OverviewThis week we take a deep dive into the Reptar vuln in Intel processors plus welook into some relic vulnerabilities in Squid and OpenZFS and finally we detailnew hardening measures in tracker-miners to keep your desktop safer.

This week in Ubuntu Security Updates115 unique CVEs addressed

[USN-6481-1] FRR vulnerabilities (01:21)* 2 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10) + CVE-2023-46753 + CVE-2023-46752 * Two different crashes reported by network pentester from Amazon - appears tobe fuzzing frr -> DoS

[USN-6482-1] Quagga vulnerabilities (01:42)* 2 CVEs addressed in Focal (20.04 LTS) + CVE-2023-46753 + CVE-2022-37032 * Speaking of BGP daemons - Quagga was the precursor to FRR - also suffers fromone of these CVEs, plus and older one that was previously fixed in FRR([USN-5685-1] FRR vulnerabilities from Episode 181) thatwould lead to an OOB read

[USN-6483-1] HTML Tidy vulnerability (02:05)* 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10) + CVE-2021-33391 * Implemented parser as a recursive algorithm - so on deeply nested documents,could end up exhausting the stack and causing memory corruption etc. * Fixed by reimplementing the parser as an iterative loop with a heap-basedstack

[USN-6480-1] .NET vulnerabilities (02:42)* 2 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10) + CVE-2023-36049 + CVE-2023-36558

[USN-6484-1] OpenVPN vulnerabilities (02:51)* 2 CVEs addressed in Lunar (23.04), Mantic (23.10) + CVE-2023-46850 + CVE-2023-46849 * Two issues which only affected more recent versions of OpenVPN (>= =2.6.0) -one UAF and the other a possible divide by zero -> DoS

[USN-6485-1] Intel Microcode vulnerability (03:13)* 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10) + CVE-2023-23583 * Tavis Ormandy’s latest processor bug - “Reptar” - found again using the sametechnique as he used to find Zenbleed (AMD) but this time in Intelprocessors - essentially can be thought of as akin to fuzzing but instead ofgenerating random input to find unexpected behaviour, generate some randominput in the form of a set of processor instructions, and then also generatean equivalent version of this by adding random alignment, serialization andmemory fence instructions etc. These extra instructions shouldn’t change thebehaviour of the program being executed, so if a difference is observed thencan likely assume the hardware has behaved incorrectly - perhaps someunderlying microarchitectural behaviour has been triggered - but either waycould indicate the presence of a hardware bug which could in turn be exploitedas a vulnerability to cause undesired affects * In this case, found a sequence of instructions that in general should beignored but which could instead cause the processor to hit a machine checkexception and halt - even from an unprivileged guest VM - this is the kind ofthings that cloud providers worry about * Theorised that since they can cause MCEs by corrupting various internal stateof the processor, they could potentially get privilege escalation if theycould control that corruption with enough precision but since it is not reallypossible to debug the microarchitectural state of the processor it is not easyto develop such a PoC * Reported the issue to Intel who released a microcode update to fix this, andTavis released a PoC tool to test for and reproduce the basic issue

[USN-6486-1] iniParser vulnerability (06:25)* 1 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10) + CVE-2023-33461 * Possible NULL ptr deref on crafted input

[USN-6487-1] Avahi vulnerabilities (06:36)* 5 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10) + CVE-2023-38473 + CVE-2023-38472 + CVE-2023-38471 + CVE-2023-38470 + CVE-2023-38469 * Various assertions were able to be triggered through crafted input - so alocal attacker on your network could cause your local avahi daemon to crash

[USN-6489-1] Tang vulnerability (07:09)* 1 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04) + CVE-2023-1672 * Race condition when generating keys - would write to a file and then setpermissions so only root could read them - small time window then whereanother process could possibly read the key before the more restrictivepermissions are set - fixed by setting a restrictive umask before creating thefile such that it gets created with the restrictive permissions from the start

[USN-6488-1] strongSwan vulnerability (07:59)* 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10) + CVE-2023-41913

[USN-6490-1] WebKitGTK vulnerabilities* 2 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10) + CVE-2023-42852 + CVE-2023-41983

