Security
Fuzzing filesystems with AFL
Fuzz testing (or fuzzing) is an increasingly popular technique to find security and other bugs in programs. For user space, american fuzzy lop (AFL) has been used successfully to find many bugs (as noted in an LWN article in September 2015). On the kernel side, projects like the Trinity system-call fuzzer and syzkaller have been used effectively. But there is now another fuzzing option for the kernel. Vegard Nossum and Quentin Casasnovas gave a presentation at Vault 2016 on porting AFL to work on the kernel, with filesystems as the target. Last year's Vault conference also had a presentation on filesystem fuzzing using different techniques.
![[Quentin Casasnovas & Vegard Nossum]](https://static.lwn.net/images/2016/vault-afl-sm.jpg "Quentin Casasnovas & Vegard Nossum")
They began with a chart (slides [PDF]) showing the amount of time it took to find the first bug in various filesystems using three AFL instances running in parallel, which ranged from five seconds to two hours. As a demonstration, they had half a dozen USB sticks with various broken filesystems found by AFL. Nossum inserted one at random into his laptop, mounted the GFS2 filesystem, which seemed to mount just fine, then removed the USB stick. At that point, the laptop hung and was completely unresponsive. A bug in the GFS2 code, which was embodied in the filesystem image that AFL found, had evidently caused enough kernel corruption to hang the system.
AFL basics
Casasnovas then introduced fuzzing and AFL to the audience. The idea behind fuzzing is to use semi-random inputs to a subsystem or program to try to "trigger interesting behavior". AFL is a "genetic fuzzer" that uses branch instrumentation to find new paths through the program. It is "amazingly good" at finding deep and obscure paths through the code.
He showed a simple "lottery" program that would fail only once per 272 runs, so it would take that many tries in the worst case to tickle the "bug". He calculated that would take up to 124 billion CPU years. With AFL, the branch information will be used to find new paths through the code. The inputs that generate a new path are saved and other inputs are "mutated" to find even more paths through the code. The net result is that AFL takes only 2034 iterations in the worst case—just a few seconds of CPU time.
AFL uses a huge buffer of shared memory between the afl-fuzz program and its target. Each branch operation changes a value in the shared memory in such a way that a branch from A to B can be distinguished from a branch from B to A. At the end of the run, a checksum for the shared memory region is calculated to see if a new path has been generated.
Porting AFL to the kernel
For user-space programs, AFL requires a special compiler pass that wraps all conditional jumps in the generated assembly code with a stub that writes the branch-taken information into the shared memory region. The first approach for the kernel was similar, but there were some downsides. For one thing, patching the assembly code was architecture dependent. In addition, all registers needed to be saved by the stub since the generated assembly code does not contain enough information about the register use.
The second approach used the GCC patch written by Dmitry Vyukov for syzkaller. That patch runs after the GIMPLE intermediate representation has been generated, which is after any optimizations have been done, and adds a stub call at the beginning of each basic block. That is an architecture-independent solution and, since GCC knows the register allocations, there is no need to save all of the registers on each call.
The afl_stub() that is called does not take any arguments; it uses the return address to calculate an index into the shared memory. Only the lower bytes of the address are used, which could cause collisions, but "worked well enough" in practice. The index is calculated by XORing the return address and the previous return address, which is what allows AFL to detect the direction of the branch. The value at the index location is then simply incremented.
In order to support shared memory between the user-space afl-fuzz program and the kernel, a /dev/afl device was created. It supports mmap() so the user-space program can map the buffer into its address space.
Multiple AFL fuzzers can be run in parallel, each with their own shared memory. The changes that were made are fairly generic, so they could be applied to other parts of the kernel (e.g. USB). Casasnovas and Nossum targeted filesystems.
Applying AFL to filesystems
Nossum then took over to talk about how this all applies to filesystems. There are a few ingredients needed for AFL to fuzz a specific filesystem. The source directory in the kernel (e.g. fs/ext4) and configuration options to enable the filesystem (e.g. CONFIG_EXT4_FS=y) are needed. Then a stub needs to be written to be called from afl-fuzz. There is also a need for a set of initial filesystem images.
The user-space stub is needed to set up the loopback device and mount point. It then needs to expand a sparse filesystem image to the full image and mount it. Then it needs to do some filesystem activity (open and read/write files, change extended attributes, and so on).
