OverviewThis week we bring you a sneak peak of how Ubuntu 23.10 fared at Pwn2OwnVancouver 2024, plus news of malicious themes in the KDE Store and we coversecurity updates for the Linux kernel, X.Org X Server, TeX Live, Expat, Bash andmore.
This week in Ubuntu Security Updates61 unique CVEs addressed
[USN-6681-3] Linux kernel vulnerabilities (00:54)* 8 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS) + CVE-2024-0340 + CVE-2023-6121 + CVE-2023-51782 + CVE-2023-51780 + CVE-2023-51779 + CVE-2023-4244 + CVE-2023-22995 + CVE-2021-44879 * 5.4 - IBM, Oracle * UAF due to a race-condition in netfilter - underflow a reference counter ->UAF
[USN-6686-2] Linux kernel vulnerabilities (01:42)* 9 CVEs addressed in Jammy (22.04 LTS) + CVE-2024-0607 + CVE-2024-0340 + CVE-2023-6121 + CVE-2023-51782 + CVE-2023-51779 + CVE-2023-46862 + CVE-2023-46343 + CVE-2023-4134 + CVE-2023-22995 * 5.15 - Raspi, Lowlatency
[USN-6699-1] Linux kernel vulnerabilities (01:52)* 3 CVEs addressed in Trusty ESM (14.04 ESM) + CVE-2024-24855 + CVE-2023-4921 + CVE-2023-30456 * 3.13 - generic, lowlatency, server, virtual * KVM mishandling of control registers for nested guest VMs + [USN-6123-1] Linux kernel (OEM) vulnerabilities from Episode 197 * UAF in Quick Fair Queuing network packet scheduler + Local privesc, reported to Google’s kCTF
[USN-6700-1] Linux kernel vulnerabilities (02:40)* 7 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM) + CVE-2024-24855 + CVE-2024-1086 + CVE-2024-0775 + CVE-2023-51781 + CVE-2023-39197 + CVE-2023-34256 + CVE-2022-20567 * 4.4 - generic, kvm, lowlatency, virtual, aws (14.04 only) * UAF in nftables - also originally reported to kCTF
[USN-6701-1] Linux kernel vulnerabilities* 12 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM) + CVE-2024-24855 + CVE-2024-1086 + CVE-2024-0775 + CVE-2023-6121 + CVE-2023-51781 + CVE-2023-46838 + CVE-2023-4132 + CVE-2023-39197 + CVE-2023-34256 + CVE-2023-3006 + CVE-2023-23000 + CVE-2023-2002 * 4.15 - oracle, kvm, aws, generic, lowlatency * UAF in nftables from above and UAF in AppleTalk network driver - [USN-6648-1]Linux kernel vulnerabilities from Episode 220
[USN-6680-3] Linux kernel (AWS) vulnerabilities* 7 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10) + CVE-2024-25744 + CVE-2024-0607 + CVE-2023-6560 + CVE-2023-6121 + CVE-2023-51782 + CVE-2023-51779 + CVE-2023-46343 * 6.5 - aws
[USN-6681-4] Linux kernel (AWS) vulnerabilities* 8 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS) + CVE-2024-0340 + CVE-2023-6121 + CVE-2023-51782 + CVE-2023-51780 + CVE-2023-51779 + CVE-2023-4244 + CVE-2023-22995 + CVE-2021-44879 * 5.4 - aws * UAF in netfilter discussed earlier
[USN-6686-3] Linux kernel (Oracle) vulnerabilities* 9 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS) + CVE-2024-0607 + CVE-2024-0340 + CVE-2023-6121 + CVE-2023-51782 + CVE-2023-51779 + CVE-2023-46862 + CVE-2023-46343 + CVE-2023-4134 + CVE-2023-22995 * 5.15 - oracle
[USN-6702-1] Linux kernel vulnerabilities* 4 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS) + CVE-2024-24855 + CVE-2024-1086 + CVE-2023-23004 + CVE-2023-23000 * 5.4 - iot, ibm, bluefield, gkeop, kvm, oracle, gcp, generic, lowlatency, oem * Second netfilter UAF above
[USN-6587-5] X.Org X Server vulnerabilities (03:34)* 7 CVEs addressed in Trusty ESM (14.04 ESM) + CVE-2024-21886 + CVE-2024-21885 + CVE-2024-0409 + CVE-2024-0408 + CVE-2024-0229 + CVE-2023-6816 + CVE-2023-6478 * Previous updates for X now available in 14.04 ESM * Most issues either OOB R/W - impact is then can crash X Server or potentiallyget code execution - nowadays X runs unprivileged but in 14.04 still runs asroot so these vulns are more severe in the older releases
[USN-6673-2] python-cryptography vulnerability (04:21)* 1 CVEs addressed in Xenial ESM (16.04 ESM) + CVE-2023-50782 * [USN-6673-1] python-cryptography vulnerabilities from Episode 220