[USN-6491-1] Node.js vulnerabilities* 6 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS) + CVE-2022-43548 + CVE-2022-35256 + CVE-2022-32215 + CVE-2022-32214 + CVE-2022-32213 + CVE-2022-32212

[USN-6493-1, USN-6493-2] hibagent update* Affecting Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10)

[USN-6492-1] Mosquitto vulnerabilities (08:06)* 6 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04) + CVE-2023-28366 + CVE-2023-3592 + CVE-2023-0809 + CVE-2021-41039 + CVE-2021-34434 + CVE-2021-34431 * Multiple memory leaks which can be triggered through crafted packets -> DoS * Excessive CPU usage when parsing a connect request from a client with a large number of user-properties -> DoS * Logic bug - failed to revoke existing subscriptions when a topic subscriptionis revoked in some cases - would still get notified after the fact - info / privacy leak

[USN-6498-1] FRR vulnerabilities (08:55)* 4 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10) + CVE-2023-47235 + CVE-2023-47234 + CVE-2023-38407 + CVE-2023-38406 * More issues discovered by Iggy Frankovic at Amazon - seemingly through fuzzingof frr - UAF, OOB read etc.

[USN-6499-1] GnuTLS vulnerability (09:13)* 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10) + CVE-2023-5981 * Timing side-channel during RSA-PSK ClientKeyExchange - response time wouldvary if given malformed ciphertext compared to when using correct PKCS#1 v1.5padding - very similar to historical CVE-2023-0361 ([USN-5901-1] GnuTLSvulnerability from Episode 189) - in that case the same issue was fixed forregular RSA - but no-one noticed that the same problematic code existed forthis other case as well * Old adage - if you want to find a vuln, look near other previous vulns - andby the same token, if a project has a vuln reported, go looking to see ifperhaps there are other instances of the same vuln in the code base * Lots of projects have lots of copy-pasted or duplicated code within themselves

[USN-6500-1] Squid vulnerabilities (10:20)* 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10) + CVE-2023-46848 + CVE-2023-46847 + CVE-2023-46846 + CVE-2023-46728 + CVE-2023-46724 * Back in early 2021 a security audit was performed on Squid which found 55vulnerabilities - these were reported to the upstream project and some CVEswere assigned but a lot went without any fix * Unfortunately the Squid project is understaffed and hasn’t had the resources to fix all the issues * Researchers eventually got tired of waiting (approx 900 days so notsurprising) - so released details publicly of all their findings * https://megamansec.github.io/Squid-Security-Audit/ * A mix of CVEs and GHSAs have been assigned for some, but not all issues, sosome are still unfixed * This update contains fixes for all the CVEs which have been assigned so far -expect more updates in the future

[USN-6494-1] Linux kernel vulnerabilities* 9 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM) + CVE-2023-5717 + CVE-2023-45871 + CVE-2023-45862 + CVE-2023-42754 + CVE-2023-39194 + CVE-2023-39193 + CVE-2023-39192 + CVE-2023-39189 + CVE-2023-31085

[USN-6495-1] Linux kernel vulnerabilities* 2 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS) + CVE-2023-45871 + CVE-2023-31085

[USN-6496-1] Linux kernel vulnerabilities* 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS) + CVE-2023-45871 + CVE-2023-31085 + CVE-2023-25775

[USN-6497-1] Linux kernel (OEM) vulnerabilities (11:50)* 3 CVEs addressed in Jammy (22.04 LTS) + CVE-2023-5717 + CVE-2023-5178 + CVE-2023-5090 * Logic issue in handling of x2AVIC MSR in KVM nested virtualisation on AMDprocessors - could allow an attacker in a guest VM to cause a crash on thehost kernel and hence a DoS against the whole host

[USN-6502-1] Linux kernel vulnerabilities* 5 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04) + CVE-2023-5345 + CVE-2023-5090 + CVE-2023-45871 + CVE-2023-31085 + CVE-2023-25775 * UAF in the error handling code for SMB file system - local attacker could usethis to escalate privileges

[USN-6502-2] Linux kernel (Oracle) vulnerabilities* 5 CVEs addressed in Lunar (23.04) + CVE-2023-5345 + CVE-2023-5090 + CVE-2023-45871 + CVE-2023-31085 + CVE-2023-25775