The filesystem images are needed to "seed" the process. AFL wants a test case where everything works as a starting point. It can then change things in the filesystem image to find new paths. Those images can also help drive the fuzzing in certain directions. For example, creating images with UTF-8 filenames would point AFL toward the Unicode support.
Nossum wanted to "emphasize that running a fuzzer is really easy". There is a top-level config.yml that needs to be changed to point at the AFL and kernel Git trees and possibly to a specific GCC version. From there, building and running AFL and the kernel is simply a matter of using a start script that is part of the code they will be releasing soon.
There are some challenges to fuzzing filesystems, however. Large filesystem images pose a problem because AFL works best with small input files (less than 1MB, preferably). Many filesystems have minimum size requirements larger than that, though. So sparse images are used, which have removed the "all-zero" areas since they probably represent unused space. Filesystem-specific compression could also be done to remove "uninteresting" parts of the image.
Internal filesystem checksums also pose a challenge. The fuzzer will change things in the image, but those values won't be reflected in the checksums. One possibility would be to comment out the checksum-verification code in the filesystem, though that could lead to introducing other bugs. It also means that the test-case images may no longer work on a stock kernel. A better idea is to calculate the correct checksums and modify the image before it gets mounted. Figuring out how and where to do that can take a fair amount of work, however.
The overhead of virtualization was another problem area. When using KVM, they could only run roughly 30 tests per second. So they turned to User-Mode Linux (UML), which allows running the kernel as a regular user-space program. The result was that they could run 60x more tests per second.
Running in the kernel environment can make each execution of the test slightly different. Ideally, each run should be deterministic and independent, but things like interrupts can alter that. In particular, interrupts during the mount process were clobbering the feedback buffer, so they ended disabling the instrumentation for interrupt routines.
The rate limiting that is done for printk() caused some state to bleed over between successive runs. They found that either disabling rate limiting or disabling printk() itself would produce more deterministic runs. In addition, disabling symmetric multi-processing (SMP) and preemption both helped make things more deterministic.
Next steps
One of the next steps would be to create a regression test suite using the images created by running AFL. Since these images trigger distinct code paths, they will be good tests as changes are made. For example, one could use 2000 images created by AFL and know that many paths are being tested.
They suggested that filesystem developers should keep track of images found by AFL. They can be used for regression testing or to generate coverage reports for the filesystem's code. Much of the work to do all of that has already been done.
Some other ideas are to do fault injection (for out of memory conditions, for example) to see what new paths are taken. The coverage reports can also be used to add new operations into the user-space stub. Nossum noticed that extended attributes were not getting any coverage at one point, so he added get and set operations for extended attributes, which resulted in "way more coverage".
There were suggestions from the audience that other test suites (xfstests or fsstress) might make good additions. Fast tests are desired, though, but there may be code snippets of use in those, Casasnovas said. So far, there has been no real need to go beyond the 20-30 system calls in the user-space stub, as bugs are still found quickly with what they have.
This work is all meant to be open source, Nossum said, but isn't yet. They are working on a release of the code and will announce it on various mailing lists (including linux-fsdevel, as suggested by Ted Ts'o) when that is done.
[ Thanks to the Linux Foundation for supporting my travel to Raleigh for Vault. ]
Brief items
Security quote of the week
Imagine yourself sitting at a desk, and you have a little box that lets you search anybody’s email in the world; it lets you pull up their entire web history, anything they’ve ever typed into a search engine; you can read the message they are typing on Facebook as they do it; you can turn on the webcam on any private home; you can follow where anyone goes through their cell phone at any time. This is obviously an extraordinarily valuable mechanism of influence, of power, of capability.
What it doesn’t do, though, is stop terrorist attacks.
