| Newsgroups |
gmane.linux.lfs.beyond.devel,gmane.linux.lfs.devel,gmane.linux.lfs.beyond.support,gmane.linux.lfs.support |
| Message-ID |
<[email protected]> |
Good evening folks,
There have been some more significant security fixes recently that I'd
like to bring your attention to! In addition, I'd like to clarify a
statement made on oss-security earlier today.
The following packages have received security updates since the last
time I sent an email:
- Node.js (High)
- abseil-cpp (High)
- OpenJDK (Medium)
- BIND (High)
- Glibc (Medium)
- VIM (Medium)
- Qt6 (Medium)
- QtWebEngine (High)
- MariaDB (Medium)
- libtasn1 (Medium)
- cURL (Low)
- Thunderbird (Critical)
- Firefox (Critical)
The first package we'll talk about is Node.js. There were three
vulnerabilities fixed recently that can allow for malicious usage of a
reinstated constructor (which can also lead to unauthorized information
modification or disclosure), a denial of service (resource exhaustion)
due to a memory leak, and for tampering with requests to backend APIs.
This update has been rated as High severity, and some special care is
required depending on how you decide to approach this update. There's
two different options - the LTS series that BLFS 12.2 released with is
still supported, so you can update to Node.js-20.18.2! If you want to
upgrade to the Node 22 LTS series though, you will need to update to
Node.js-22.13.1 and update libuv to a later version. The current version
in BLFS, libuv-1.50.0, has been validated and confirmed to work well on
BLFS 12.2 systems, but if you aren't developing Node.js applications
where you need to test on the latest LTS version, it is 100% safe to use
Node.js-20.18.2 instead of upgrading to the 22 LTS series.
The next package we'll talk about is abseil-cpp. There is an issue that
allows for an out-of-bounds memory access (and subsequent crash) due to
an integer overflow. The vulnerability occurs when creating and resizing
hash containers, and it happens because there were no upper boundaries
on size arguments with some methods in absl::{flat,node}_hash_{set,map}.
For most uses of abseil-cpp in BLFS, this vulnerability would be
extremely difficult to exploit because container sizes are almost never
attacker controlled. That being said though, it has been rated High, but
only because upstream hasn't provided a CVE and our policy is to treat
unrated vulnerabilities as High to be on the safe side. That being said,
if you have abseil-cpp installed, it can't hurt to update to
abseil-cpp-20240722.1 just in case.
Next we'll talk about OpenJDK. This only impacts applications which open
network sockets, and the issue allows for a remote attacker to
write/delete/access information on a system running a Java application.
No user is required to exploit the vulnerability, nor are privileges
required to exploit it. However, the attack complexity for this
vulnerability is very high, and it exists in the Hotspot component of
OpenJDK. If you are using Java applications which use the network, you
should update to OpenJDK-23.0.2, but if you don't use Java applications
which utilize the network, you don't need to upgrade. The issue has been
rated as Medium by upstream, primarily due to the high attack complexity!
The next package that I'd like to talk about is BIND. For clarification,
the vulnerabilities only affect the BIND server, if you just use the
BIND utilities you can safely skip this update. There are two
vulnerabilities in total which allow for a denial of service condition
causing severe performance degradation and crashes. The first issue
occurs due to DNS-over-HTTPS flooding, and upstream has resolved it by
adjusting the server to only handle HTTP/2 data in smaller chunks, and
it'll now throttle reading more chunks until the client acknowledges
that it has received the response data. Administrators of BIND servers
should be aware that it will throttle clients that send too many
requests at the same time, and that the server will now evaluate
excessive streams opened by clients which have no DNS data contained in
them, and it will log these clients for an administrator to review them.
The server will automatically block these users from sending more
requests, but it's also recommended that you block affected IP addresses
via iptables (or a similar firewall) to prevent them from exploiting any
other services that may be running on your system. The other
vulnerability occurs due to a bug that allows for many records in
additional sections of RDATA sets to cause CPU exhaustion, and it was
resolved by capping it at 13 names and rejecting the requests if there
are more than 13 additional names provided. If you are using a BIND
server, please upgrade BIND to 9.20.5 or later.
The next update that I'd like to talk about is glibc. To preface this,
99% of users will not need to upgrade glibc. Updating glibc is scary,
and this vulnerability is only exploitable with a custom setuid program
that has an existing bug that results in an assertion failure. No
packages in BLFS can currently trigger the vulnerability. That being
said, the vulnerability occurs when applications use the assert()
function, and the issue is only exploitable locally. It's a buffer
overflow that occurs when printing assertion failure messages, and it
leads to application crashes (and in very extreme cases, undefined
behavior). The problem is that the assert() function does not allocate
enough space for the assertion failure string and size information in
some cases, and this can lead to the overflow if the message string size
aligns to page size. **The only case where an LFS user is affected is if
you have a custom setuid program installed**. If you do, please pay
close attention to SA-12.2-072 from 2025-02-02, because extra
precautions are needed as documented in an "Important" box in the book
section for glibc. YOU ARE HEREBY WARNED THAT NOT FOLLOWING THESE
INSTRUCTIONS CAREFULLY WILL LEAD TO A BROKEN SYSTEM. If you are
upgrading from LFS 12.0 or earlier, note that the update process will
also disable and remove NSCD to get rid of additional vulnerabilities
that were resolved in LFS 12.0.
