OverviewUbuntu gets pwned at Pwn2Own 2023, plus we cover security updates for vulns inGitPython, object-path, amanda, url-parse and the Linux kernel - and we mentionthe recording of Alex’s Everything Open 2023 presentation as well.
This week in Ubuntu Security Updates91 unique CVEs addressed
[USN-5968-1] GitPython vulnerability [00:46]* 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) + CVE-2022-24439 * RCE via a malicious URL when cloning a repo - would call git clone under thehood and pass the purported URL in without any validation * Used as a dependency for other Python based tools etc - in particular byBandit, Python security checking tool - used to scan python projects forsecurity issues - would be ironic if a tool used to scan for security problemscould be used to leverage an attack - so I took a quick look at the sourcecode for bandit and it seems to only use GitPython to check if the currentdirectory is a git repo or not - so would not be able to be exploited by thisissue
[USN-5967-1] object-path vulnerabilities [02:11]* 3 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS) + CVE-2021-3805 + CVE-2021-23434 + CVE-2020-15256 * all prototype pollution vulns - a type of injection attack that particularlyapplies for languages like Javascript, where an attacker can add arbitraryproperties to global / default javascript objects that then get inherited byuser-defined objects - and so can result in the ability to change the logic ofthe application or potentially even get remote code execution (depending onhow those object properties are used by the application)
[USN-5942-2] Apache HTTP Server vulnerability [02:56]* 1 CVEs addressed in Xenial ESM (16.04 ESM)
+ CVE-2023-25690
* request smuggling attack against mod_proxy
[USN-5966-1, USN-5966-2] amanda vulnerabilities [03:06]* 3 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) + CVE-2022-37705 + CVE-2022-37704 + CVE-2022-37703 * amanda has several suid-root binaries - each was able to be abused in adifferent way - one to see if a given directory existed or not (info leak),and the others to both get code execution etc - update introduced a regressionwhich was then also fixed
[USN-5969-1] gif2apng vulnerabilities [04:00]* 3 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS) + CVE-2021-45911 + CVE-2021-45910 + CVE-2021-45909
[USN-5971-1] Graphviz vulnerabilities [04:12]* 3 CVEs addressed in Trusty ESM (14.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS) + CVE-2020-18032 + CVE-2019-11023 + CVE-2018-10196 * 2 different NULL ptr derefs, 1 buffer overflow -> DoS / RCE
[USN-5954-2] Firefox regressions [04:40]* 9 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS) + CVE-2023-28161 + CVE-2023-28164 + CVE-2023-28160 + CVE-2023-25751 + CVE-2023-28177 + CVE-2023-28176 + CVE-2023-28162 + CVE-2023-25752 + CVE-2023-25750 * 111.0.1 - fixes a couple regressions on macOS and Windows apparently
[USN-5972-1] Thunderbird vulnerabilities [04:58]* 6 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Jammy (22.04 LTS), Kinetic (22.10) + CVE-2023-25752 + CVE-2023-28164 + CVE-2023-25751 + CVE-2023-28176 + CVE-2023-28162 * 102.9.0
[USN-5973-1] url-parse vulnerabilities [05:11]* 8 CVEs addressed in Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS) + CVE-2022-0686 + CVE-2022-0691 + CVE-2022-0639 + CVE-2022-0512 + CVE-2021-3664 + CVE-2021-27515 + CVE-2020-8124 + CVE-2018-3774 * nodejs module for parsing URLs - even for such a seemingly simple task asparsing URLs, can have various vulnerabilities + DoS, SSRF, open-redirect, or bypass various other authorisation checks * upstream project now recommends to use the URL interface from nodejs and thevarious browsers for “better security and accuracy”
[USN-5974-1] GraphicsMagick vulnerabilities [06:24]* 7 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic (18.04 LTS), Focal (20.04 LTS) + CVE-2022-1270 + CVE-2020-12672 + CVE-2019-11006 + CVE-2018-9018 + CVE-2018-5685 + CVE-2018-20189 + CVE-2018-20184
