Episode 103

Ubuntu Security Podcast

Overview

This week we take a deep dive look at 2 recent vulnerabilities in the popular application containerisation frameworks, snapd and flatpak, plus we cover security updates for MiniDLNA, PHP-PEAR, the Linux kernel and more.

This week in Ubuntu Security Updates

26 unique CVEs addressed

[USN-4720-2] Apport vulnerabilities [00:53]

• 3 CVEs addressed in Trusty ESM (14.04 ESM)
  • CVE-2021-25684
  • CVE-2021-25683
  • CVE-2021-25682
• Episode 102

[USN-4721-1] Flatpak vulnerability [01:06]

• 1 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10)
  • CVE-2021-21261
• Flatpak sandbox escape - Flatpak isolates applications inside their own mount / user / etc namespaces - allows sandboxed applications to communicate with the host via various portals - ie. open a file via a file chooser portal (aka powerbox)
• Portal D-Bus service provides the ability to launch other subprocesses in a new sandbox instance, following a NNP model (ie same or less privileges as caller) (eg. used by sandboxed webbrowers to process untrusted content inside less privileged subprocesses)
• Would previous allow a confined process to specify various environment variables which would then get passed to the `flatpak run` command to launch the new subprocess in its own sandbox - so fix is to sanitize environment variables

[USN-4722-1] ReadyMedia (MiniDLNA) vulnerabilities [01:11]

• 2 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10)
  • CVE-2020-28926
  • CVE-2020-12695
• Possible RCE via malicious UPnP requests - could send with chunked encoding, this would exploit a signdness bug leading to a heap buffer overflow
• Episode 91 - “CallStranger” - UPnP spec didn’t forbid subscription requests with a URL on a different network segment - could allow an attacker to cause a miniDLNA server to DoS a different endpoint

[USN-4723-1] PEAR vulnerability [02:30]

• 1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10)
  • CVE-2020-36193
• Improper handling of symlinks in archives could result in arbitrary file overwrite via directory traversal - since PHP PEAR runs installer as root, could then overwrite arbitrary files as root and priv esc / code execution etc

[USN-4724-1] OpenLDAP vulnerabilities [03:14]

• 10 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10)
  • CVE-2020-36230
  • CVE-2020-36229
  • CVE-2020-36228
  • CVE-2020-36227
  • CVE-2020-36223
  • CVE-2020-36226
  • CVE-2020-36225
  • CVE-2020-36224
  • CVE-2020-36222
  • CVE-2020-36221
• Various issues

[USN-4725-1] QEMU vulnerabilities [03:20]

• 6 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10)
  • CVE-2021-20181
  • CVE-2020-29443
  • CVE-2020-28916
  • CVE-2020-27821
  • CVE-2020-15859
  • CVE-2020-11947
• Usual sorts of issues in device emulation etc resulting in info disclosure from host to guest or a crash of qemu host process etc

[USN-4717-2] Firefox regression [03:55]

• Affecting Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10)
• Upstream Firefox regression - 85.0.1

[USN-4726-1] OpenJDK vulnerability [04:04]

• Affecting Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10)
• Not much info from upstream on this one - “incorrectly handled direct buffering of characters” -> DoS or other unspecified impact

[USN-4713-2] Linux kernel vulnerability [04:22]

• 1 CVEs addressed in Trusty ESM (14.04 ESM), Bionic (18.04 LTS)
  • CVE-2020-28374
• Episode 102 - LIO SCSI XCOPY issue

[USN-4727-1] Linux kernel vulnerability [04:36]

• 1 CVEs addressed in Focal (20.04 LTS), Groovy (20.10)
  • CVE-2021-26708
• AF_VSOCK race conditions - local user could get code execution as root via memory corruption

[USN-4728-1] snapd vulnerability [05:11]

• 1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10)
  • CVE-2020-27352
• Gilad Reti & Nimrod Stoler from CyberArk
• Thanks to Ian Johnson from snapd team for working on the fix

Get in contact

• [e-mail]
• #ubuntu-security on the Libera.Chat IRC network
• ubuntu-hardened mailing list
• Security section on discourse.ubuntu.com
• @ubuntu_sec on twitter