Security
A new stable security tree
The history of the stable kernel tree goes all the way back to some mailing list discussions in 2005. It has clearly been a great success that now spans multiple supported kernel versions, some of which are supported for two years as part of the long-term support initiative and some that are supported for far longer than that. But there have always been worries in some quarters that following the stable kernels—with fairly frequent updates including many patches—might introduce more bugs than would be fixed (at least bugs relevant to a particular user). So, a "security fix only" stable kernel has some appeal, which is exactly what Sasha Levin announced on April 11.
Levin described his "linux-stable security tree" (which is available
as a Git
tree) as "a derivative tree from the regular stable tree that would
contain only commits that fix security vulnerabilities
".
The repository contains branches and -security tags for all stable series
starting with 3.0 (though some of those are now unsupported), which gives
an idea of what kinds of fixes he is targeting.
Levin
plans to support all of the maintained stable
kernels with a -security variant. He went on to outline the reasons
behind his plan:
Given this, a few projects preferred to delay important kernel updates, and a few even stopped updating the tree altogether, exposing them to critical vulnerabilities.
This project provides an easy way to receive only important security commits, which are usually only a few in each release, and makes it easy to incorporate them into existing projects.
One major problem, of course, is defining what constitutes a "security
fix". Greg Kroah-Hartman, who is the founder of the stable trees and still
maintains several of them, wondered
how Levin would "define 'security vulnerabilities'
". He noted
that everyone's needs are different, so they should either do the
cherry-picking themselves or simply rely on one of the stable trees: "It's not that much churn at all, given the % of
the mainline tree
". He also pointed out that there are fixes that
have gone into the stable trees that weren't recognized as security flaws
until long after those trees were released. Anyone who was cherry-picking
fixes might well have missed one or more of those and been exposed to
vulnerabilities for far longer than necessary.
Levin replied that the security tree would
carry patches for "anything that qualified for a CVE plus anything
exploitable
by a local unprivileged user
". He noted that the security
trees would simply be "a subset of [its]
corresponding -stable tree
". But Kroah-Hartman expressed further concern about the goals of
the project:
Putting up a tree like this isn't going to cause people to update their trees any quicker. If they haven't been doing it now, they aren't going to do it with this tree, as their workloads don't allow them to take updated kernel trees.
In short, it's not the fact that we have stable trees that are "too big" for them to take, it's the fact that they just can't take and test updates properly.
But there are plenty of patches that end up in the stable trees that actually introduce bugs, Levin said. He pointed to the number of "Fixes:" tags that refer to commits in the stable tree as an indicator of that. Furthermore:
There are also fixes for CVEs that have not made it into the stable
tree, he said, typically because they were not sent to the stable
maintainers when
they were merged and a CVE was requested later once the security
implications were known. While Levin did not say so directly, it would
seem that the idea is that the maintainers of this new tree could help
ensure those fixes get into the stable tree, since that provides the path
for them to reach the stable security tree as well. But, he acknowledged
that the tree would not be able to achieve "100% success rate,
but this is the same story as the stable tree and the patch selection
there
".
Beyond that, though, Levin said that reviewing a few cherry-picked fixes, rather than the 100+ fixes all over the tree that often come with a stable release will help certain projects:
The stable kernels do tend to have a lot of patches. 4.5.1 had 238, the 4.4 series has had 1004 patches through 4.4.7, and the 3.14 series contains 4580 patches through 3.14.66. The trees in Levin's repository show markedly fewer patches.
Willy Tarreau, who had been maintaining the 2.6.32 stable kernel until its recent end of life, was worried that the use of "security" in the name of the tree will lead users astray:
Tarreau suggested an alternate strategy to create an "easily
searchable
" list of mainline
commits that were security fixes. Those could perhaps be put into a tree:
"We could even amend the commit messages to mention the CVE id once
it's
assigned, and sometimes 'relies on this preliminary patch'.
" But it
would be "tough work
" and difficult to find someone interested
in doing it. In the end, though, he believes the underlying problem boils
down to "more of an issue educating our users than an issue
with the code we distribute
".
Kroah-Hartman agreed with Tarreau about the
education problem, but also complained that there are "users that
just don't want
to upgrade as it's 'hard' for them
". There is no real difference in
taking 200 patches in an update versus 100, he said, so the "small subset"
argument doesn't make sense to him. But Levin had previously suggested
that stable-security tree releases might carry on the order of five
patches, so it's clear that the two have clashing visions of how it will
all play out.