New vulnerabilities
ansible: code execution
| Package(s): | ansible1.9 | CVE #(s): | CVE-2016-3096 | ||||||||||||||||||||||||
| Created: | April 26, 2016 | Updated: | July 20, 2016 | ||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
A vulnerability in lxc_container, ansible module, was found allowing to get root inside the container. The problem is in the create_script function, which tries to write to /opt/.lxc-attach-script inside of the container. If the attacker can write to /opt/.lxc-attach-script before that, he can overwrite arbitrary files or execute commands as root. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
drupal7-block_class: cross-site scripting
| Package(s): | drupal7-block_class | CVE #(s): | CVE-2016-3144 | ||||||||
| Created: | April 22, 2016 | Updated: | April 27, 2016 | ||||||||
| Description: | From the CVE entry: Cross-site scripting (XSS) vulnerability in the Block Class module 7.x-2.x before 7.x-2.2 for Drupal allows remote authenticated users with the "Administer block classes" permission to inject arbitrary web script or HTML via a class name. | ||||||||||
| Alerts: |
| ||||||||||
giflib: denial of service
| Package(s): | giflib | CVE #(s): | CVE-2016-3977 | ||||||||||||||||
| Created: | April 21, 2016 | Updated: | November 28, 2016 | ||||||||||||||||
| Description: | From the SUSE bug report: A heap buffer overflow vulnerability was found in giflib. A maliciously crafted gif file could cause the application to crash. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
glpi: SQL injection
| Package(s): | glpi | CVE #(s): | |||||||||
| Created: | April 22, 2016 | Updated: | April 27, 2016 | ||||||||
| Description: | From the bug report: param page_limit is not sanitized. | ||||||||||
| Alerts: |
| ||||||||||
golang: denial of service
| Package(s): | golang | CVE #(s): | CVE-2016-3959 | ||||||||||||||||
| Created: | April 26, 2016 | Updated: | May 24, 2016 | ||||||||||||||||
| Description: | From the Red Hat bugzilla:
Go has an infinite loop in several big integer routines that makes Go programs vulnerable to remote denial of service attacks. Programs using HTTPS client authentication or the Go ssh server libraries are both exposed to this vulnerability. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
imlib2: code execution
| Package(s): | imlib2 | CVE #(s): | CVE-2016-4024 | ||||||||||||||||||||||||||||||||
| Created: | April 22, 2016 | Updated: | April 27, 2016 | ||||||||||||||||||||||||||||||||
| Description: | From the Mageia advisory: Integer overflow in imlib2 1.4.8 on 32-bit machines leads to insufficient heap allocation and heap overwrite in many image loaders, potentially resulting in remote code execution. | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
imlib2: denial of service
| Package(s): | imlib2 | CVE #(s): | CVE-2014-9771 | ||||||||||||
| Created: | April 25, 2016 | Updated: | April 27, 2016 | ||||||||||||
| Description: | From the Debian advisory:
It was discovered that an integer overflow could lead to invalid memory reads and unreasonably large memory allocations. | ||||||||||||||
| Alerts: |
| ||||||||||||||
java-1.6.0-sun: multiple vulnerabilities
| Package(s): | java-1.6.0-sun | CVE #(s): | CVE-2016-3422 CVE-2016-3443 CVE-2016-3449 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 22, 2016 | Updated: | April 27, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entries: CVE-2016-3422 - Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect availability via vectors related to 2D. CVE-2016-3443 - Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to 2D. CVE-2016-3449 - Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Deployment. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
java-1.8.0-openjdk: multiple vulnerabilities
| Package(s): | java-1.8.0-openjdk | CVE #(s): | CVE-2016-0686 CVE-2016-0687 CVE-2016-0695 CVE-2016-3425 CVE-2016-3426 CVE-2016-3427 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 21, 2016 | Updated: | November 25, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Scientific Linux advisory: Multiple flaws were discovered in the Serialization and Hotspot components in OpenJDK. An untrusted Java application or applet could use these flaws to completely bypass Java sandbox restrictions. (CVE-2016-0686, CVE-2016-0687). It was discovered that the RMI server implementation in the JMX component in OpenJDK did not restrict which classes can be deserialized when deserializing authentication credentials. A remote, unauthenticated attacker able to connect to a JMX port could possibly use this flaw to trigger deserialization flaws. (CVE-2016-3427). It was discovered that the JAXP component in OpenJDK failed to properly handle Unicode surrogate pairs used as part of the XML attribute values. Specially crafted XML input could cause a Java application to use an excessive amount of memory when parsed. (CVE-2016-3425). It was discovered that the GCM (Galois/Counter Mode) implementation in the JCE component in OpenJDK used a non-constant time comparison when comparing GCM authentication tags. A remote attacker could possibly use this flaw to determine the value of the authentication tag. (CVE-2016-3426). It was discovered that the Security component in OpenJDK failed to check the digest algorithm strength when generating DSA signatures. The use of a digest weaker than the key strength could lead to the generation of signatures that were weaker than expected. (CVE-2016-0695). | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
lha: buffer overflow
| Package(s): | lha | CVE #(s): | CVE-2016-1925 | ||||
| Created: | April 22, 2016 | Updated: | April 29, 2016 | ||||
| Description: | From the Mageia advisory: The lha command is vulnerable to a buffer overflow while processing level 0 and level 1 headers while extracting an archive. | ||||||
| Alerts: |
| ||||||
libgd2: code execution
| Package(s): | libgd2 | CVE #(s): | CVE-2016-3074 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 25, 2016 | Updated: | May 16, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
Hans Jerry Illikainen discovered that libgd2, a library for programmatic graphics creation and manipulation, suffers of a signedness vulnerability which may result in a heap overflow when processing specially crafted compressed gd2 data. A remote attacker can take advantage of this flaw to cause an application using the libgd2 library to crash, or potentially, to execute arbitrary code with the privileges of the user running the application. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
libksba: three vulnerabilities
| Package(s): | libksba | CVE #(s): | |||||
| Created: | April 27, 2016 | Updated: | April 27, 2016 | ||||
| Description: | From the Gentoo advisory:
libksba is vulnerable to two integer overflows and a Denial of Service vulnerability.
