OverviewAfter a well-deserved break, we’re is back looking at the recent Ubuntu 23.10release and the significant security technologies it introduces along with acall for testing of unprivileged user namespace restrictions, plus the detailsof security updates for curl, Samba, iperf3, CUE and more.

This week in Ubuntu Security Updates26 unique CVEs addressed

[USN-6429-2, USN-6429-3] curl vulnerability (00:51)* 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM) + CVE-2023-38546 * for Ubuntu Pro users * under rare circumstances, possible that an application using libcurl wouldpotentially load cookies from a crafted file on disk - allowing a localattacker to inject arbitrary cookies into a connection - although requires theapplication to use the curl_easy_duphandle() function * 2 CVEs addressed in Mantic (23.10) + CVE-2023-38546 + CVE-2023-38545 * cookie issue above, plus a possible heap buffer overflow when using a SOCKS5proxy, if the specified hostname was longer than 255 bytes

[USN-6425-3] Samba vulnerabilities (02:38)* 4 CVEs addressed in Mantic (23.10) + CVE-2023-42670 + CVE-2023-42669 + CVE-2023-4154 + CVE-2023-4091 * Various logic issues which could result in a range of effects, from attackersbeing able to truncate read-only files, or cause Samba to stop responding andhence DoS through to the ability to obtain all domain secrets

[USN-6425-2] Samba regression (03:06)* 4 CVEs addressed in Focal (20.04 LTS) + CVE-2023-42670 + CVE-2023-42669 + CVE-2023-4154 + CVE-2023-4091 * Previous security update for focal was miscompiled and resulted in an issuewhen handling the %U directive in smb.conf - if specified a path to be sharedlike /home/%U/FILES the %U would seemingly be ignored and not replaced withthe username as expected - and hence the share would fail - this same issueactually occurred previously in January this year - have now added aregression test specifically to try and ensure we do not introduce this sameissue in the future again

[USN-6430-1] FFmpeg vulnerabilities (04:25)* 6 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS) + CVE-2021-28429 + CVE-2020-22051 + CVE-2020-22043 + CVE-2020-22040 + CVE-2020-22039 + CVE-2020-22024 * Most just memory leaks in handling of various crafted files -> DoS * One heap buffer overflow - possible RCE but likely just DoS * One integer overflow in FPS calculation

[USN-6431-1, USN-6431-2, USN-6431-3] iperf3 vulnerabilities (05:12)* 1 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04) + CVE-2023-38403 * Integer overflow -> heap buffer overflow -> RCE / crash - essentially, whenparsing a frame, would allocate memory for the frame, plus 1 extra byte for atrailing NUL - if frame length was MAX_UINT adding 1 then wraps the integeraround back to zero - and so no memory gets allocated - and when copying intothe subsequent memory get a buffer overflow * When preparing this update, Jorge discovered he could cause the iperf3 serverto hang indefinitely on crafted input as well - reported this upstream andincluded that fix here as well

[USN-6432-1] Quagga vulnerabilities (06:26)* 2 CVEs addressed in Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM), Focal (20.04 LTS) + CVE-2023-41360 + CVE-2023-41358 * 2 different DoS vulns - both OOB reads on crafted input -> crash

[USN-6436-1] FRR vulnerabilities (06:38)* 3 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04) + CVE-2023-41909 + CVE-2023-41360 + CVE-2023-41358 * FRR is the new Quagga

[USN-6394-2] Python vulnerability (06:52)* 1 CVEs addressed in Trusty ESM (14.04 ESM), Xenial ESM (16.04 ESM), Bionic ESM (18.04 ESM) + CVE-2022-48560 * Possible UAF in heapq module (aka priority queue implementation)

[USN-6423-2] CUE vulnerability (07:04)* 1 CVEs addressed in Mantic (23.10) + CVE-2023-43641 * OOB write discovered by Kevin Backhouse from Github - allows for a one-clickRCE on GNOME desktop due to the use of libcue by tracker - when a crafted CUEfile is downloaded, will get automatically indexed by tracker and hence parsedby libcue triggering this bug -> RCE * Interestingly, tracker employed a seccomp sandbox which should have limitedthe impact for this kind of issue (ie restricting what the exploit could do)but Kevin found a way to bypass this since the seccomp filter was only appliedto the thread used to parse the file - not the main thread - so Kevin couldsimply delegate the code execution to the main thread to bypass this * Upstream GNOME developers were already aware of this as a possible weakness inthe sandbox, and so worked to ensure this is then applied to all threadswithin tracker, not just the one spawned to parse the particular file