[USN-5686-4] Git vulnerability [06:37]* 1 CVEs addressed in Xenial ESM (16.04 ESM) + CVE-2022-39253 * [USN-5686-1] Git vulnerabilities from Episode 181
[USN-5970-1] Linux kernel vulnerabilities [06:45]* 9 CVEs addressed in Kinetic (22.10) + CVE-2023-23559 + CVE-2023-1195 + CVE-2023-0469 + CVE-2023-0266 + CVE-2023-0045 + CVE-2022-4382 + CVE-2022-42329 + CVE-2022-42328 + CVE-2022-2196
[LSN-0093-1] Linux kernel vulnerability [07:15]* 2 CVEs addressed in all the various Livepatch supported releases (LTS and16.04 ESM) across various different kernels + CVE-2023-0461 + CVE-2023-0179 * UAF in Upper Level Protocol and buffer overflow in netfilter when handlingVLAN headers - both could allow a local user to DoS / code execution in kernel-> EoP
| Kernel type | 22.04 | 20.04 | 18.04 | 16.04 | | --- | --- | --- | --- | --- | | aws | 93.1 | 93.1 | 93.1 | — | | aws-5.15 | — | 93.1 | — | — | | aws-5.4 | — | — | 93.1 | — | | aws-hwe | — | — | — | 93.1 | | azure | 93.1 | 93.1 | — | 93.1 | | azure-4.15 | — | — | 93.1 | — | | azure-5.4 | — | — | 93.1 | — | | gcp | 93.2 | 93.1 | — | 93.1 | | gcp-4.15 | — | — | 93.1 | — | | gcp-5.15 | — | 93.2 | — | — | | gcp-5.4 | — | — | 93.1 | — | | generic-4.15 | — | — | 93.1 | 93.1 | | generic-5.4 | — | 93.1 | 93.1 | — | | gke | 93.2 | 93.1 | — | — | | gke-4.15 | — | — | 93.1 | — | | gke-5.15 | — | 93.2 | — | — | | gke-5.4 | — | — | 93.1 | — | | gkeop | — | 93.1 | — | — | | gkeop-5.4 | — | — | 93.1 | — | | ibm | 93.1 | 93.1 | — | — | | linux | 93.1 | — | — | — | | lowlatency-4.15 | — | — | 93.1 | 93.1 | | lowlatency-5.4 | — | 93.1 | 93.1 | — | | oem | — | — | 93.1 | — |
To check your kernel type and Livepatch version, enter this command:
canonical-livepatch status
[USN-5975-1] Linux kernel vulnerabilities* 31 CVEs addressed in Xenial ESM (16.04 ESM)
+ CVE-2023-28328
+ CVE-2023-26607
+ CVE-2023-23559
+ CVE-2023-23455
+ CVE-2023-0394
+ CVE-2023-0266
+ CVE-2023-0045
+ CVE-2022-47929
+ CVE-2022-43750
+ CVE-2022-42895
+ CVE-2022-42329
+ CVE-2022-42328
+ CVE-2022-41850
+ CVE-2022-41849
+ CVE-2022-41218
+ CVE-2022-39842
+ CVE-2022-3649
+ CVE-2022-3646
+ CVE-2022-3640
+ CVE-2022-36280
+ CVE-2022-3628
+ CVE-2022-3545
+ CVE-2022-3521
+ CVE-2022-3424
+ CVE-2022-29901
+ CVE-2022-29900
+ CVE-2022-2663
+ CVE-2022-26373
+ CVE-2022-20369
+ CVE-2021-3669
+ CVE-2023-0461
[USN-5976-1] Linux kernel (OEM) vulnerabilities* 9 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS) + CVE-2023-0394 + CVE-2022-41850 + CVE-2022-3649 + CVE-2022-3646 + CVE-2022-36280 + CVE-2022-3628 + CVE-2022-3061 + CVE-2022-2196 + CVE-2023-0461
[USN-5977-1] Linux kernel (OEM) vulnerabilities* 3 CVEs addressed in Jammy (22.04 LTS) + CVE-2023-1032 + CVE-2022-2196 + CVE-2023-1281
[USN-5978-1] Linux kernel (OEM) vulnerabilities* 12 CVEs addressed in Jammy (22.04 LTS) + CVE-2023-26545 + CVE-2023-23559 + CVE-2023-1078 + CVE-2023-1075 + CVE-2023-1074 + CVE-2023-1073 + CVE-2023-0394 + CVE-2022-4842 + CVE-2022-4382 + CVE-2022-27672 + CVE-2022-2196 + CVE-2023-1281
[USN-5979-1] Linux kernel (HWE) vulnerabilities* 9 CVEs addressed in Jammy (22.04 LTS) + CVE-2023-23559 + CVE-2023-1195 + CVE-2023-0469 + CVE-2023-0266 + CVE-2023-0045 + CVE-2022-4382 + CVE-2022-42329 + CVE-2022-42328 + CVE-2022-2196
[USN-5980-1] Linux kernel vulnerabilities* 4 CVEs addressed in Focal (20.04 LTS) + CVE-2023-23559 + CVE-2022-4382 + CVE-2022-2196 + CVE-2021-3669
[USN-5981-1] Linux kernel vulnerabilities* 11 CVEs addressed in Xenial ESM (16.04 ESM) + CVE-2023-28328 + CVE-2023-23559 + CVE-2023-23455 + CVE-2023-0394 + CVE-2023-0266 + CVE-2023-0045 + CVE-2022-47929 + CVE-2022-41218 + CVE-2022-36280 + CVE-2022-3424 + CVE-2021-3669
[USN-5982-1] Linux kernel vulnerabilities* 15 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS) + CVE-2023-28328 + CVE-2023-26606 + CVE-2023-23559 + CVE-2023-23455 + CVE-2023-23454 + CVE-2023-0266 + CVE-2023-0210 + CVE-2023-0045 + CVE-2022-48424 + CVE-2022-48423 + CVE-2022-4382 + CVE-2022-41218 + CVE-2022-36280 + CVE-2022-3424 + CVE-2022-2196
