-2022-2503 CVE-2022-1729 CVE-2022-32296 CVE-2022-1012 CVE-2021-33655 5.4 GA 20.04 LTS / HWE 18.04 LTS x*** [USN-5624-1] Linux kernel vulnerabilities [07:05] 11 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-36946 CVE-2022-34495 CVE-2022-34494 CVE-2022-33744 CVE-2022-33743 CVE-2022-33742 CVE-2022-33741 CVE-2022-33740 CVE-2022-26365 CVE-2022-2318 CVE-2021-33655 5.15 GA 22.04 LTS / Azure 20.04 LTS [USN-5623-1] Linux kernel (HWE) vulnerabilities [07:12] 21 CVEs addressed in Focal (20.04 LTS) CVE-2022-36946 CVE-2022-34495 CVE-2022-34494 CVE-2022-33744 CVE-2022-33743 CVE-2022-33742 CVE-2022-33741 CVE-2022-33740 CVE-2022-2959 CVE-2022-2873 CVE-2022-26365 CVE-2022-2503 CVE-2022-2318 CVE-2022-1973 CVE-2022-1943 CVE-2022-1852 CVE-2022-1729 CVE-2022-32296 CVE-2022-1012 CVE-2021-33655 CVE-2021-33061 5.15 20.04 HWE all the vulns mentioned earlier plus a bunch in Xen (kernel side) - impact ranges from crashing guest and exposing its memory to DoS services on the host [USN-5617-1] Xen vulnerabilities [07:45] 20 CVEs addressed in Focal (20.04 LTS) CVE-2020-25604 CVE-2020-25603 CVE-2020-25602 CVE-2020-25601 CVE-2020-25600 CVE-2020-25599 CVE-2020-25597 CVE-2020-25596 CVE-2020-25595 CVE-2020-15567 CVE-2020-15566 CVE-2020-15565 CVE-2020-15564 CVE-2020-15563 CVE-2020-11743 CVE-2020-11742 CVE-2020-11741 CVE-2020-11740 CVE-2020-11739 CVE-2020-0543 Community contributed update for xen - almost wins the award for the most CVEs patched in a single update for this week Most issues allow a malicious guest to attack the host -> DoS, privesc, code-exec etc [USN-5619-1] LibTIFF vulnerabilities [08:17] 7 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-2058 CVE-2022-2057 CVE-2022-2056 CVE-2022-1355 CVE-2022-1354 CVE-2020-19144 CVE-2020-19131 Another package vying for most security updates recently Usual memory corruption issues when handling crafted files - stack / heap buffer overflows etc [USN-5618-1] Ghostscript vulnerability [08:49] 1 CVEs addressed in Xenial ESM (16.04 ESM) CVE-2020-27792 Heap buffer overflow when parsing a crafted PDF [USN-5626-1] Bind vulnerabilities [08:58] 6 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-38178 CVE-2022-38177 CVE-2022-3080 CVE-2022-2906 CVE-2022-2881 CVE-2022-2795 Memory leaks when handling certain crypto algorithms with DNSSEC, resource-based DoS, buffer over-read -> info leak / crash, assertion-based crash via crafted query [USN-5625-1] Mako vulnerability [09:22] 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-40023 ReDoS via crafted content Goings on in Ubuntu Security Community Preparing for the release of Ubuntu Pro [09:44] Team has worked on this for the last few years - finally will see the light of day in the coming week or two - more details to come Get in contact security@ubuntu.com #ubuntu-security on the Libera.Chat IRC network ubuntu-hardened mailing list Security section on discourse.ubuntu.com @ubuntu_sec on twitter

Full show notes at the publisher

Episode 177 Sep 16, 2022

Show notes

Overview

Alex talks with special guests Nishit Majithia and Matthew Ruffell about a recent systemd regression on Ubuntu 18.04 LTS plus we cover security updates for Dnsmasq, the Linux kernel, poppler, .NET 6, rust-regex and more.