The one participant in the discussion who is strictly a user of the stable
kernels (rather than a maintainer and user) was Eddie Chapman. He said that the quality of the stable kernels has
always been excellent in his experience; he has run into regressions only
rarely and uses the stable tree for "virtually all my own
projects, as well as many clients' projects
". He agreed with much
of what
Kroah-Hartman and Tarreau said in the thread and warned: "IMO you deserve everything you get if you only applied the fixes
in Sasha's new tree and ignored the stable releases completely.
"
With that said, though, Chapman is in favor of the new tree. He recognizes that the line between a bug fix and a security fix is blurry, but any assistance in narrowing down which fixes are applied is welcome.
So anything which improves visibility, which this certainly does, is a good thing in my opinion.
But Tarreau is skeptical that the tree will generally be used in the right way. The security fixes will only appear in it if they are already in the stable tree, which means that fixes that are missed by the stable maintainers (which is common for him, he said) won't be present.
Chapman agreed that there is a risk, but
"I think it is better than no repository
". Users who are
blindly applying fixes are already in trouble, "so things can't
really effectively get any worse
", he said. Blindly applying a
small set of fixes from the stable-security tree will perhaps help in a
relatively small way: "Their situation might
then be upgraded from 100% screwed to maybe only 70% screwed
".
That's where the conversation trailed off, at least for now. In the end, the proof will be in the pudding. If Levin can provide a tree that is useful to some projects—and perhaps help get some additional fixes into the stable tree itself—it will be a success. If, on the other hand, it ends up causing more headaches than it solves, it seems likely that it will just go away at some point. Only time will tell.
Brief items
Security quotes of the week
This problem was also demonstrated by Fang [Binxing, architect of the China's infamous Great Firewall], with his internet connection cutting out twice while trying to access Facebook and Google. The problem was so bad that he ended up resorting to using Baidu to find a screenshot of a Google homepage.
The incident was so embarrassing that Fang ended up ducking out of a planned Q and A session that was supposed to take place after the speech, though not before exhorting his listeners to do he said and not as he did.
The privately held company, valued at more than $60 billion, said the agencies requested information on trips, trip requests, pickup and dropoff areas, fares, vehicles, and drivers.
HTTPS Everywhere: Encryption for All WordPress.com Sites
WordPress has announced free HTTPS for all custom domains hosted on WordPress.com. "The Let’s Encrypt project gave us an efficient and automated way to provide SSL certificates for a large number of domains. We launched the first batch of certificates in January 2016 and immediately starting working with Let’s Encrypt to make the process smoother for our massive and growing list of domains. For you, the users, that means you’ll see secure encryption automatically deployed on every new site within minutes. We are closing the door to un-encrypted web traffic (HTTP) at every opportunity."
The "Badlock" vulnerability
The details for the "Badlock" vulnerability in thePlease update your systems. We are pretty sure that there will be exploits soon. Engineers at Microsoft and the Samba Team worked together during the past months to get this problem fixed."
