Overview
This week we look at results from the Tianfu Cup 2020, the PLATYPUS attack
against Intel CPUs, a detailed writeup of the GDM/accountsservice
vulnerabilities covered in Episode 95 and more.
Goings on in Ubuntu Security Community
Tianfu Cup 2020 [00:37]
https://www.zdnet.com/article/windows-10-ios-chrome-and-many-others-fall-at-chinas-top-hacking-contest/
QEMU on Ubuntu, Firefox and docker all pwned (as well as Chrome, Safari,
VMWare ESXi, CentOS 8, iPhone etc)
qemu-kvm on Ubuntu - used a UAF and an info-leak to escape VM and get
root code exec on host - by Xiao Wei from 360 ESG Vuln Research Institute
who has previously found lots of QEMU bugs - $60k
Still waiting on upstream qemu / docker to release details - Firefox
already patched in CVE-2020-26950
Github writeup of GDM/accountsservice vulnerabilities [02:53]
We covered the vulns in last week’s Episode 95
Kevin Backhouse provides a great amount of detail and a cool demo video
of the attack -
https://securitylab.github.com/research/Ubuntu-gdm3-accountsservice-LPE
https://portswigger.net/daily-swig/vulnerabilities-in-ubuntu-desktop-enabled-root-access-in-two-simple-steps
PLATYPUS attack against Intel CPUs [03:41]
https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Platypus
https://platypusattack.com/
https://www.zdnet.com/article/new-platypus-attack-can-steal-data-from-intel-cpus/
This week in Ubuntu Security Updates [05:27]
23 unique CVEs addressed
[USN-4617-1] SPICE vdagent vulnerabilities
4 CVEs addressed in Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10)
CVE-2020-25653
CVE-2020-25652
CVE-2020-25651
CVE-2020-25650
[USN-4616-2] AccountsService vulnerabilities
2 CVEs addressed in Trusty ESM (14.04 ESM)
CVE-2018-14036
CVE-2020-16126
[USN-4618-1] tmux vulnerability
1 CVEs addressed in Focal (20.04 LTS), Groovy (20.10)
CVE-2020-27347
[USN-4619-1] dom4j vulnerability
1 CVEs addressed in Xenial (16.04 LTS)
CVE-2018-1000632
[USN-4599-3] Firefox regressions
Affecting Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10)
Episode 94
[USN-4620-1] phpLDAPadmin vulnerability
1 CVEs addressed in Bionic (18.04 LTS)
CVE-2017-11107
[USN-4621-1] netqmail vulnerabilities
5 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS)
CVE-2020-3812
CVE-2020-3811
CVE-2005-1515
CVE-2005-1514
CVE-2005-1513
[USN-4622-1] OpenLDAP vulnerability
1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10)
CVE-2020-25692
[USN-4623-1] Pacemaker vulnerability
1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10)
CVE-2020-25654
[USN-4624-1] libexif vulnerability
1 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10)
CVE-2020-0452
[USN-4625-1] Firefox vulnerability
1 CVEs addressed in Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10)
CVE-2020-26950
[USN-4626-1] Linux kernel vulnerabilities
2 CVEs addressed in Groovy (20.10)
CVE-2020-8694
CVE-2020-27194
[USN-4627-1] Linux kernel vulnerability
1 CVEs addressed in Precise ESM (12.04 ESM), Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS)
CVE-2020-8694
[USN-4628-1] Intel Microcode vulnerabilities
3 CVEs addressed in Trusty ESM (14.04 ESM), Xenial (16.04 LTS), Bionic (18.04 LTS), Focal (20.04 LTS), Groovy (20.10)
CVE-2020-8698
CVE-2020-8696
CVE-2020-8695
Get in contact
security@ubuntu.com
#ubuntu-security on the Libera.Chat IRC network
ubuntu-hardened mailing list
Security section on discourse.ubuntu.com
@ubuntu_sec on twitter