This week in Ubuntu Security Updates

28 unique CVEs addressed

[USN-4976-2] Dnsmasq vulnerability [00:55]

1 CVEs addressed in Xenial ESM (16.04 ESM)
- CVE-2021-3448
[USN-4976-1] Dnsmasq vulnerability for Episode 118
Failed to properly randomise source port (ie used a fixed port) when forwarding queries when configured to use a specific server for a given network interface - could then allow a remote attacker to more easily perform cache poisoning attacks (ie just need to guess the transmission ID once know the source port to get a forged reply accepted)
- As I said back in Episode 118, this is very similar to the issues that were discovered back in 2008 by Dan Kaminsky - the whole reason source port randomisation was introduced as part of the DNS protocol

[USN-5604-1] LibTIFF vulnerabilities [03:13]

3 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM)

[USN-5606-1] poppler vulnerability [03:23]

1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS)
- CVE-2022-38784
Integer overflow in JBIG2 decoder -> heap buffer overflow via crafted PDF / JBIG2 image - very similar to CVE-2022-38171 in xpdf
- poppler started life as a fork of code from xpdf-3.0 but now has diverged so much that in general a vuln in one cannot be assumed to exist in the other, hence the separate CVE IDs for these two vulns

[USN-5607-1] GDK-PixBuf vulnerability [04:11]

1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- CVE-2021-44648
Heap buffer overflow when decoding lzw compressed stream from GIF files

[USN-5608-1] DPDK vulnerability [04:26]

1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS)
- CVE-2022-2132
Crafted Vhost header could cause a DoS

[USN-5609-1] .NET 6 vulnerability [04:39]

1 CVEs addressed in Jammy (22.04 LTS)
- CVE-2022-38013
DoS in .NET Core - “a malicious client could cause a stack overflow which may result in a denial of service attack when an attacker sends a customized payload that is parsed during model binding”
https://devblogs.microsoft.com/dotnet/september-2022-updates/
Updates to latest upstream release 6.0.109

[USN-5583-2] systemd regression [05:16]

1 CVEs addressed in Bionic (18.04 LTS)
- CVE-2022-2526
Mentioned in passing in both the last 2 weeks episodes

[USN-5610-1] rust-regex vulnerability

1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- CVE-2022-24713
ReDoS in regex crate - already includes various mitigations against DoS via untrusted regexes (and these can be tuned by users of the crate) - however was able to be bypassed by a regex that specified an empty subexpression that should be matched up to say 294 million times - this then gets compiled but is able to evade the existing mitigations since doesn’t take any memory - but it does take a lot of CPU time
Fixed by changing code such that it will take a fake amount of memory for each empty subexpression and therefore will trip the existing detection logic in a reasonable amount of time

[USN-5611-1] WebKitGTK vulnerability [06:53]

1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
- CVE-2022-32893
OOB write via malicious web content - Apple reported that this was being actively exploited for iOS users (Safari uses Webkit)

Goings on in Ubuntu Security Community

Discussion of the recent systemd regression in Ubuntu 18.04 LTS with Nishit Majithia and Matthew Ruffell [07:49]

Gathered media attention
https://thenewstack.io/ubuntu-linux-and-azure-dns-problem-gives-azure-fits/
Matthew is from the Sustaining Engineering Team at Canonical - I talked about his blog in Analysis of the dovecat and hy4 Linux Malware - from Episode 97

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 176 Sep 09, 2022

Show notes

Overview

On this week’s episode we dive into the Shikitega Linux malware report from AT&T Alien Labs, plus we cover security updates for the Linux kernel, curl and Zstandard as well as some open positions on the team. Join us!

This week in Ubuntu Security Updates

13 unique CVEs addressed

[USN-5591-1, USN-5591-2, USN-5591-3, USN-5591-4, USN-5597-1, USN-5598-1] Linux kernel (+ HWE, AWS, Oracle) vulnerability [00:47]

1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS)
- CVE-2021-33656
OOB write in virtual terminal driver when changing VGA console fonts - covered back in USN-5580-1 - Linux kernel (AWS) vulnerabilities - in Episode 175

[USN-5592-1, USN-5595-1, USN-5596-1, USN-5600-1] Linux kernel (+ OEM, HWE) vulnerabilities [01:04]

2 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS)
- CVE-2021-33656
- CVE-2021-33061
OOB write in virtual terminal driver when changing VGA console fonts
Improper control flow mgmt in Intel 10GbE PCIe driver - local DoS

[USN-5594-1, USN-5599-1] Linux kernel (+ Oracle) vulnerabilities [01:28]

9 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS)
Above issues plus:
- NULL pointer deref in KVM on host if a VM tried to execute an illegal instruction
- OOB write in UDF file-system driver
- UAF in NFTS under certain error conditions
- OOB write in Intel SMBus host controller driver
- Race condition in handling of pipe buffers -> OOB

