OverviewThe Linux kernel.org CNA has assigned their first CVEs so we revisit this topicto assess the initial impact on Ubuntu and the CVE ecosystem, plus we coversecurity updates for Roundcube Webmail, less, GNU binutils and the Linux kernelitself.
This week in Ubuntu Security Updates64 unique CVEs addressed
[USN-6647-1] Linux kernel vulnerabilities (01:14)* 3 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM) + CVE-2023-7192 + CVE-2023-51782 + CVE-2023-51780 * 4.15 - AWS/Azure/GCP/HWE/KVM/Oracle * Memory leak in netfilter able to be abused via an unprivileged usernamespace - DoS via exhausting system memory
[USN-6648-1] Linux kernel vulnerabilities (02:00)* 4 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS)
+ CVE-2024-0646
+ CVE-2024-0565
+ CVE-2023-6915
+ CVE-2023-51781
* 5.4 - IOT/Xilinx ZynqMP/IBM/Bluefield/GKEOP/Raspi/KVM/Oracle/AWS/GCP/Generic/LowLatency/OEM
* OOB write in KTLS reported by Jann Horn - if a user can get the kernel tosplice a ktls socket can possibly escalate privileges
* UAF in AppleTalk network driver - could be abused by a local unprivilegeduser - can be mitigated by blocklisting in /etc/modprobe.d/blacklist-rare-network.conf
```
```
[USN-6650-1] Linux kernel (OEM) vulnerability (03:30)* 1 CVEs addressed in Jammy (22.04 LTS) + CVE-2023-6915 * NULL ptr deref in generic ID allocator
[USN-6651-1] Linux kernel vulnerabilities (03:38)* 6 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10) + CVE-2024-0646 + CVE-2024-0582 + CVE-2024-0565 + CVE-2023-6915 + CVE-2023-51781 + CVE-2023-51780 * ktls + appletalk
[USN-6653-1] Linux kernel vulnerabilities* 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS) + CVE-2024-0646 + CVE-2024-0565 + CVE-2023-6915 + CVE-2023-51781 + CVE-2023-51780 * ktls + appletalk
[USN-6652-1] Linux kernel (Azure) vulnerabilities (03:47)* 15 CVEs addressed in Mantic (23.10) + CVE-2024-0646 + CVE-2024-0641 + CVE-2024-0582 + CVE-2024-0565 + CVE-2023-6915 + CVE-2023-6622 + CVE-2023-6531 + CVE-2023-6176 + CVE-2023-5972 + CVE-2023-51781 + CVE-2023-51780 + CVE-2023-46862 + CVE-2023-46813 + CVE-2023-35827 + CVE-2023-34324 * ktls + appletalk + NULL ptr deref in TLS impl ([LSN-0100-1] Linux kernel vulnerability from Episode 219)
[USN-6649-1] Firefox vulnerabilities (04:14)* 12 CVEs addressed in Focal (20.04 LTS) + CVE-2024-1556 + CVE-2024-1552 + CVE-2024-1551 + CVE-2024-1546 + CVE-2024-1557 + CVE-2024-1555 + CVE-2024-1554 + CVE-2024-1553 + CVE-2024-1550 + CVE-2024-1549 + CVE-2024-1548 + CVE-2024-1547 * 123.0
[USN-6654-1] Roundcube Webmail vulnerability (04:35)* 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
+ CVE-2023-43770
* XSS able to abused by simple text/plain emails with crafted links - includedthe ability to detect link references like [1] and linkify them to thesource - if an attacker used a form like [<script>evil</script>] this would beincluded in the generated HTML without escaping and so could get arbitrary XSS
* Since is in universe, this update is available via Ubuntu Pro
[USN-6655-1] GNU binutils vulnerabilities (05:54)* 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS) + CVE-2022-48065 + CVE-2022-48063 + CVE-2022-47695 * 3 instances of DoS via excessive memory consumption, one of NULL ptr deref -in general upstream does not consider binutils safe for analysing untrustedinputs
[USN-6656-1] PostgreSQL vulnerability (06:31)* 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
+ CVE-2024-0985
* Failed to properly drop privileges when handling REFRESH MATERIALIZED VIEW CONCURRENTLY commands - should drop privileges so that the SQL is executed asthe owner of the materialized view - as such, if an attacker could get a useror automated system to run such a command they could possibly executearbitrary SQL as the user rather than as the owner of the view as expected
[USN-6657-1] Dnsmasq vulnerabilities (07:10)* 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10) + CVE-2023-28450 + CVE-2023-50868 + CVE-2023-50387 * KeyTrap and NSEC3 proof related vuln in DNSSEC - [USN-6633-1] Bindvulnerabilities from Episode 219
[USN-6658-1] libxml2 vulnerability (07:33)* 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10) + CVE-2024-25062 * UAF if using DTD validation with XInclude expansion enabled
[USN-6659-1] libde265 vulnerabilities (07:52)* 13 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS) + CVE-2023-24758 + CVE-2023-24757 + CVE-2023-24756 + CVE-2023-24755 + CVE-2023-24754 + CVE-2023-24752 + CVE-2023-24751 + CVE-2022-43245 + CVE-2023-25221 + CVE-2022-47665 + CVE-2022-43250 + CVE-2022-43249 + CVE-2022-43244 * Next lot of libde265 vulns after discussed previously in[USN-6627-1] libde265 vulnerabilities fromEpisode 219 - more fuzzing related fixes for usual sorts of issues