| ||||||
| Alerts: |
| ||||||
mod_nss: invalid handling of +CIPHER operator
| Package(s): | mod_nss | CVE #(s): | CVE-2016-3099 | ||||||||||||||||||||||||
| Created: | April 26, 2016 | Updated: | December 15, 2016 | ||||||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
It was reported that +CIPHER operator in OpenSSL changes the order of a cipher. Since cipher ordering isn't supported in NSS, the mod_nss code was supposed to return an error. Instead it returned the result of processing up to that point. Default OpenSSL cipher string: !SSLv2:kEECDH:kRSA:kEDH:kPSK:+3DES:!aNULL:!eNULL:!MD5:!EXP:!RC4:!SEED:!IDEA:!DES Would not properly exclude anything because only the first 5 elements would be examined. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
mozilla: multiple vulnerabilities
| Package(s): | firefox seamonkey thunderbird | CVE #(s): | CVE-2016-2805 CVE-2016-2806 CVE-2016-2807 CVE-2016-2808 CVE-2016-2814 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 27, 2016 | Updated: | June 22, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2016-2805, CVE-2016-2806, CVE-2016-2807, CVE-2016-2808, CVE-2016-2814) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
mozilla: multiple vulnerabilities
| Package(s): | firefox seamonkey | CVE #(s): | CVE-2016-2804 CVE-2016-2811 CVE-2016-2812 CVE-2016-2816 CVE-2016-2817 CVE-2016-2820 | ||||||||||||||||||||||||||||||||
| Created: | April 27, 2016 | Updated: | April 27, 2016 | ||||||||||||||||||||||||||||||||
| Description: | From the Ubuntu advisory:
Christian Holler, Tyson Smith, Phil Ringalda, Gary Kwong, Jesse Ruderman, Mats Palmgren, Carsten Book, Boris Zbarsky, David Bolter, Randell Jesup, Andrew McCreight, and Steve Fink discovered multiple memory safety issues in Firefox. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-2804, CVE-2016-2806, CVE-2016-2807) Looben Yang discovered a use-after-free and buffer overflow in service workers. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to cause a denial of service via application crash, or execute arbitrary code with the privileges of the user invoking Firefox. (CVE-2016-2811, CVE-2016-2812) Muneaki Nishimura discovered that CSP is not applied correctly to web content sent with the multipart/x-mixed-replace MIME type. An attacker could potentially exploit this to conduct cross-site scripting (XSS) attacks when they would otherwise be prevented. (CVE-2016-2816) Muneaki Nishimura discovered that the chrome.tabs.update API for web extensions allows for navigation to javascript: URLs. A malicious extension could potentially exploit this to conduct cross-site scripting (XSS) attacks. (CVE-2016-2817) Mark Goodwin discovered that about:healthreport accepts certain events from any content present in the remote-report iframe. If another vulnerability allowed the injection of web content in the remote-report iframe, an attacker could potentially exploit this to change the user's sharing preferences. (CVE-2016-2820) | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
mozilla: multiple vulnerabilities
| Package(s): | thunderbird | CVE #(s): | |||||||||||||
| Created: | April 25, 2016 | Updated: | May 12, 2016 | ||||||||||||
| Description: | Thunderbird 45.0 fixes vulnerabilities. See the Thunderbird release notes for more information. | ||||||||||||||
| Alerts: |
| ||||||||||||||
mysql: multiple vulnerabilities
| Package(s): | mysql | CVE #(s): | CVE-2016-0657 CVE-2016-0659 CVE-2016-0662 CVE-2016-0667 | ||||
| Created: | April 25, 2016 | Updated: | April 27, 2016 | ||||
| Description: | From the CVE entries:
Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows local users to affect confidentiality via vectors related to JSON. (CVE-2016-0657) Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows local users to affect availability via vectors related to Optimizer. (CVE-2016-0659) Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows local users to affect availability via vectors related to Partition. (CVE-2016-0662) Unspecified vulnerability in Oracle MySQL 5.7.11 and earlier allows local users to affect availability via vectors related to Locking. (CVE-2016-0667) | ||||||
| Alerts: |
| ||||||
mysql: multiple vulnerabilities