[USN-5587-1] curl vulnerability [02:12]

1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS)
- CVE-2022-35252
Cookies generally contain NAME=VALUE pairs using ASCII chars for both
ASCII character set contains usual A-Za-z0-9 and punctuation (space, “!#&) plus a bunch of control codes - NUL, BEL, LF, CR, HT (\t) and more
These have a byte value below 32
curl since 4.9 would accept cookies with control codes
As with cookies, these get sent back to the server on subsequent requests
Over time web servers have started rejecting cookies with control codes and returning a HTTP 400 response code (Bad Request)
As such, a malicious “sister site” could return a cookie with control codes inside it, this then would get sent by curl to other sites in the same domain, which would then reject the request and effectively DoS the user
Fixed to have curl validate and then reject such cookies in the first place

[USN-5593-1] Zstandard vulnerability [04:34]

1 CVEs addressed in Xenial ESM (16.04 ESM)
- CVE-2019-11922
Originally discussed all the way back in Episode 44 - [USN-4108-1] Zstandard vulnerability
Race condition when using single-pass compression, might allow attacker to get OOB write IF the caller had provided a smaller output buffer than the recommended size
So likely won’t affect all packages which use zstd (there are many) - should always follow best practice

Goings on in Ubuntu Security Community

AT&T Alien Labs teardown of Shikitega Linux malware [05:40]

https://cybersecurity.att.com/blogs/labs-research/shikitega-new-stealthy-malware-targeting-linux
Targets endpoints and IoT devices running Linux
Uses multiple different binaries to achieve its purpose - each does one task of the process
Uses various components of Metasploit along the way
- Framework containing various exploits plus different tools to help develop exploits as well as scan environments etc
Initial dropper is a very small binary that is encoded using one of the standard Metasploit encoders to help it evade detection from AV scanners etc
Decodes basic shellcode to open a socket to the C2 server and downloads additional shellcode to run plus the mettle interpreter so that it can make use of off-the-shelf components from Metasploit in further stages
Also downloads the next stage dropper
This again is encoded the same as the first component - contained within is shellcode to spawn a shell via /bin/sh - from this shell it then attempts to run commands to exploit two known privesc vulns - CVE-2021-4034 ([USN-5252-1, USN-5252-2] PolicyKit vulnerability from Episode 147) and CVE-2021-3493 ([USN-4916-2] Linux kernel vulnerability in Episode 113)
Once has gained root privileges via these vulns, with then move on to achieve persistence and execute the primary payload - cryptominer
Persistence is achieved simply by using cron to download the cryptominer from C2 on boot - and then another cron job to execute the cryptominer - and this is done for both the standard user and root
As such the only traces left on the machine at reboot is the crontabs
cryptominer is the XMRig and is configured to mine Monero
C2 is seemingly fronted by cloudflare and cloudfront
No details provided on initial compromise but is good to see details on the privesc vulns - both of these were patched in Ubuntu quite a while ago - and we released a Livepatch for the kernel privesc too - shows the value in such services - can still stay protected against the kind of vulnerabilities that attackers are actually exploiting without the need to reboot
Shows the increasing prevalence of Linux malware (and the resulting interest in it from organisations like AT&T) but also the value in ensuring systems are kept updated

systemd/open-vm-tools regression for Ubuntu 18.04 LTS [10:56]

Had mentioned last week that I would likely cover this - is still a work-in-progress so hopefully next week 🤞

Hiring [11:30]

https://canonical.com/careers/engineering?search=security
Security Certifications Product Manager
- Home based, EMEA
Security Engineer - Ubuntu
- Home based, worldwide
Ubuntu Security Manager
- Home based, worldwide