[USN-6502-3] Linux kernel (NVIDIA) vulnerabilities* 5 CVEs addressed in Jammy (22.04 LTS) + CVE-2023-5345 + CVE-2023-5090 + CVE-2023-45871 + CVE-2023-31085 + CVE-2023-25775

[USN-6503-1] Linux kernel vulnerabilities* 5 CVEs addressed in Jammy (22.04 LTS), Mantic (23.10) + CVE-2023-5633 + CVE-2023-5345 + CVE-2023-5090 + CVE-2023-4244 + CVE-2023-31085

[USN-6516-1] Linux kernel (Intel IoTG) vulnerabilities* 5 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS) + CVE-2023-45871 + CVE-2023-3772 + CVE-2023-31085 + CVE-2023-31083 + CVE-2023-25775

[USN-6520-1] Linux kernel (StarFive) vulnerabilities* 16 CVEs addressed in Jammy (22.04 LTS) + CVE-2023-5345 + CVE-2023-5090 + CVE-2023-45871 + CVE-2023-44466 + CVE-2023-4134 + CVE-2023-4132 + CVE-2023-3867 + CVE-2023-3866 + CVE-2023-3865 + CVE-2023-3863 + CVE-2023-38432 + CVE-2023-38430 + CVE-2023-3772 + CVE-2023-31085 + CVE-2023-31083 + CVE-2023-25775

[LSN-0099-1] Linux kernel vulnerability (12:49)* 16 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS) + CVE-2023-42753 + CVE-2023-42752 + CVE-2023-40283 + CVE-2023-34319 + CVE-2023-31436 + CVE-2023-5197 + CVE-2023-4881 + CVE-2023-4623 + CVE-2023-4622 + CVE-2023-4004 + CVE-2023-3995 + CVE-2023-3777 + CVE-2023-3776 + CVE-2023-3609 + CVE-2023-3567 + CVE-2022-3643

| Kernel type | 22.04 | 20.04 | 18.04 | 16.04 | 14.04 | | --- | --- | --- | --- | --- | --- | | aws | 99.2 | 99.1 | 99.1 | 99.1 | — | | aws-5.15 | — | 99.2 | — | — | — | | aws-5.4 | — | — | 99.1 | — | — | | aws-6.2 | 99.2 | — | — | — | — | | aws-hwe | — | — | — | 99.1 | — | | azure | 99.2 | 99.1 | — | 99.1 | — | | azure-4.15 | — | — | 99.1 | — | — | | azure-5.4 | — | — | 99.1 | — | — | | azure-6.2 | 99.2 | — | — | — | — | | gcp | 99.2 | 99.1 | — | 99.1 | — | | gcp-4.15 | — | — | 99.1 | — | — | | gcp-5.15 | — | 99.2 | — | — | — | | gcp-5.4 | — | — | 99.1 | — | — | | gcp-6.2 | 99.2 | — | — | — | — | | generic-4.15 | — | — | 99.1 | 99.1 | — | | generic-4.4 | — | — | — | 99.1 | 99.1 | | generic-5.15 | — | 99.2 | — | — | — | | generic-5.4 | — | 99.1 | 99.1 | — | — | | gke | 99.2 | 99.1 | — | — | — | | gke-5.15 | — | 99.2 | — | — | — | | gkeop | — | 99.1 | — | — | — | | hwe-6.2 | 99.2 | — | — | — | — | | ibm | 99.2 | 99.1 | — | — | — | | ibm-5.15 | — | 99.2 | — | — | — | | ibm-5.4 | — | — | 99.1 | — | — | | linux | 99.2 | — | — | — | — | | lowlatency-4.15 | — | — | 99.1 | 99.1 | — | | lowlatency-4.4 | — | — | — | 99.1 | 99.1 | | lowlatency-5.15 | — | 99.2 | — | — | — | | lowlatency-5.4 | — | 99.1 | 99.1 | — | — |

canonical-livepatch status [USN-6501-1] RabbitMQ vulnerability* 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10) + CVE-2023-46118