Let's talk about VIM next. There was a vulnerability fixed with our
update to VIM-9.1.1071 that could allow for a crash when the win_line()
function is called in some extreme circumstances. To be affected by it,
you'd have to be in Silent EX mode (-s -e), and you'd have to feed
binary characters to VIM that cause the screen to scroll. It'll cause a
screen redraw to be triggered even though no screen is actually present,
which results in the ScreenLines pointer being accessed even though the
variable isn't allocated. Upstream resolved the issue by skipping the
redraw attempt by testing whether the ScreenLines pointer is NULL.
Upstream rated the vulnerability as Medium, but a user must
intentionally and explicitly feed binary data to VIM while also in ex
mode, so most LFS users are unlikely to be affected. That being said
though, if you use VIM in ex mode and experience a crash, you should
update to VIM-9.1.1071.
The next package on the agenda is Qt6. In Qt6-6.8.2, a security
vulnerability was fixed that allows for a crash when a Bluetooth Low
Energy device pairs and sends malformed Bluetooth ATT commands to a
computer. This only impacts QtConnectivity's QLowEnergyController module
in particular, and a BLFS user would only be affected if they use a Qt
application to pair with a malicious device. The malformed ATT commands
will allow for a remotely exploitable crash, and a user must explicitly
pair with the device. That being said, if you use a Qt application to
pair with a Bluetooth Low Energy device, you should update to Qt6-6.8.2
in case said device gets compromised in the future. As far as I am
aware, the only package in BLFS which could theoretically trigger this
is Bluedevil, which is part of KDE Plasma. Please keep in mind that if
you upgrade Qt6, you will also need to rebuild qcoro and qca if they are
installed, as well as lxqt-qtplugin if you also have LXQt installed.
Upstream has rated the issue as Medium.
Next we should talk about QtWebEngine. The bundled copy of Chromium had
nine security vulnerabilities resolved that could allow for remote code
execution, arbitrary code execution within a sandbox, privilege
escalation, and sensitive system information disclosure (which may
include usernames, IP addresses, and more). The vulnerabilities occur in
the Compositing, V8, Metrics, Navigation, Fenced Frames, Extensions,
Tracing, and Skia components, and they can all be exploited via
maliciously crafted web content such as HTML pages and multimedia. If
you have QtWebEngine installed, you should upgrade to QtWebEngine-6.8.2
immediately to protect your system. Upstream has rated these issues as High.
Next we'll discuss MariaDB. MariaDB-11.4.5 (and 10.11.11) fixed a
security vulnerability that could allow for a remote attacker with high
privileges to cause a denial of service. The issue in particular causes
a hang and frequently exploitable crashes of the mariadb server. While
the vulnerability is extremely easy to exploit, it requires the attacker
to have network access to the mariadb server itself, which is disabled
by default in BLFS via /etc/mariadb/my.cnf! However, if you have
deviated from the book by commenting the "skip-networking" flag out of
/etc/mariadb/my.cnf, you will be affected by this vulnerability. In that
case, you should update to MariaDB-11.4.5, and run the "mariadb-upgrade"
command after upgrading. If you decide to upgrade to this package
though, you must pay extremely close attention to the CMake options
used, as well as remove the mysqld service (or bootscript) and replace
it with the mariadb service (or bootscript), as they have been changed
significantly to work with changes in MariaDB-11.x. If you want to stay
on the previous major version of MariaDB, you can upgrade to
MariaDB-10.11.11, but note that BLFS 12.3 will be shipping with
MariaDB-11.4.x and we do not guarantee support of the 10.11 series after
BLFS 12.3 is released due to having to keep different copies of
MariaDB's data around to support more than one major version. It is thus
recommended that you upgrade to MariaDB-11.4.5 if you are affected by
this vulnerability, but again, most users should be safe to stay on
their existing version of MariaDB unless they have deviated from the
configuration in the book by allowing network access to the MariaDB
server. Upstream has rated the issue as Medium severity.