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Episode 175 Sep 02, 2022

Show notes

Overview An increased rate of CVEs in curl is a good thing, and we’ll tell you why, plus we cover security updates for the Linux kernel, Firefox, Schroot, systemd and more. This week in Ubuntu Security Updates 37 unique CVEs addressed [USN-5474-2] Varnish Cache regression [00:43] 1 CVEs addressed in Focal (20.04 LTS) CVE-2020-11653 USN-5474-1 from Episode 164 incomplete fix in original update - required additional patches from upstream - thanks to community member who reported this and provided the associated debdiff to fix it [USN-5572-2, USN-5579-1] Linux kernel vulnerabilities [01:27] 3 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM) CVE-2022-33741 CVE-2022-33740 CVE-2022-26365 4.4 AWS 14.04 ESM + 4.4 generic etc 16.04 ESM + 14.04 ESM 3 issues in Xen PV drivers - all memory management issues See USN-5572-1 from Episode 174 [USN-5580-1] Linux kernel (AWS) vulnerabilities [01:54] 4 CVEs addressed in Xenial ESM (16.04 ESM) CVE-2022-36946 CVE-2022-20368 CVE-2021-33656 CVE-2021-33655 4.4 AWS 16.04 ESM One of these is an OOB write in the framebuffer driver - covered previously in USN-5577-1 in Episode 174 Others: OOB write in virtual terminal driver when changing VGA console fonts OOB read in Packet network protocol -> info leak Assertion failure (-> kernel panic) in netfilter when handling rules which truncate packets below their header size -> remote DoS [USN-5582-1] Linux kernel (Azure CVM) vulnerabilities [02:42] 11 CVEs addressed in Focal (20.04 LTS) CVE-2022-28893 CVE-2022-1975 CVE-2022-1974 CVE-2022-1734 CVE-2022-1679 CVE-2022-1652 CVE-2022-1048 CVE-2022-0494 CVE-2022-2586 CVE-2022-2588 CVE-2022-34918 Azure Confidential Virtual Machines - implements FDE so that contents is protected from VM host 5.4 kernel 3 high priority vulns that allow a local unpriv user to privesc - first covered back in USN-5557-1 in Episode 172 - all in netfilter / network packet scheduler subsystems [USN-5588-1] Linux kernel vulnerability [03:43] 1 CVEs addressed in Trusty ESM (14.04 ESM) CVE-2022-2588 3.13 GA [USN-5589-1] Linux kernel vulnerabilities [03:56] 2 CVEs addressed in Focal (20.04 LTS) CVE-2021-33656 CVE-2021-33061 5.4 GA/OEM/Raspi/lowlatency OOB write in virtual terminal driver mentioned earlier Improper control flow mgmt in Intel 10GbE PCIe driver - local DoS [USN-5590-1] Linux kernel (OEM) vulnerability [04:24] 1 CVEs addressed in Focal (20.04 LTS) CVE-2022-36946 5.14 OEM Assertion failure on netfilter rules that truncate packets below their header size mentioned earlier [USN-5578-2] Open VM Tools vulnerability [04:34] 1 CVEs addressed in Xenial ESM (16.04 ESM) CVE-2022-31676 Privesc within guest - USN-5578-1 from Episode 174 [USN-5581-1] Firefox vulnerabilities [04:57] 5 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS) CVE-2022-38478 CVE-2022-38477 CVE-2022-38475 CVE-2022-38473 CVE-2022-38472 104.0 - usual mix of browser security issues - DoS, chrome UI spoofing, bypass security restrictions, RCE via malicious web content [USN-5584-1] Schroot vulnerability [05:25] 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-2787 Not a tool that is normally used by most users / customers - BUT is used by many Ubuntu developers - interesting avenue for a supply chain attack perhaps? DoS via crafted schroot names - one user could launch a schroot with a crafted name that would then result in schroot corrupting its internal state and then stopping it from launching any more schroot sessions for any other users on the machine [USN-5586-1] SDL vulnerability [07:05] 1 CVEs addressed in Xenial ESM (16.04 ESM) CVE-2022-34568 UAF in handling of crafted video content on X11 [USN-5583-1] systemd vulnerability [07:14] 1 CVEs addressed in Bionic (18.04 LTS) CVE-2022-2526 Possible UAF when handling crafted DNS requests -> crash / RCE Ask me about this one next week 😉 [USN-5585-1] Jupyter Notebook vulnerabilities [07:44] 8 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS) CVE-2022-29238 CVE-2022-24758 CVE-2020-26215 CVE-2019-9644 CVE-2019-10856 CVE-2019-10255 CVE-2018-21030 CVE-2018-19351 Another community contributed update - fixes various issues such as XSS, open redirect, info leak etc Goings on in Ubuntu Security Community Increased CVE activity in curl [08:09] https://daniel.haxx.se/blog/2022/08/22/increased-cve-activity-in-curl/ Daniel Stenberg (curl maintainer) put a poll on twitter asking if folks had noticed an increased rate in CVEs for curl in the last year ~45% - yes - and it’s good ~2% - yes - and it’s bad ~40% - no ~12% - I don’t understand the question This can be seen easily on the curl dashboard https://curl.se/dashboard.html in particular on https://curl.se/dashboard1.html#vulns-per-year We can see the same results from the Ubuntu CVE Tracker via jq and gnuplot (plus curl itself to fetch the data in the first place): #!