Goings on in Ubuntu Security Communitypwn2own 2023 [08:02]* pwn2own - part of CanSecWest security conference in Vancouver, Canada
* originally started as an informal event, now is organised by Trend’s ZDI andis attended by many of the best offensive security research teams in the world
* compete to hack various known targets under various categories
* Runs over 3 days
* Ubuntu Desktop was a target again this year, in particular in the local userelevation of privilege category - standard unprivileged user account which canbe used to escalate privileges to root - targeting the latest Ubuntu interimrelease 22.10 (Kinetic)
* competitors get 3 attempts, each with a time limit of 10 minutes to get theirexploit to work
* From our side, we had a team of 4 engineers (Steve Beattie, John Johansen andGeorgia Garcia from the Ubuntu Security team and Thadeu Cascardo from theUbuntu Kernel team) who were on call to be shown the exploit and vulnerabilityand within 30 minutes would have to determine if it was already known or not
* Day 1 saw 2 attempts
+ one unsuccessful, the other was a previously known (but unpatched)
* Day 2 saw 1 successful attempt (incorrect pointer scaling issue)
* Day 3 saw 3 successful attempts
+ one also previously known, the other two double free and a UAF
* In total, 6 separate teams targeted Ubuntu Desktop, 5 were successful, and theother was not able to get their exploit to work in the allotted time limit
+ Details surrounding all of these vulnerabilities is embargoed for now, butwill become available in the future
+ Only minor details have been released publicly by ZDI at this time (ieincorrect pointer scaling, double free and UAF) but all (unsurprisingly)related to the memory unsafety of C
* Interesting to see the macOS was only targeted once (successful), and Windows11 twice (both successful too) yet Ubuntu had 6
* Yet last year, there were 6 for WIndows 11, and 4 for Ubuntu
* Is Ubuntu seen as an easy target? Or are there more security researcherslooking at Ubuntu compared to Windows nowadays?
* Does the open source nature of Linux make it easier to find vulns since thesource code is easily able to be inspected?
* Pace of development of the upstream kernel is quite fast, lots of newsubsystems like io_uring and large attack surfaces through unprivileged usernamespaces perhaps make Ubuntu more of an easy target
+ Part of the motivation to want to restrict access to unprivileged usernamespaces in the future
* More details to follow once vulns have been made public
* Thanks to Steve, JJ, Georgia and Thadeu
* Day 1 Results
* Day 2 Results
* Day 3 Results
Securing a distro and you own open source project - Everything Open 2023 [14:27]* https://youtu.be/a-_5aJIjjLQ * Ubuntu is one of the most popular Linux distributions and is used by millionsof people all over the world. It contains software from a wide array ofdifferent upstream projects and communities across a number of differentlanguage ecosystems. Ubuntu also aims to provide the best user experience forconsuming all these various pieces of software, whilst being both as secureand usable as possible. * The Ubuntu Security team is responsible for keeping all of this softwaresecure and patched against known vulnerabilities, as well as proactivelylooking for new possible security issues, and finally for ensuring thedistribution as a whole is secured through proactive hardening work. They alsohave a huge depth of experience in working with upstream open source projectsto report, manage patch and disclose security vulnerabilities. Find out bothhow they keep Ubuntu secure and how you can improve the security of your ownopen source project or the projects you contribute to.
Get in contact* security@ubuntu.com * #ubuntu-security on the Libera.Chat IRC network * ubuntu-hardened mailing list * Security section on discourse.ubuntu.com * @ubuntusecurity@fosstodon.org, @ubuntu_sec on twitter