| Package(s): | mysql-5.5, mysql-5.6 | CVE #(s): | CVE-2016-0639 CVE-2016-0640 CVE-2016-0641 CVE-2016-0642 CVE-2016-0643 CVE-2016-0644 CVE-2016-0646 CVE-2016-0647 CVE-2016-0648 CVE-2016-0649 CVE-2016-0650 CVE-2016-0655 CVE-2016-0661 CVE-2016-0665 CVE-2016-0666 CVE-2016-0668 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 22, 2016 | Updated: | June 27, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the CVE entries: CVE-2016-0639 - Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and earlier allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Pluggable Authentication. CVE-2016-0640 - Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier allows local users to affect integrity and availability via vectors related to DML. CVE-2016-0641 - Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier allows local users to affect confidentiality and availability via vectors related to MyISAM. CVE-2016-0642 - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier allows local users to affect integrity and availability via vectors related to Federated. CVE-2016-0643 - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier allows local users to affect confidentiality via vectors related to DML. CVE-2016-0644 - Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier allows local users to affect availability via vectors related to DDL. CVE-2016-0646 - Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier allows local users to affect availability via vectors related to DML. CVE-2016-0647 - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier allows local users to affect availability via vectors related to FTS. CVE-2016-0648 - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier allows local users to affect availability via vectors related to PS. CVE-2016-0649 - Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier allows local users to affect availability via vectors related to PS. CVE-2016-0650 - Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier allows local users to affect availability via vectors related to Replication. CVE-2016-0655 - Unspecified vulnerability in Oracle MySQL 5.6.29 and earlier and 5.7.11 and earlier allows local users to affect availability via vectors related to InnoDB. CVE-2016-0661 - Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier allows local users to affect availability via vectors related to Options. CVE-2016-0665 - Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier allows local users to affect availability via vectors related to Security: Encryption. CVE-2016-0666 - Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier allows local users to affect availability via vectors related to Security: Privileges. CVE-2016-0668 - Unspecified vulnerability in Oracle MySQL 5.6.28 and earlier and 5.7.10 and earlier allows local users to affect availability via vectors related to InnoDB. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
parallel: file overwrites
| Package(s): | parallel | CVE #(s): | |||||||||
| Created: | April 25, 2016 | Updated: | April 27, 2016 | ||||||||
| Description: | From the Red Hat bugzilla:
Race condition vulnerability lies in GNU Parallel's way of creating temporary files while at the same time trying to remove these ASAP, so if GNU Parallel is stopped, there will be no temporary files to clean up. A local attacker can exploit this issue to overwrite a file with one byte file. If an attacker sees the temporary file being created, and then removed, he has 15 ms to create a symlink with the same name to a file owned by the user. And if the file is then being recreated this will overwrite the user's file. GNU Parallel is vulnerable when using --pipe, --tmux, --cat, --fifo, or --compress. This issue was partly fixed in 20150422 and fully fixed in 20150522. See the GNU Parallel advisory for more details. | ||||||||||
| Alerts: |
| ||||||||||
pgpdump: denial of service
| Package(s): | pgpdump | CVE #(s): | CVE-2016-4021 | ||||||||||||||||||||||||
| Created: | April 25, 2016 | Updated: | January 2, 2017 | ||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
When pgpdump is run on specially crafted input, a denial of service condition occurs. The program runs with 100% CPU usage for an indefinite amount of time. This can be abused in scenarios where users can supply input to pgpdump, e.g. in http://www.pgpdump.net/. A remote attacker is able to create a specially crafted input that is leading to CPU resource consumption resulting in denial of service. | ||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||
php5: multiple vulnerabilities
| Package(s): | php5 | CVE #(s): | CVE-2014-9767 CVE-2015-8835 CVE-2016-3185 CVE-2015-8838 CVE-2016-3141 CVE-2016-3142 | ||||||||||||||||||||||||||||||||||||||||
| Created: | April 22, 2016 | Updated: | April 28, 2016 | ||||||||||||||||||||||||||||||||||||||||