/bin/bash for d in $(curl -s "https://ubuntu.com/security/cves.json?order=newest&package=curl&limit=100" | jq -r ".cves[].published"); do date +%s -d "$d"; done > curlhist #!/usr/bin/gnuplot binwidth = 60*60*24*365 # ~30days in seconds bin(x,width)=width*floor(x/width) + width/2.0 set xdata time set datafile missing NaN set boxwidth binwidth set xtics format "%Y" time rotate set style fill solid 0.5 # fill style set title 'Frequency of curl CVEs in the Ubuntu CVE Tracker by year' plot 'curlhist' using (bin($1,binwidth)):(1.0) \ smooth freq with boxes notitle curl CVE frequency has increased in recent years however is still less than what it was back in 2016 Daniel explains how for each CVE wounds his pride that he didn’t find it in the first place (or actually not introduce it) - but overall it is good they are being looked for and found and fixed curl has a bug bounty - and this works as a good incentive has paid out over $40kUSD since it started This year though the 15 reports came from just 4 people and 60% came from a single individual shows that to do this kind of work you need to have a deep, intimate knowledge of the code - can’t just drive by and find bugs - need to spend a lot of time getting to know the code and protocols etc well to be able to find these sorts of issues indicates that curl is a high quality project since it is hard to find security issues long lived codebase that has been well studied and improved over the years Speaking of being long-lived - Daniel also then looks at the average lifetime of each CVE in curl - like the Linux kernel, curl developers go back and try find out what commit introduced a particular vulnerability - they can then compare the time from when that original commit was introduced to when the commit which fixes the bug was made On average, for all CVEs - 2,867 days - 7 years 10 months For those in the past 12 months - 3,245 days - almost 9 years I mentioned the Linux kernel - Kees Cook (ex Ubuntu Security) has done similar analysis using the data we collect in the Ubuntu CVE Tracker over the years and found that for kernel vulnerabilities the average lifetime is 5.5 years In general, curl has had a steady rate of development of around 1300 commits per year since 2007 So on average the same amount of code churn is happening still (although this doesn’t tell us if say the same amount of new code is being written each year - perhaps this is more refactoring / cleanups over time?) but if we assume it is the same amount of new code being written each year, but since the CVE lifetime is growing over time, then more CVEs are being found in the older code than newer code - and as such the quality of the code seems to be improving over time we can clean a bunch of info from the dashboard: test cases - these are growing linearly over time number of CI jobs - also growing linearly over time both indicate an increase in tooling to improve quality over time Final thought: whilst on the surface the idea that curl has got more CVEs recently sounds bad, this is actually a good thing - it means these long lived vulnerabilties are being found and fixed - this is a good thing - and the bug bounty provides a good incentive to first encourage vulns to be looked for and found and then to make sure they get reported and hence fixed (and not say hoarded or sold to third parties etc) Great graph showing the rate of vulns introduced over time and vulns being fixed over time Shows vulns get introduced linearly but they are getting fixed exponentially - so over time the number of latent vulns in the curl codebase is decreasing - and this is definitely a good thing Also shows the benefit of having a bug bounty - if you want vulns to get found and fixed you need to create an environment that encourages that - and what is more motivating than cold hard cash? Get in contact security@ubuntu.com #ubuntu-security on the Libera.Chat IRC network ubuntu-hardened mailing list Security section on discourse.ubuntu.com @ubuntu_sec on twitter