[USN-6504-1] tracker-miners vulnerability (13:30)* 1 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10) + CVE-2023-5557 * Hardening of the seccomp sandbox in tracker * [USN-6423-2] CUE vulnerability (07:04) from Episode 211 - libcue vuln fromKevin Backhouse at Github exploited this weakness in the existing seccompsandbox to be able to mount their attack for that vulnerability * At the time I discussed how the tracker developers were deploying additionalhardening to ensure all threads used by tracker-miners were sandboxed - thisis that fix

[USN-6505-1] nghttp2 vulnerability (15:20)* 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10) + CVE-2023-44487 * [USN-6438-1, USN-6438-2, USN-6427-2] .NET vulnerabilities from Episode 212 * HTTP/2 Rapid Reset - affects multiple HTTP/2 implementations

[USN-6506-1] Apache HTTP Server vulnerabilities (15:27)* 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10) + CVE-2023-45802 + CVE-2023-43622 + CVE-2023-31122 * DoS against HTTP/2 implemtation - very similar to historical Slow Lorisattack - fixing required backporting the entire version of the http/2 modulefrom 2.0.10 back to earlier releases - thanks to Marc for this herculeaneffort

[USN-6507-1] GlusterFS vulnerability* 1 CVEs addressed in Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10) + CVE-2022-48340

[USN-6509-1] Firefox vulnerabilities (16:17)* 10 CVEs addressed in Focal (20.04 LTS) + CVE-2023-6209 + CVE-2023-6208 + CVE-2023-6207 + CVE-2023-6205 + CVE-2023-6204 + CVE-2023-6213 + CVE-2023-6212 + CVE-2023-6211 + CVE-2023-6210 + CVE-2023-6206 * 120.0 * One issue specific to Linux when running under X11 (and I assume XWayland) -when copying text using the Selection API, this would also be copied into theprimary selection (aka where stuff goes when you highlight it and then pasteit with middle mouse button)

[USN-6508-1, USN-6508-2] poppler vulnerabilities* 5 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS) + CVE-2022-38349 + CVE-2022-37052 + CVE-2022-37051 + CVE-2022-37050 + CVE-2020-23804

[USN-6511-1] OpenZFS vulnerability (17:21)* 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04) + CVE-2013-20001 * Oldest CVE patched in a while - was originally reported to openzfs projectback in November 2013 - over 10 years ago * When sharing over IPv6 would expose to everyone, not just the intended IPv6address but to everyone * Issue languished, eventually a CVE was assigned in Feb 2021 and then fixed inOctober 2021

[USN-6510-1] Apache HTTP Server vulnerability* 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM) + CVE-2023-31122

[USN-6512-1] LibTIFF vulnerabilities* 2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS) + CVE-2023-3576 + CVE-2022-40090

[USN-6513-1] Python vulnerabilities* 2 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM) + CVE-2023-40217 + CVE-2022-48564

[USN-6514-1] Open vSwitch vulnerability (18:18)* 1 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS) + CVE-2023-5366 * Failed to properly handle OpenFlow rules for ICMPv6 Neighbour Advertisements -in some circumstances would match against the wrong rules and so could allowan attacker who could load certain rules to then cause other traffic to beredirected contrary to expectations - this would then result in an info leak

[USN-6515-1] Thunderbird vulnerabilities (18:46)* 7 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10) + CVE-2023-6209 + CVE-2023-6208 + CVE-2023-6207 + CVE-2023-6205 + CVE-2023-6204 + CVE-2023-6212 + CVE-2023-6206 * 115.5.0

[USN-6517-1] Perl vulnerabilities* 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04), Mantic (23.10) + CVE-2023-47038 + CVE-2022-48522

[USN-6402-2] LibTomMath vulnerability* 1 CVEs addressed in Mantic (23.10) + CVE-2023-36328

[USN-6513-2] Python vulnerability* 2 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04) + CVE-2023-40217 + CVE-2022-48564

[USN-6518-1] AFFLIB vulnerability* 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM) + CVE-2018-8050

[USN-6519-1] EC2 hibagent update* Affecting Bionic ESM (18.04 ESM)

Get in contact* security@ubuntu.com * #ubuntu-security on the Libera.Chat IRC network * ubuntu-hardened mailing list * Security section on discourse.ubuntu.com * @ubuntusecurity@fosstodon.org, @ubuntu_sec on twitter