- Arch-security - lists.archlinux.org

[ASA-201911-14] intel-ucode: multiple issues
by Remi Gacogne 03 Dec '19

03 Dec '19

Arch Linux Security Advisory ASA-201911-14 ========================================== Severity: High Date : 2019-11-13 CVE-ID : CVE-2019-0117 CVE-2019-11135 CVE-2019-11139 Package : intel-ucode Type : multiple issues Remote : No Link : https://security.archlinux.org/AVG-1068 Summary ======= The package intel-ucode before version 20191112-1 is vulnerable to multiple issues including information disclosure, private key recovery and denial of service. Resolution ========== Upgrade to 20191112-1. # pacman -Syu "intel-ucode>=20191112-1" The problems have been fixed upstream in version 20191112. Workaround ========== None. Description =========== - CVE-2019-0117 (information disclosure) A flaw was found in the implementation of SGX around the access control of protected memory. A local attacker of a system with SGX enabled and an affected intel GPU with the ability to execute code is able to infer the contents of the SGX protected memory. - CVE-2019-11135 (private key recovery) A flaw was found in the way Intel CPUs handle speculative execution of instructions when the TSX Asynchronous Abort (TAA) error occurs. A local authenticated attacker with the ability to monitor execution times could infer the TSX memory state by comparing abort execution times. This could allow information disclosure via this observed side- channel for any TSX transaction being executed while an attacker is able to observe abort timing. Intel's Transactional Synchronisation Extensions (TSX) are set of instructions which enable transactional memory support to improve performance of the multi-threaded applications, in the lock-protected critical sections. The CPU executes instructions in the critical-sections as transactions, while ensuring their atomic state. When such transaction execution is unsuccessful, the processor cannot ensure atomic updates to the transaction memory, so the processor rolls back or aborts such transaction execution. While TSX Asynchronous Abort (TAA) is pending, CPU may continue to read data from architectural buffers and pass it to the dependent speculative operations. This may cause information leakage via speculative side- channel means, which is quite similar to the Microarchitectural Data Sampling (MDS) issue. This mitigation is only effective using one the follow linux kernels: v3.16.77, v4.4.202, v4.9.202, v4.14.154, v4.19.84 or v5.3.11. - CVE-2019-11139 (denial of service) It was discovered that certain Intel Xeon processors did not properly restrict access to a voltage modulation interface. A local privileged attacker could use this to cause a denial of service (system crash). Impact ====== A local unprivileged attacker with access to an affected GPU can read protected memory on an SGX enclave. Further, an attacker can infer the contents of TPM keys using side-channel attacks. Finally, an attacker can crash the system by accessing the voltage modulator interface on certain Xeon processors. References ========== https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0… https://software.intel.com/security-software-guidance/insights/deep-dive-in… https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0… https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-0… https://security.archlinux.org/CVE-2019-0117 https://security.archlinux.org/CVE-2019-11135 https://security.archlinux.org/CVE-2019-11139

1 0

[ASA-201911-13] libtiff: denial of service
by Remi Gacogne 03 Dec '19

03 Dec '19

Arch Linux Security Advisory ASA-201911-13 ========================================== Severity: Medium Date : 2019-11-13 CVE-ID : CVE-2019-6128 CVE-2019-7663 Package : libtiff Type : denial of service Remote : Yes Link : https://security.archlinux.org/AVG-886 Summary ======= The package libtiff before version 4.1.0-1 is vulnerable to denial of service. Resolution ========== Upgrade to 4.1.0-1. # pacman -Syu "libtiff>=4.1.0-1" The problems have been fixed upstream in version 4.1.0. Workaround ========== None. Description =========== - CVE-2019-6128 (denial of service) The TIFFFdOpen function in tif_unix.c in LibTIFF 4.0.10 has a memory leak, as demonstrated by pal2rgb. - CVE-2019-7663 (denial of service) An Invalid Address dereference was discovered in TIFFWriteDirectoryTagTransferfunction in libtiff/tif_dirwrite.c in LibTIFF 4.0.10, affecting the cpSeparateBufToContigBuf function in tiffcp.c. Remote attackers could leverage this vulnerability to cause a denial-of-service via a crafted tiff file. Impact ====== A remote attacker is able to cause a denial of service. References ========== https://gitlab.com/libtiff/libtiff/commit/ae0bed1fe530a82faf2e9ea1775109dbf… https://gitlab.com/libtiff/libtiff/commit/802d3cbf3043be5dce5317e140ccb1c17… https://gitlab.com/libtiff/libtiff/merge_requests/60 https://security.archlinux.org/CVE-2019-6128 https://security.archlinux.org/CVE-2019-7663