[USN-6695-1] TeX Live vulnerabilities (04:28)* 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10) + CVE-2024-25262 + CVE-2023-32668 + CVE-2019-18604 * Heap buffer overflow via a crafted TTF file * LuaTeX specific issue - allowed a document to make arbitrary network requestssince it didn’t disable access to the underlying lua socket library * Misused sprint() resulting in a buffer overflow in the axohelp - helperprogram for the LaTeX axodraw2 package when used with pdflatex
[USN-6694-1] Expat vulnerabilities (05:24)* 2 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10) + CVE-2024-28757 + CVE-2023-52425 * C library for parsing xml + used by many other applications like gdb, dbus, audacity, git, python,polkit, squid and more * CPU/memory-based DoS since would do many full reparsings of a document in some cases * XML Entity Expansion attack + billion laughs attack / XML bomb - 10 entities which each comprise 10 of theprevious entity with the document containing a single instance of thelargest entity - 1 billion copies of the original entity
[USN-6696-1] OpenJDK 8 vulnerabilities (06:40)* 6 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10) + CVE-2024-20952 + CVE-2024-20945 + CVE-2024-20926 + CVE-2024-20921 + CVE-2024-20919 + CVE-2024-20918 * [USN-6660-1, USN-6661-1] OpenJDK 11 & 17 vulnerabilities from Episode 220
[USN-6697-1] Bash vulnerability (07:01)* 1 CVEs addressed in Jammy (22.04 LTS) + CVE-2022-3715 * Heap buffer overflow on a valid parameter transformation - can thenunexpectedly lead to possible code execution
[USN-6698-1] Vim vulnerability (07:30)* 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10) + CVE-2024-22667 * stack buffer overflow when parsing a crafted command file - ie. the user hasto load a crafted file to be sourced by vim
[USN-6703-1] Firefox vulnerabilities (07:48)* 11 CVEs addressed in Focal (20.04 LTS) + CVE-2024-2613 + CVE-2024-2612 + CVE-2024-2610 + CVE-2024-2608 + CVE-2024-2607 + CVE-2024-2606 + CVE-2023-5388 + CVE-2024-2615 + CVE-2024-2614 + CVE-2024-2611 + CVE-2024-2609 * 124.0
Goings on in Ubuntu Security CommunitySummary of Pwn2Own Vancouver 2024 results against Ubuntu 23.10 (08:05)* https://www.zerodayinitiative.com/blog/2024/3/20/pwn2own-vancouver-2024-day-one-results * The DEVCORE Team was able to execute their LPE attack against UbuntuLinux. However, the bug they used was previously known. They still earn$10,000 and 1 Master of Pwn points. + https://youtube.com/shorts/fXUrMIM2KYc?si=VIR7YKIt86NGEceU * Kyle Zeng from ASU SEFCOM used an ever tricky race condition to escalateprivileges on Ubuntu Linux desktop. This earns him him $20,000 and 20 Masterof Pwn points. + https://www.youtube.com/shorts/HSIasEbEkXY * https://www.zerodayinitiative.com/blog/2024/3/21/pwn2own-vancouver-2024-day-two-results * STAR Labs SG successfully demonstrated their privilege escalation on Ubuntudesktop. However, they used a bug that was previously reported. They stillearn $5,000 and 1 Master of Pwn point. * The final entry of Pwn2Own Vancouver 2024 ends as a collision as Theori used abug that was previously know to escalate privileges on Ubuntu desktop. Hestill wins $5,000 and 1 Master of Pwn point.
Reports of malicious themes in KDE Store (10:27)* https://www.bleepingcomputer.com/news/linux/kde-advises-extreme-caution-after-theme-wipes-linux-users-files/ * https://floss.social/@kde/112128243960545659 * https://www.reddit.com/r/kde/comments/1bixmbx/do_not_install_global_themes_some_wipe_out_all/
Get in contact* security@ubuntu.com * #ubuntu-security on the Libera.Chat IRC network * ubuntu-hardened mailing list * Security section on discourse.ubuntu.com * @ubuntusecurity@fosstodon.org, @ubuntu_sec on twitter