| Description: | From the Ubuntu advisory: It was discovered that the PHP Zip extension incorrectly handled directories when processing certain zip files. A remote attacker could possibly use this issue to create arbitrary directories. (CVE-2014-9767) It was discovered that the PHP Soap client incorrectly validated data types. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2015-8835, CVE-2016-3185) It was discovered that the PHP MySQL native driver incorrectly handled TLS connections to MySQL databases. A man in the middle attacker could possibly use this issue to downgrade and snoop on TLS connections. This vulnerability is known as BACKRONYM. (CVE-2015-8838) It was discovered that the PHP WDDX extension incorrectly handled certain malformed XML data. A remote attacker could possibly use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2016-3141) It was discovered that the PHP phar extension incorrectly handled certain zip files. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly obtain sensitive information. (CVE-2016-3142) It was discovered that the PHP libxml_disable_entity_loader() setting was shared between threads. When running under PHP-FPM, this could result in XML external entity injection and entity expansion issues. This issue only applied to Ubuntu 12.04 LTS and Ubuntu 14.04 LTS. (No CVE number) It was discovered that the PHP openssl_random_pseudo_bytes() function did not return cryptographically strong pseudo-random bytes. (No CVE number) It was discovered that the PHP Fileinfo component incorrectly handled certain magic files. An attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE number pending) It was discovered that the PHP php_snmp_error() function incorrectly handled string formatting. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. This issue only applied to Ubuntu 14.04 LTS and Ubuntu 15.10. (CVE number pending) It was discovered that the PHP rawurlencode() function incorrectly handled large strings. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service. (CVE number pending) It was discovered that the PHP phar extension incorrectly handled certain filenames in archives. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE number pending) It was discovered that the PHP mb_strcut() function incorrectly handled string formatting. A remote attacker could use this issue to cause PHP to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE number pending) | ||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||
python-tgcaptcha2: reusable captchas
| Package(s): | python-tgcaptcha2 | CVE #(s): | |||||||||
| Created: | April 25, 2016 | Updated: | April 27, 2016 | ||||||||
| Description: | From the Red Hat bugzilla:
If an attacker stores a captcha and its hidden value, they can reuse that same captcha an unlimited amount of time for as long as it's valid. Version-Release number of selected component (if applicable): python-tgccaptcha2-0.2.0-1 How reproducible: Consistent
Steps to Reproduce: Actual results: Both times are accepted. Expected results: The second time should be refused. | ||||||||||
| Alerts: |
| ||||||||||
rpm: two vulnerabilities
| Package(s): | rpm | CVE #(s): | |||||||||
| Created: | April 27, 2016 | Updated: | November 4, 2016 | ||||||||
| Description: | From the Red Hat bugzilla:
Bug #1316903: Null pointer dereference in rstrdup triggered by crafted RPM file causing minor crash was reported. Bug #1316896: Out-of-bounds heap read in rpmtdGetNumber triggered by crafted RPM file was found. | ||||||||||
| Alerts: |
| ||||||||||
springframework-amqp: code execution
| Package(s): | springframework-amqp | CVE #(s): | CVE-2016-2173 | ||||||||
| Created: | April 21, 2016 | Updated: | April 27, 2016 | ||||||||
| Description: | From the CVE entry: The class org.springframework.core.serializer.DefaultDeserializer does not validate the deserialized object against a whitelist. By supplying a crafted serialized object like Chris Frohoff's Commons Collection gadget, remote code execution can be achieved. | ||||||||||
| Alerts: |
| ||||||||||
squid: multiple vulnerabilities
| Package(s): | squid | CVE #(s): | CVE-2016-4051 CVE-2016-4052 CVE-2016-4053 CVE-2016-4054 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 25, 2016 | Updated: | August 4, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Arch Linux advisory:
- CVE-2016-4051 (denial of service): Due to incorrect buffer management Squid cachemgr.cgi tool is vulnerable to a buffer overflow when processing remotely supplied inputs relayed to it from Squid. - CVE-2016-4052 (denial of service): Due to buffer overflow issues Squid is vulnerable to a denial of service attack when processing ESI responses. - CVE-2016-4053 (information disclosure): Due to incorrect input validation Squid is vulnerable to public information disclosure of the server stack layout when processing ESI responses. - CVE-2016-4054 (arbitrary code execution): Due to incorrect input validation and buffer overflow Squid is vulnerable to remote code execution when processing ESI responses. A remote attacker is able to execute arbitrary code, disclose sensitive information or perform a denial of service attack via multiple vulnerabilities. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
varnish: access control bypass
| Package(s): | varnish | CVE #(s): | CVE-2015-8852 | ||||||||||||||||
| Created: | April 22, 2016 | Updated: | July 20, 2016 | ||||||||||||||||
| Description: | From the Debian advisory: Régis Leroy from Makina Corpus discovered that varnish, a caching HTTP reverse proxy, is vulnerable to HTTP smuggling issues, potentially resulting in cache poisoning or bypassing of access control policies. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
w3m: denial of service
| Package(s): | w3m | CVE #(s): | |||||||||
| Created: | April 25, 2016 | Updated: | April 27, 2016 | ||||||||
| Description: | From the Red Hat bugzilla:
A vulnerability was found in w3m package. A maliciously crafted html file opened with specific command could cause the application to crash. | ||||||||||
| Alerts: |
| ||||||||||
webkitgtk4: multiple vulnerabilities
| Package(s): | webkitgtk4 | CVE #(s): | |||||||||
| Created: | April 25, 2016 | Updated: | April 27, 2016 | ||||||||
| Description: | WebKitGTK+ 2.12.1 fixes several issues. See the WebKit release announcement for details. | ||||||||||
| Alerts: |
| ||||||||||
wireshark: multiple vulnerabilities
| Package(s): | wireshark | CVE #(s): | CVE-2016-4076 CVE-2016-4077 CVE-2016-4078 CVE-2016-4079 CVE-2016-4080 CVE-2016-4081 CVE-2016-4006 CVE-2016-4082 CVE-2016-4083 CVE-2016-4084 | ||||||||||||||||
| Created: | April 27, 2016 | Updated: | May 23, 2016 | ||||||||||||||||
| Description: | From the Mageia advisory:
The NCP dissector could crash (CVE-2016-4076). TShark could crash due to a packet reassembly bug (CVE-2016-4077). The IEEE 802.11 dissector could crash (CVE-2016-4078). The PKTC dissector could crash (CVE-2016-4079). The PKTC dissector could crash (CVE-2016-4080). The IAX2 dissector could go into an infinite loop (CVE-2016-4081). Wireshark and TShark could exhaust the stack (CVE-2016-4006). The GSM CBCH dissector could crash (CVE-2016-4082). MS-WSP dissector crash (CVE-2016-4083, CVE-2016-4084). | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
xen: privilege escalation
| Package(s): | xen | CVE #(s): | CVE-2016-3960 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | April 22, 2016 | Updated: | May 2, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory: Ling Liu and Yihan Lian of the Cloud Security Team, Qihoo 360 discovered an integer overflow in the x86 shadow pagetable code. A HVM guest using shadow pagetables can cause the host to crash. A PV guest using shadow pagetables (i.e. being migrated) with PV superpages enabled (which is not the default) can crash the host, or corrupt hypervisor memory, potentially leading to privilege escalation. | ||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||
xstream: enabled processing of external entities
| Package(s): | xstream | CVE #(s): | CVE-2016-3674 | ||||||||||||||||||||
| Created: | April 27, 2016 | Updated: | June 8, 2016 | ||||||||||||||||||||
| Description: | From the Red Hat bugzilla:
XStream (x-stream.github.io) is a Java library to marshal Java objects into XML and back. For this purpose it supports a lot of different XML parsers. Some of those can also process external entities which was enabled by default. An attacker could therefore provide manipulated XML as input to access data on the file system, see https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
yast2-users: empty passwords fields in /etc/shadow
| Package(s): | yast2-users | CVE #(s): | CVE-2016-1601 | ||||||||
| Created: | April 25, 2016 | Updated: | May 4, 2016 | ||||||||
| Description: | From the SUSE advisory:
Empty passwords fields in /etc/shadow after SLES 12 SP1 autoyast installation (bsc#974220). | ||||||||||
| Alerts: |
| ||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>