Full show notes at the publisher

Episode 174 Aug 26, 2022

Show notes

Overview

This week we cover the debate around the decision in Ubuntu 22.10 to disable presenting platform security assessments to end users via GNOME, plus we look at security updates for zlib, PostgreSQL, the Linux kernel, Exim and more.

This week in Ubuntu Security Updates

12 unique CVEs addressed

[USN-5570-1, USN-5573-1] zlib and rsync vulnerability [00:43]

1 CVEs addressed for zlib in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS)
1 CVEs addressed for rsync in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2022-37434
Heap-buffer over-read via crafted gzip header - requires an application to call the inflateGetHeader() function so not everything that uses zlib would be affected - impact is DoS via crash
Also turns out the original fix introduced a regression upstream so required a couple different patches to fix this
- thankfully by the time we got around to patching this the regression had already been identified and fixed upstream but some other distros who were quicker off-the-mark were affected by the regression
Also affects rsync in older Ubuntu releases since it contains a vendored copy of zlib - but on newer releases rsync uses the system install zlib and so once that is patched then rsync is also effectively patched too

[USN-5571-1] PostgreSQL vulnerability [02:12]

1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS)
- CVE-2022-2625
Allowed possible code execution as the postgres superuser via various extensions - some of these are bundled with postgres itself and some may come from external sources - was fixed however in the core postgres server so no need to modify/fix other extensions to remediate this vuln - just need to update to this new patched version

[USN-5572-1] Linux kernel (AWS) vulnerabilities [02:45]

3 CVEs addressed in Xenial ESM (16.04 ESM)
4.4 16.04 ESM AWS
3 issues all in Xen paravirtualisation handling - 1 in virtual block driver and another in the PV frontend - both of which failed to properly initialise memory - could then allow a local attacker to see guest memory contents
Third one - memory mgmt issue in PV frontend which could end up sharing unrelated data when communicating with various backends - could then possibly lead to a crash of the guest or info leak of guest memory etc

[USN-5577-1] Linux kernel (OEM) vulnerabilities [03:38]

2 CVEs addressed in Focal (20.04 LTS)
- CVE-2021-33655
- CVE-2021-33061
5.14 OEM kernels
Intel 10GbE PCI Express driver - insufficient control flow management -> local DoS
Framebuffer driver failed to verify size limits when changing font / screen sizes -> OOB write -> DoS/codeexec->privesc

[USN-5574-1] Exim vulnerability [04:11]

1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS)
- CVE-2022-37452
Single-byte heap buffer overflow when doing a host name lookup under certain configurations - failed to account for terminating NUL byte and so could overwrite this and hence leave a string without a trailing NUL - run of end of string -> subsequent further buffer overflow
https://github.com/ivd38/exim_overflow
Requires to have set a custom configuration where the value of one config items references the global variable sender_host_name so unlikely to affect most installations

[USN-5575-1, USN-5575-2] Libxslt vulnerabilities [05:06]

2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS)
- CVE-2021-30560
- CVE-2019-5815
originally reported against blink (chromium browser engine) - heap corruption via crafted HTML
plus type confusion bug when handling crafted XML -> heap buffer overflow as well

[USN-5576-1] Twisted vulnerability [05:41]

1 CVEs addressed in Jammy (22.04 LTS)
- CVE-2022-24801
HTTP desync - form of HTTP request smuggling
parsed various HTTP requests more leniently than permitted by RFC 7230 - can then allow requests which should have been blocked and hence lead to desync if requests pass though multiple parsers -> request smuggling -> access to privileged endpoints etc

[USN-5578-1] Open VM Tools vulnerability [06:23]

1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS)
- CVE-2022-31676
VMWare OpenVM Tools - failed to properly check access controls on certain requests - could then allow a local user who has non-admin access to a guest VM to escalate privileges and gain root within the VM

Goings on in Ubuntu Security Community

Ubuntu 22.10 To Disable GNOME 43’s ‘Device Security’ Panel [07:09]