1 0

[ASA-201911-12] linux-zen: arbitrary code execution
by Levente Polyak 14 Nov '19

14 Nov '19

Arch Linux Security Advisory ASA-201911-12 ========================================== Severity: Critical Date : 2019-11-13 CVE-ID : CVE-2019-17666 Package : linux-zen Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1066 Summary ======= The package linux-zen before version 5.3.9.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.3.9.1-1. # pacman -Syu "linux-zen>=5.3.9.1-1" The problem has been fixed upstream in version 5.3.9.1. Workaround ========== When Wi-Fi usage is not required, disabling it mitigates the issue. Description =========== rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel before 5.3.9, 4.19.82, 4.14.152, 4.9.199, 4.4.199 lacks a certain upper-bound check, leading to a buffer overflow. An attacker is able to trigger the overflow remotely through Wi-Fi by using a power- saving feature known as a Notice of Absence when the Realtek (RTLWIFI) driver is being used on the affected host leading to arbitrary code execution. Impact ====== A remote attacker in Wi-Fi range is able to execute arbitrary code when the Realtek (RTLWIFI) driver is being used on the affected host. References ========== https://lkml.org/lkml/2019/10/16/1226 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2019-17666

1 0

[ASA-201911-11] linux-lts: arbitrary code execution
by Levente Polyak 14 Nov '19

14 Nov '19

Arch Linux Security Advisory ASA-201911-11 ========================================== Severity: Critical Date : 2019-11-13 CVE-ID : CVE-2019-17666 Package : linux-lts Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1065 Summary ======= The package linux-lts before version 4.19.82-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 4.19.82-1. # pacman -Syu "linux-lts>=4.19.82-1" The problem has been fixed upstream in version 4.19.82. Workaround ========== When Wi-Fi usage is not required, disabling it mitigates the issue. Description =========== rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel before 5.3.9, 4.19.82, 4.14.152, 4.9.199, 4.4.199 lacks a certain upper-bound check, leading to a buffer overflow. An attacker is able to trigger the overflow remotely through Wi-Fi by using a power- saving feature known as a Notice of Absence when the Realtek (RTLWIFI) driver is being used on the affected host leading to arbitrary code execution. Impact ====== A remote attacker in Wi-Fi range is able to execute arbitrary code when the Realtek (RTLWIFI) driver is being used on the affected host. References ========== https://lkml.org/lkml/2019/10/16/1226 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2019-17666

1 0

[ASA-201911-10] linux: arbitrary code execution
by Levente Polyak 14 Nov '19

14 Nov '19

Arch Linux Security Advisory ASA-201911-10 ========================================== Severity: Critical Date : 2019-11-13 CVE-ID : CVE-2019-17666 Package : linux Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1064 Summary ======= The package linux before version 5.3.9.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.3.9.1-1. # pacman -Syu "linux>=5.3.9.1-1" The problem has been fixed upstream in version 5.3.9.1. Workaround ========== When Wi-Fi usage is not required, disabling it mitigates the issue. Description =========== rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel before 5.3.9, 4.19.82, 4.14.152, 4.9.199, 4.4.199 lacks a certain upper-bound check, leading to a buffer overflow. An attacker is able to trigger the overflow remotely through Wi-Fi by using a power- saving feature known as a Notice of Absence when the Realtek (RTLWIFI) driver is being used on the affected host leading to arbitrary code execution. Impact ====== A remote attacker in Wi-Fi range is able to execute arbitrary code when the Realtek (RTLWIFI) driver is being used on the affected host. References ========== https://lkml.org/lkml/2019/10/16/1226 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2019-17666

