April 2020 - Arch-security - lists.archlinux.org

[ASA-202004-3] linux-lts: privilege escalation
by Levente Polyak 01 Apr '20

01 Apr '20

Arch Linux Security Advisory ASA-202004-3 ========================================= Severity: High Date : 2020-04-01 CVE-ID : CVE-2020-8835 Package : linux-lts Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1121 Summary ======= The package linux-lts before version 5.4.28-2 is vulnerable to privilege escalation. Resolution ========== Upgrade to 5.4.28-2. # pacman -Syu "linux-lts>=5.4.28-2" The problem has been fixed upstream but no release is available yet. Workaround ========== BPF access can be restricted to privileged users by setting kernel.unprivileged_bpf_disabled to 1: # sysctl -w kernel.unprivileged_bpf_disabled=1 Description =========== An out-of-bounds access flaw was found in the Linux kernel’s implementation of the eBPF code verifier, where an incorrect register bounds calculation while checking 32-bit instructions in an eBPF program occurs. This flaw allows an unprivileged user or process to execute eBPF programs to crash the kernel, resulting in a denial of service or potentially gaining root privileges on the system. Impact ====== An unprivileged local user or process can crash the kernel, resulting in a denial of service, or potentially gain root privileges on the system. References ========== https://www.thezdi.com/blog/2020/3/19/pwn2own-2020-day-one-results https://lore.kernel.org/bpf/20200330160324.15259-1-daniel@iogearbox.net/T/ https://www.openwall.com/lists/oss-security/2020/03/30/3 https://security.archlinux.org/CVE-2020-8835

1 0

[ASA-202004-2] linux-hardened: privilege escalation
by Levente Polyak 01 Apr '20

01 Apr '20

Arch Linux Security Advisory ASA-202004-2 ========================================= Severity: High Date : 2020-04-01 CVE-ID : CVE-2020-8835 Package : linux-hardened Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-1120 Summary ======= The package linux-hardened before version 5.5.13.b-1 is vulnerable to privilege escalation. Resolution ========== Upgrade to 5.5.13.b-1. # pacman -Syu "linux-hardened>=5.5.13.b-1" The problem has been fixed upstream in version 5.5.13.b. Workaround ========== By default linux-hardened is safe as it restricts BPF access to privileged users. In case the kernel.unprivileged_bpf_disabled setting has been explicitly changed, it can be restricted again: # sysctl -w kernel.unprivileged_bpf_disabled=1 Description =========== An out-of-bounds access flaw was found in the Linux kernel’s implementation of the eBPF code verifier, where an incorrect register bounds calculation while checking 32-bit instructions in an eBPF program occurs. This flaw allows an unprivileged user or process to execute eBPF programs to crash the kernel, resulting in a denial of service or potentially gaining root privileges on the system. Impact ====== An unprivileged local user or process can crash the kernel, resulting in a denial of service, or potentially gain root privileges on the system in case the default BPF access has been changed to allow unprivileged users. References ========== https://www.thezdi.com/blog/2020/3/19/pwn2own-2020-day-one-results https://lore.kernel.org/bpf/20200330160324.15259-1-daniel@iogearbox.net/T/ https://www.openwall.com/lists/oss-security/2020/03/30/3 https://security.archlinux.org/CVE-2020-8835

1 0

[ASA-202004-1] chromium: arbitrary code execution
by Levente Polyak 01 Apr '20

01 Apr '20

Arch Linux Security Advisory ASA-202004-1 ========================================= Severity: High Date : 2020-04-01 CVE-ID : CVE-2020-6450 CVE-2020-6451 CVE-2020-6452 Package : chromium Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1123 Summary ======= The package chromium before version 80.0.3987.162-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 80.0.3987.162-1. # pacman -Syu "chromium>=80.0.3987.162-1" The problems have been fixed upstream in version 80.0.3987.162. Workaround ========== None. Description =========== - CVE-2020-6450 (arbitrary code execution) A use-after-free vulnerability has been found in the WebAudio component of the chromium browser before 80.0.3987.162. - CVE-2020-6451 (arbitrary code execution) A use-after-free vulnerability has been found in the WebAudio component of the chromium browser before 80.0.3987.162. - CVE-2020-6452 (arbitrary code execution) A head-based buffer overflow vulnerability has been found in the Media component of the chromium browser before 80.0.3987.162. Impact ====== A remote attacker might be able to execute arbitrary code on the affected host. References ========== https://chromereleases.googleblog.com/2020/03/stable-channel-update-for-des… https://crbug.com/1062247 https://crbug.com/1061018 https://crbug.com/1059764 https://security.archlinux.org/CVE-2020-6450 https://security.archlinux.org/CVE-2020-6451 https://security.archlinux.org/CVE-2020-6452

1 0