New vulnerabilities
cairo: denial of service
| Package(s): | cairo | CVE #(s): | CVE-2016-3190 | ||||
| Created: | April 12, 2016 | Updated: | April 13, 2016 | ||||
| Description: | From the openSUSE bug report:
A vulnerability was found in cairo. A maliciously crafted file can cause out of bounds read in fill_xrgb32_lerp_opaque_spans function in cairo, thus crashing the software. | ||||||
| Alerts: |
| ||||||
ImageMagick: multiple vulnerabilities
| Package(s): | imagemagick | CVE #(s): | |||||
| Created: | April 12, 2016 | Updated: | April 13, 2016 | ||||
| Description: | From the Debian advisory:
Several vulnerabilities were discovered in ImageMagick, a program suite for image manipulation. This update fixes a large number of potential security problems such as null-pointer access and buffer-overflows that might lead to memory leaks or denial of service. | ||||||
| Alerts: |
| ||||||
imlib2: two vulnerabilities
| Package(s): | imlib2 | CVE #(s): | CVE-2016-3994 CVE-2011-5326 | ||||||||||||||||||||||||||||
| Created: | April 13, 2016 | Updated: | April 14, 2016 | ||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
CVE-2016-3994: A vulnerability was found in a way imlib2 processes GIF files. A specially crafted file could cause the imlib2 to crash, or even expose some of the host memory. CVE-2011-5326: A vulnerability was found in imlib2. Attempting to draw a 2x1 radi ellipse with imlib_image_draw_ellipse() will result in a floating point exception. | ||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||
kernel: multiple vulnerabilities
| Package(s): | kernel | CVE #(s): | CVE-2016-3136 CVE-2016-2187 CVE-2016-3140 CVE-2016-3138 CVE-2016-2185 CVE-2016-2188 CVE-2016-2186 CVE-2016-3137 CVE-2016-2184 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 11, 2016 | Updated: | April 13, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
CVE-2016-3136: Kernel crash occurs when presented a buggy USB device which requires mct_u232 driver, causing null pointer dereference. CVE-2016-2187: Kernel crash occurs when presented a buggy USB device which requires gtco driver, causing null pointer dereference. CVE-2016-3140: Kernel crash occurs when presented a buggy USB device which requires digi_acceleport driver, causing null pointer dereference. CVE-2016-3138: Kernel crash occurs when presented a buggy USB device which requires cdc_acm driver, causing null pointer dereference. CVE-2016-2185: Kernel crash occurs when presented a buggy USB device which requires ati_remote2 driver, causing null pointer dereference. CVE-2016-2188: Kernel crash occurs when presented a buggy USB device which requires iowarrior driver, causing null pointer dereference. CVE-2016-2186: Kernel crash occurs when presented a buggy USB device which requires powermate driver, causing null pointer dereference. CVE-2016-3137: Kernel crash occurs when presented a buggy USB device which requires cypress_m8 driver, causing null pointer dereference. CVE-2016-2184: Kernel crash occurs when presented a buggy USB device which requires snd_usb_audio driver, causing null pointer dereference. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: denial of service
| Package(s): | kernel | CVE #(s): | CVE-2015-1339 | ||||||||||||
| Created: | April 12, 2016 | Updated: | April 13, 2016 | ||||||||||||
| Description: | From the openSUSE bug report:
Kernel memory leak in the CUSE driver using stress-ng was found. It is possible for privileged attacker to cause a local DoS via memory exhaustion by repeatedly opening /dev/cuse for reading. | ||||||||||||||
| Alerts: |
| ||||||||||||||
kernel: two vulnerabilities
| Package(s): | kernel | CVE #(s): | CVE-2016-2143 CVE-2016-3139 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 13, 2016 | Updated: | April 13, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the SUSE advisory:
- CVE-2016-2143: On zSeries a fork of a large process could have caused memory corruption due to incorrect page table handling. (bnc#970504) - CVE-2016-3139: A malicious USB device could cause a kernel crash in the wacom driver. (bnc#970909). | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
libmaxminddb: multiple vulnerabilities
| Package(s): | libmaxminddb | CVE #(s): | |||||||||||||
| Created: | April 7, 2016 | Updated: | April 13, 2016 | ||||||||||||
| Description: | From the Red Hat bugzilla entry:
There were found several segmentation faults caused by missing bounds checking and missing verification of data type. Upstream patch: https://github.com/maxmind/libmaxminddb/commit/51255f113fe3c7b63ffe957636a7656a3ff9d1ff | ||||||||||||||
| Alerts: |
| ||||||||||||||
libreswan: denial of service
| Package(s): | libreswan | CVE #(s): | CVE-2016-3071 | ||||||||
| Created: | April 13, 2016 | Updated: | April 19, 2016 | ||||||||
| Description: | From the Libreswan advisory:
The Libreswan Project found a bug in the default proposal set for IKEv2. This code, introduced in version 3.16, includes the AES_XCBC integrity algorithm. It wrongly assumes that the NSS cryptographic library supports this algorithm. As a result, the IKE daemon crashes and restarts when the aes_xcbc transform is selected. No remote code execution is possible. | ||||||||||