[USN-6433-1] Ghostscript vulnerability (10:18)* 1 CVEs addressed in Focal (20.04 LTS), Jammy (22.04 LTS), Lunar (23.04) + CVE-2023-43115 * Possible sandbox escape via a crafted PS document since it could modify thespecified IJS server parameter binary to execute some other binary instead

[USN-6396-3] Linux kernel (Azure) vulnerabilities (10:55)* 6 CVEs addressed in Trusty ESM (14.04 ESM) + CVE-2023-4128 + CVE-2023-40283 + CVE-2023-3863 + CVE-2023-3212 + CVE-2022-40982 + CVE-2022-27672 * Various issues covered previously - 2 different UAFs - network packetclassifier and bluetooth subsystems, recent speculative execution vulns in AMDand Intel processors and more

[USN-6434-1] PMIx vulnerability (11:24)* 1 CVEs addressed in Bionic ESM (18.04 ESM), Focal (20.04 LTS), Jammy (22.04 LTS) + CVE-2023-41915 * OpenPMIx implementiation - Process Management Interface Exascale Standard -API used in HPC environments * Possible privilege escalation via race condition - library sets ownership ofvarious files but would follow symlinks when doing this - so if a user couldrace it to swap a symlink out then could get it to set the ownership of a rootowned file to themselves and gain the ability to read it etc

Goings on in Ubuntu Security CommunityUbuntu 23.10 (Mantic Minotaur) Released (12:41)* https://ubuntu.com/blog/canonical-releases-ubuntu-23-10-mantic-minotaur * Culmination of the last 6 months of work - this release in particular has astrong focus on raising the bar for security, and setting the stage for thenext LTS (24.04) * Two preview features - TPM-backed FDE on Ubuntu Desktop, and unprivileged usernamespace restrictions via AppArmor * Covered both of these in previous episodes + TPM-backed Full Disk Encryption is coming to Ubuntu from Episode 208 + Unprivileged user namespace restrictions via AppArmor in Ubuntu from Episode 205

Call for testing of Unprivileged User Namespace Restrictions on Mantic* The hope is to get this enabled by default in 24.04 LTS - but we need as muchtesting as we can get to find anything else which is not working as expectedbeforehand - easy to do via a new sysctl

+ Can either do it immediately:`sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=1`
+ Or can set this to be applied at boot via a new file in `/etc/sysctl.d`, e.g.:create a file `/etc/sysctl.d/60-apparmor.conf` with the following contents:

kernel.apparmor_restrict_unprivileged_userns = 1 * Then if you do find something which is not working as expected, you can createa simple AppArmor profile which will allow it to use unprivileged usernamespaces without any additional restrictions, e.g:

abi <abi/4.0>,include <tunables/global>/opt/google/chrome/chrome flags=(unconfined) { userns, # Site-specific additions and overrides. See local/README for details. include if exists <local/opt.google.chrome.chrome>} * From a defensive security point of view, also is useful to enable anadditional sysctl to ensure that anything which is unconfined can’t just abusethese profiles by aa-exec‘ing themselves via that profile - so then also needto enable the kernel.apparmor_restrict_unprivileged_unconfined = 1 sysctl too * One application that we are aware of that is impacted is LXD - which, to avoidissues, is currently disabling this automatically at startup - so for now youhave to keep manually re-enabling this restriction until the LXD devs land achange to stop this https://github.com/canonical/lxd-pkg-snap/pull/187 * Also all applications based on chromium (ie all electron apps) may likely haveissues since the chromium sandbox uses unprivileged user namespaces bydefault - we have already created profiles for the various ones in the Ubuntuarchive that we are aware of, and for some third party ones too (Brave,Vivaldi etc) but we expect there will be others - in that case, let us know * File a bug against apparmor: ubuntu-bug apparmor or visithttps://bugs.launchpad.net/ubuntu/+source/apparmor/+filebug

Get in contact* security@ubuntu.com * #ubuntu-security on the Libera.Chat IRC network * ubuntu-hardened mailing list * Security section on discourse.ubuntu.com * @ubuntusecurity@fosstodon.org, @ubuntu_sec on twitter