Episode 43

Ubuntu Security Podcast

Content provided by Alex Murray and Ubuntu Security Team. All podcast content including episodes, graphics, and podcast descriptions are uploaded and provided directly by Alex Murray and Ubuntu Security Team or their podcast platform partner. If you believe someone is using your copyrighted work without your permission, you can follow the process outlined here https://player.fm/legal.

5y ago 26:20

MP3•Episode home

Overview

This week we cover vulnerabilities in Ghostscript, the Linux kernel, nginx and more, and we follow up last weeks interview with another interview with Jamie Strandboge, this time talking about the history of the Ubuntu Security team.

This week in Ubuntu Security Updates

53 unique CVEs addressed

[USN-4091-1] poppler vulnerability

1 CVEs addressed in Bionic, Disco
- CVE-2019-14494
Divide by zero when texture surface specified with 0 length or width - found via fuzzing - handled by checking first for zero-length and returning an error -> DoS

[USN-4092-1] Ghostscript vulnerability

1 CVEs addressed in Xenial, Bionic, Disco
- CVE-2019-10216
Yet another Ghostscript -dSAFER sandbox bypass - Episode 31, Episode 25, Episode 18, Episode 14, Episode 10, Episode 7, Episode 5
Allows to escape the sandbox and use the various Ghostscript APIs for arbitrary file access / modification etc.
- Related: ImageMagick policy update Episode 38

[USN-4070-2, USN-4070-3] MariaDB vulnerabilities

4 CVEs addressed in Bionic and Disco
4 CVEs addressed in Disco only
Covered some for MySQL in Episode 41

[USN-4093-1] Linux kernel vulnerabilities

7 CVEs addressed in Bionic (HWE), Disco
Latest speculative execution side-channel attack - SWAPGS
- https://www.bitdefender.com/business/swapgs-attack.html
- Userspace can speculatively execute SWAPGS, allowing it to potentially read kernel memory by speculatively swapping out userspace for kernel memory - requires an appropriate gadget in the kernel
- Linux not believed to be affected, since no appropriate gadget is available, however we have proactively included the upstream fix which is to add LFENCE calls around SWAPGS to ensure SWAPGS occurs before any subsequent memory reads to / from userspace
2 different memory corruption issues in the Marvell Wifi driver - wouldn’t do bounds checking on structures passed to it from user-space - could allow DoS via crash or RCE
NULL ptr dereferences:
- NFC subsystem, able to be triggered from userspace (using netlink)
- PowerPC specific - could occur on memory allocation failures (failed to check NULL return value)
2 by Jann Horn:
- ptrace would record process credentials incorrectly, so that a local user can escalate to root in scenarios where a parent process drops privileges and then calls execve of an attacker controlled application
- UAF in handling of local descriptor table entries

[USN-4094-1] Linux kernel vulnerabilities

32 CVEs addressed in Xenial (HWE), Bionic
Includes all from above, plus a heap of others - most interesting ones:
- Heaps of DoS via NULL dereference / divide by zero / invalid read when dealing with crafted file-system images (XFS, Ext4, F2FS, etc)
- Bluetooth crypto may not validate ECC parameters, allowing an attacker to force a weak key and snoop on communications as a result

[USN-4095-1] Linux kernel vulnerabilities

8 CVEs addressed in Xenial
Marvell Wifi, ptrace, PowerPC, SWAPGS and Bluetooth ECC parameter validation mentioned above
Core dump race-condition (Episode 41)

[USN-4095-2] Linux kernel (Xenial HWE) vulnerabilities

7 CVEs addressed in Trusty ESM
Marvell, PowerPC, SWAPGS, Bluetooth
seccomp race, ext4 extents (Episode 41)

[USN-4096-1] Linux kernel (AWS) vulnerability

1 CVEs addressed in Xenial, Bionic, Disco
- CVE-2019-1125
SWAPGS

[USN-4097-1, USN-4097-2] PHP vulnerabilities

2 CVEs addressed in Precise ESM, Trusty ESM, Xenial, Bionic, Disco
- CVE-2019-11042
- CVE-2019-11041
PHP EXIF parser would read past enf of supplied data - OOB read - crash -> DoS

[USN-4098-1] wpa_supplicant and hostapd vulnerability

1 CVEs addressed in Bionic, Disco
- CVE-2019-13377
Side-channel attack when using brainpool curves for ECC in WPA3 - observe timing differences between various operations over long enough time to infer the resulting encryption key - hard to achieve same level of side-channel robustness as other ECC groups - recommended to disable Brainpool curves in the context of SAE and EAP-pwd - https://w1.fi/security/2019-6/sae-eap-pwd-side-channel-attack-update.txt

[USN-4099-1] nginx vulnerabilities

3 CVEs addressed in Xenial, Bionic, Disco
HTTP/2 DoS attacks
- https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/http2
- 8 different vulnerabilities affecting a variety of HTTP/2 implementations - disovered mainly by Netflix: https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
- 3 affect nginx
  - 0 length header
  - resource loop
  - data dribble

[USN-4101-1] Firefox vulnerability

1 CVEs addressed in Xenial, Bionic, Disco
- CVE-2019-11733
Upstream 68.0.2 release
Able to copy passwords from the Saved Logins dialog without entering Master Password - allows a local user with physical access to obtain passwords etc

Goings on in Ubuntu Security Community

History of Ubuntu Security with Jamie Strandboge and Joe McManus

Get in contact

241 episodes

#Alex Murray #Ubuntu Security Team #Linux #Tech #Operating Systems #Alex and Joe #Security #Software Development

Episode 43

Ubuntu Security Podcast

146 subscribers

published 5y ago

MP3•Episode home

Overview