| Alerts: |
| ||||||||||
python-pillow: buffer overflow
| Package(s): | python-pillow | CVE #(s): | CVE-2016-3076 | ||||||||||||
| Created: | April 11, 2016 | Updated: | April 14, 2016 | ||||||||||||
| Description: | From the Fedora advisory:
This update fixes an integer overflow in Jpeg2KEncode.c causing a buffer overflow. | ||||||||||||||
| Alerts: |
| ||||||||||||||
python-rsa: unspecified
| Package(s): | python-rsa | CVE #(s): | |||||||||
| Created: | April 7, 2016 | Updated: | April 18, 2016 | ||||||||
| Description: | From the Fedora advisory:
Long-unfixed security vulnerabilities: https://bugzilla.redhat.com/show_bug.cgi?id=1170702 [ Though the bug report doesn't make it at all clear what is being fixed. ] | ||||||||||
| Alerts: |
| ||||||||||
samba: multiple vulnerabilities
| Package(s): | samba | CVE #(s): | CVE-2015-5370 CVE-2016-2110 CVE-2016-2111 CVE-2016-2112 CVE-2016-2113 CVE-2016-2114 CVE-2016-2115 CVE-2016-2118 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 13, 2016 | Updated: | June 10, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
* Multiple flaws were found in Samba's DCE/RPC protocol implementation. A remote, authenticated attacker could use these flaws to cause a denial of service against the Samba server (high CPU load or a crash) or, possibly, execute arbitrary code with the permissions of the user running Samba (root). This flaw could also be used to downgrade a secure DCE/RPC connection by a man-in-the-middle attacker taking control of an Active Directory (AD) object and compromising the security of a Samba Active Directory Domain Controller (DC). (CVE-2015-5370) Note: While Samba packages as shipped in Red Hat Enterprise Linux do not support running Samba as an AD DC, this flaw applies to all roles Samba implements. * A protocol flaw, publicly referred to as Badlock, was found in the Security Account Manager Remote Protocol (MS-SAMR) and the Local Security Authority (Domain Policy) Remote Protocol (MS-LSAD). Any authenticated DCE/RPC connection that a client initiates against a server could be used by a man-in-the-middle attacker to impersonate the authenticated user against the SAMR or LSA service on the server. As a result, the attacker would be able to get read/write access to the Security Account Manager database, and use this to reveal all passwords or any other potentially sensitive information in that database. (CVE-2016-2118) * Several flaws were found in Samba's implementation of NTLMSSP authentication. An unauthenticated, man-in-the-middle attacker could use this flaw to clear the encryption and integrity flags of a connection, causing data to be transmitted in plain text. The attacker could also force the client or server into sending data in plain text even if encryption was explicitly requested for that connection. (CVE-2016-2110) * It was discovered that Samba configured as a Domain Controller would establish a secure communication channel with a machine using a spoofed computer name. A remote attacker able to observe network traffic could use this flaw to obtain session-related information about the spoofed machine. (CVE-2016-2111) * It was found that Samba's LDAP implementation did not enforce integrity protection for LDAP connections. A man-in-the-middle attacker could use this flaw to downgrade LDAP connections to use no integrity protection, allowing them to hijack such connections. (CVE-2016-2112) * It was found that Samba did not validate SSL/TLS certificates in certain connections. A man-in-the-middle attacker could use this flaw to spoof a Samba server using a specially crafted SSL/TLS certificate. (CVE-2016-2113) * It was discovered that Samba did not enforce Server Message Block (SMB) signing for clients using the SMB1 protocol. A man-in-the-middle attacker could use this flaw to modify traffic between a client and a server. (CVE-2016-2114) * It was found that Samba did not enable integrity protection for IPC traffic by default. A man-in-the-middle attacker could use this flaw to view and modify the data sent between a Samba server and a client. (CVE-2016-2115) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
xen: information disclosure
| Package(s): | xen | CVE #(s): | CVE-2016-3158 CVE-2016-3159 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 11, 2016 | Updated: | April 13, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
There is a workaround in Xen to deal with the fact that AMD CPUs don't load the x86 registers FIP (and possibly FCS), FDP (and possibly FDS), and FOP from memory (via XRSTOR or FXRSTOR) when there is no pending unmasked exception. However, this workaround does not cover all possible input cases. This is because writes to the hardware FSW.ES bit, which the current workaround is based on, are ignored; instead, the CPU calculates FSW.ES from the pending exception and exception mask bits. Xen therefore needs to do the same. Note that part of said workaround was the subject of XSA-52. A malicious domain may be able to leverage this to obtain sensitive information such as cryptographic keys from another domain. | ||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>