[USN-6660-1, USN-6661-1] OpenJDK 11 & 17 vulnerabilities (08:17)* 6 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10) + CVE-2024-20952 + CVE-2024-20945 + CVE-2024-20926 + CVE-2024-20921 + CVE-2024-20919 + CVE-2024-20918 * 11.0.22; 17.0.10
[USN-6662-1] OpenJDK 21 vulnerabilities* 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10) + CVE-2024-20952 + CVE-2024-20945 + CVE-2024-20921 + CVE-2024-20919 + CVE-2024-20918 * 21.0.2
[USN-6305-2] PHP vulnerabilities (08:37)* 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS) + CVE-2023-3824 + CVE-2023-3823
[USN-6663-1] OpenSSL update (08:40)* Affecting Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10) * Hardening update for openssl 3.0 / 1.0 - OpenSSL 3.2.0 introduced a change toreturn random output instead of an exception when it detected wrong paddingfor PKCS#1 v1.5 encryption - without this there is a timing side-channel whichcan be used to infer the secret key and hence break confidentiality
[USN-6664-1] less vulnerability (09:40)* 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Mantic (23.10)
+ CVE-2022-48624
* Failed to quote filenames when using LESSCLOSE - could then get arbitraryshell commands - env var that tells less to invoke a particular command as aninput post-processor (this is used in conjunction with LESSOPEN topre-processor the file before it is displayed by less - for instance, if youwanted to use less to page through a HTML file you might perhaps use this torun it via html2text first - then use LESSCLOSE to do any cleanup)
[USN-6644-2] LibTIFF vulnerabilities (10:51)* 3 CVEs addressed in Jammy (22.04 LTS) + CVE-2023-6277 + CVE-2023-6228 + CVE-2023-52356 * Heap buffer overflow in libtiff itself, plus a heap buffer overflow in thetiffcp tool (used to combine multiple TIFF files into a single one) andfinally a possible OOM issue in libtiff if an input file specified a verylarge size but then failed to actually contain such data (ie the headersspecify a certain size but the file itself doesn’t contain that amount ofdata)
Goings on in Ubuntu Security CommunityFollow up to Linux kernel CNA (11:40)* Since announcing kernel.org has now started assigning CVEs
* First CVE assigned
+ https://lore.kernel.org/linux-cve-announce/2024022058-outsell-equator-e1c5@gregkh/T/#u
+ CVE-2023-52433: netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction
+ CVE-2023-52433
+ Assigned on 2024-02-20 12:53 UTC
* Both historical and recent
+ 40 from 2024
+ 66 from 2023
+ 1 from 2022
+ 165 from 2021
+ 13 from 2020
+ 3 from 2019
* As of Fri 01 Mar 2024 04:04:26 UTC have assigned 288 CVEs
+ 9 days, 15 hours and 11 minutes or so
+ 231 hours
+ Currently assigning more than 1 CVE per hour
* Looking at these, 8 appear to be due to reported issues from Coverity -popular static analysis tool which is not infallible. Others appear to comedirectly from the GSD project (Global Security Database)
+ e.g. CVE-2019-25160(https://lore.kernel.org/linux-cve-announce/2024022657-CVE-2019-25160-e487@gregkh/T/#u)is the same as GSD-2022-1001715
+ As I mentioned in Episode 219, GSD has over 13573 Linux kernel issues
+ Whilst I also said that I hoped that the kernel CNA wouldn’t be so much of afirehose, currently it seems to be quite significant
* On a personal note - I have been doing the CVE Triage role on our team thisweek - in past weeks, I would normally spend about 30-minutes to 1 hour eachday doing this - and this week it has been at least 2 hours each day, mostlydue to the large influx of kernel CVEs
* Perhaps the only way to solve this is better tooling - on our side, mdeslauradded support for automatically extracting the required git commits from theCVE notifications and the kernel team already has tooling which checks if therequired commits are in the git trees of the various Ubuntu kernels
* Hopefully that helps - but it doesn’t help to assign priorities to each CVE
* The kernel CNA is not assigning CVSS scores and they don’t intend to -although my understanding is this is required - and so we can’t use this to help
* So then we need to try and manually assess the impact of each CVE - but eventhe kernel CNA says this is not obvious - so then perhaps the solution is tojust assign them all to medium and deal with them as part of the usual kernelSRU cycle
Get in contact* security@ubuntu.com * #ubuntu-security on the Libera.Chat IRC network * ubuntu-hardened mailing list * Security section on discourse.ubuntu.com * @ubuntusecurity@fosstodon.org, @ubuntu_sec on twitter