The next issue on the agenda is in libtasn1. A security vulnerability
was fixed in libtasn1-4.20.0 that could allow for an application to
crash or timeout when processing certificates. When an input DER data
contains a large number of SEQUENCE OF or SET OF elements, decoding the
data and launching a specific element in it will take a quadratic amount
of time to complete. Remote attackers may utilize this to cause a denial
of service attack by presenting a malicious certificate to a network
peer. This vulnerability can impact any application which uses libtasn1
for certificate parsing and validation. Upstream suggested a temporary
workaround of resource control mechanism (such as cgroups) to help avoid
excessive usage of CPU time, but I recommend upgrading to
libtasn1-4.20.0 instead as it is a much safer option. Upstream has rated
the issue as Medium severity.
Now let's discuss cURL. I'd like to preface this by saying that BLFS
users are only impacted if they either use a .netrc file or if they have
built cURL with the --enable-threaded-resolver option. Following the
book and using it as described there should be safe. However, the issues
could allow for application crashes (when cURL is built using
--enable-threaded-resolver *and is running on a 64-bit system*), and for
credential leaks when using a .netrc file for credentials which has a
default entry that omits both the username and password for a service.
Because of both of these conditions, most BLFS users are unlikely to be
affected, but if you did build cURL with the --enable-threaded-resolver
option or have a .netrc file with a default entry that omits both the
username and password for a service, you should update to cURL-8.12.0 as
soon as possible. Because both of these circumstances are extremely
rare, upstream has rated the severity as Low.
Next up is Thunderbird. This update is particularly dire, and all users
of Thunderbird should upgrade immediately. Eleven security
vulnerabilities were fixed that could allow for privacy leaks, remote
code execution, remotely exploitable crashes, automatic launching of web
pages within Thunderbird, memory corruption, and for email address
spoofing. The most severe of these vulnerabilities is the email address
spoofing vulnerability, as it can allow for trivial phishing attacks.
Thunderbird displayed an incorrect sender address if the From field of
an email used invalid group name syntax, and an unsuspecting user who
does not examine all mail headers can be tricked into thinking that a
mail came from a legitimate source - including the correct domain name
for a service, even though the message was not sent from the claimed
address. To reiterate, because of the extreme risk for phishing attacks,
you should update to Thunderbird-128.7.0esr immediately. If you import
address books from other people, you should also consider updating as an
attacker can craft a malicious address book entry, and export it, which
will cause Thunderbird to open a web page and execute JavaScript code
when opening the address book. ALL USERS WHO HAVE THUNDERBIRD INSTALLED
ARE ADVISED TO UPDATE TO 128.7.0esr IMMEDIATELY!
The final update I'd like to talk about today is Firefox. In
Firefox-128.7.0esr, nine security vulnerabilities were fixed that could
allow for remote code execution, memory corruption, remotely exploitable
crashes, invalid certificate validation, and for potentially opening
private browsing tabs in normal browsing windows. Note that the
certificate validation issue occurs due to the length of a certificate
being added to the certificate store not being checked properly. If you
have Firefox installed, you should update to Firefox-128.7.0esr to
protect against potential remote code execution.
Outside of BLFS updates, I would like to clarify a statement made in the
announcement of a vulnerability on oss-security earlier this morning. A
post was made about the pam_pkcs11 PAM module, which has a silent
authentication bypass problem when using smartcards with display
managers such as GDM. The poster mentioned that Linux From Scratch was
potentially impacted by the vulnerability. I would like to clarify that
we do not carry the affected package (pam_pkcs11), and as far as I can
tell from our history we haven't carried it in the books before. The PAM
configuration that GDM installs does reference it in the gdm-smartcard
file, but BLFS users are safe because we do not carry the affected
package. I have replied to the poster on oss-security to clarify that we
are not affected, but I wanted to make sure everyone here was aware as
well. Thank you to Joe Locash for bringing it to my attention privately
earlier this afternoon.
I would like to provide an update on the issues with Firefox and other
applications on BLFS systems accessing websites that use Entrust
certificates as well. We are close to resolving the issue and will
likely have a resolution for it via an update to the make-ca package
within the next few days. If you are impacted on Firefox, you can remove
the copy of /usr/lib/libnssckbi.so that we install in the p11-kit page,
reinstall NSS, and restart Firefox as a temporary workaround. For other
applications though, such as cURL and wget, you will need to wait for us
to resolve the issue. For more details on this, please see the thread
starting at
https://lists.linuxfromscratch.org/sympa/arc/blfs-support/2025-02/msg00011.html
(including my post at
https://lists.linuxfromscratch.org/sympa/arc/blfs-support/2025-02/msg00015.html),
and the issue at make-ca that Xi has created to help track the issue
(https://github.com/lfs-book/make-ca/issues/32)
Thank you everyone for reading this!
Douglas Reno
Linux From Scratch
--
http://lists.linuxfromscratch.org/sympa/info/blfs-dev
Unsubscribe: See the above information page