https://www.omgubuntu.co.uk/2022/08/ubuntu-22-10-device-security-panel-disabled
GNOME 43 (Ubuntu 22.10 / Kinetic Kudu) has as new Device Security Panel in GNOME Control Center / Settings
Shows an assessment of the security of the hardware platform
- HSI security levels for the host
- https://fwupd.github.io/libfwupdplugin/hsi.html
- Designed to raise awareness of platform security issues to put pressure on vendors to build and provide security configurations OOTB
- LVFS analyses firmware binaries to determine how they then affect the security of hardware platforms
- fwupd then assesses the hardware platform settings in conjuction with the details from LVFS for the firmware of the machine and the results can be viewed in g-c-c
- Includes details like:
  - Whether SPI memory regions are defined and locked by the BIOS
  - TPM 2.0 presence
  - UEFI platform key
  - IOMMU
  - Intel BootGuard
  - Ability to accurately reconstruct the PCR0 value from the TPM event log
  - Intel CET (Episode 79 - Joe discusses Intel CET with John Johansen (aka JJ))
- Unfortunately for most of these options, there is not a lot a user can do to easily increase their security / get to a higher level of conformance
- So showing this could just alarm users when there is no good action they can take to remediate it
  - especially from the GUI - some of this could be done at a more low-level but this has the chance of breaking things
  - e.g. could try and potentially recompile everything with CET enabled (this is already done in Ubuntu for the vast majority of packages but not for the kernel - still waiting on Intel to upstream patches required to make this work)
  - but if you do this there is a good chance you could break your install if you don’t get it right
- Ideally if GNOME wants to display security information to the user, especially if they want to try and increase security awareness etc, this needs to be actionable - and be actionable from the same place as the info is displayed - ie in g-c-c itself
- and if g-c-c is going to then trigger steps to try and make things more secure for the user this needs to be super robust to make sure we still don’t brick machines etc
- so overall, for Ubuntu the desktop and security teams feel this is not ready to be included for Ubuntu 22.10 in such a prominent way
  - users can already get the same info via fwupd already (even in Ubuntu 22.04 LTS)
```
          fwupdmgr security
```
  - interesting to note this shows a message:
```
          The HSI specification is not yet complete. To ignore this warning, use --force
```
  - so even fwupd developers realise this is perhaps still not ready for prime time
- So the question then as LVFS/fwupd developer Richard Hughes put it: “I suppose that not knowing is more secure?”
- And as I responded in the LP bug - at this stage yes, since currently it would just create alarm with no easy actions for a user to take to remediate it - since then there is a risk of DoS by say enabling secure boot when unknowingly using unsigned drivers etc

Get in contact

security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter

Our TOPPODCAST Picks

Follow Us

Stay Connected

Overview

This week in Ubuntu Security Updates

[USN-4976-2] Dnsmasq vulnerability [00:55]

[USN-5602-1] Linux kernel (Raspberry Pi) vulnerabilities [02:11]

[USN-5603-1] Linux kernel (Raspberry Pi) vulnerabilities [02:29]

[USN-5605-1] Linux kernel (Azure CVM) vulnerabilities [02:38]

[USN-5523-2] LibTIFF vulnerabilities [02:45]

[USN-5604-1] LibTIFF vulnerabilities [03:13]

[USN-5606-1] poppler vulnerability [03:23]

[USN-5607-1] GDK-PixBuf vulnerability [04:11]

[USN-5608-1] DPDK vulnerability [04:26]

[USN-5609-1] .NET 6 vulnerability [04:39]

[USN-5583-2] systemd regression [05:16]

[USN-5610-1] rust-regex vulnerability

[USN-5611-1] WebKitGTK vulnerability [06:53]

Goings on in Ubuntu Security Community

Discussion of the recent systemd regression in Ubuntu 18.04 LTS with Nishit Majithia and Matthew Ruffell [07:49]

Get in contact

Overview

This week in Ubuntu Security Updates

[USN-5591-1, USN-5591-2, USN-5591-3, USN-5591-4, USN-5597-1, USN-5598-1] Linux kernel (+ HWE, AWS, Oracle) vulnerability [00:47]

[USN-5592-1, USN-5595-1, USN-5596-1, USN-5600-1] Linux kernel (+ OEM, HWE) vulnerabilities [01:04]

[USN-5594-1, USN-5599-1] Linux kernel (+ Oracle) vulnerabilities [01:28]

[USN-5587-1] curl vulnerability [02:12]

[USN-5593-1] Zstandard vulnerability [04:34]

Goings on in Ubuntu Security Community

AT&T Alien Labs teardown of Shikitega Linux malware [05:40]

systemd/open-vm-tools regression for Ubuntu 18.04 LTS [10:56]

Hiring [11:30]

Get in contact

Overview

This week in Ubuntu Security Updates

[USN-5570-1, USN-5573-1] zlib and rsync vulnerability [00:43]

[USN-5571-1] PostgreSQL vulnerability [02:12]

[USN-5572-1] Linux kernel (AWS) vulnerabilities [02:45]

[USN-5577-1] Linux kernel (OEM) vulnerabilities [03:38]

[USN-5574-1] Exim vulnerability [04:11]

[USN-5575-1, USN-5575-2] Libxslt vulnerabilities [05:06]

[USN-5576-1] Twisted vulnerability [05:41]

[USN-5578-1] Open VM Tools vulnerability [06:23]

Goings on in Ubuntu Security Community

Ubuntu 22.10 To Disable GNOME 43’s ‘Device Security’ Panel [07:09]

Get in contact

Related Podcasts

1

2

3

4

5

6