1 0

[ASA-201911-9] linux-hardened: arbitrary code execution
by Levente Polyak 07 Nov '19

07 Nov '19

Arch Linux Security Advisory ASA-201911-9 ========================================= Severity: Critical Date : 2019-11-07 CVE-ID : CVE-2019-17666 Package : linux-hardened Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1063 Summary ======= The package linux-hardened before version 5.3.7.b-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 5.3.7.b-1. # pacman -Syu "linux-hardened>=5.3.7.b-1" The problem has been fixed upstream in version 5.3.7.b. Workaround ========== When Wi-Fi usage is not required, disabling it mitigates the issue. Description =========== rtl_p2p_noa_ie in drivers/net/wireless/realtek/rtlwifi/ps.c in the Linux kernel before 5.3.9, 4.19.82, 4.14.152, 4.9.199, 4.4.199 lacks a certain upper-bound check, leading to a buffer overflow. An attacker is able to trigger the overflow remotely through Wi-Fi by using a power- saving feature known as a Notice of Absence when the Realtek (RTLWIFI) driver is being used on the affected host leading to arbitrary code execution. Impact ====== A remote attacker in Wi-Fi range is able to execute arbitrary code when the Realtek (RTLWIFI) driver is being used on the affected host. References ========== https://lkml.org/lkml/2019/10/16/1226 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… https://security.archlinux.org/CVE-2019-17666

1 0

[ASA-201911-8] squid: multiple issues
by Remi Gacogne 07 Nov '19

07 Nov '19

Arch Linux Security Advisory ASA-201911-8 ========================================= Severity: Critical Date : 2019-11-07 CVE-ID : CVE-2019-12526 CVE-2019-18678 CVE-2019-18679 Package : squid Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1062 Summary ======= The package squid before version 4.9-1 is vulnerable to multiple issues including arbitrary code execution, content spoofing and information disclosure. Resolution ========== Upgrade to 4.9-1. # pacman -Syu "squid>=4.9-1" The problems have been fixed upstream in version 4.9. Workaround ========== - CVE-2019-12526 Deny urn: protocol URI being proxied to all clients: acl URN proto URN http_access deny URN - CVE-2019-18678 There are no workarounds for this vulnerability. - CVE-2019-18679 Digest authentication can be disabled by removing all 'auth_param digest ...' configuration settings from squid.conf. Description =========== - CVE-2019-12526 (arbitrary code execution) A heap-based buffer overflow has been found in Squid before 4.9, when processing URN. - CVE-2019-18678 (content spoofing) A HTTP request splitting issue has been found in Squid before 4.9. This issue allows attackers to smuggle HTTP requests through frontend software to a Squid which splits the HTTP Request pipeline differently. The resulting Response messages corrupt caches between client and Squid with attacker controlled content at arbitrary URLs. - CVE-2019-18679 (information disclosure) An information disclosure issue has been found in Squid before 4.9, when processing HTTP Digest Authentication. The nonce tokens contain the raw byte value of a pointer which sits within heap memory allocation, which reduces ASLR protections and may aid attackers isolating memory areas to target for remote code execution attacks. Impact ====== A remote attacker might access sensitive information, corrupt the content of arbitrary URLs in the caches or execute arbitrary code. References ========== http://www.squid-cache.org/Advisories/SQUID-2019_7.txt http://www.squid-cache.org/Advisories/SQUID-2019_10.txt http://www.squid-cache.org/Advisories/SQUID-2019_11.txt http://www.squid-cache.org/Versions/v4/changesets/squid-4-7aa0184a720fd2161… http://www.squid-cache.org/Versions/v4/changesets/squid-4-671ba97abe929156d… http://www.squid-cache.org/Versions/v4/changesets/squid-4-671ba97abe929156d… https://security.archlinux.org/CVE-2019-12526 https://security.archlinux.org/CVE-2019-18678 https://security.archlinux.org/CVE-2019-18679

1 0

[ASA-201911-7] electron: arbitrary code execution
by Remi Gacogne 04 Nov '19

04 Nov '19

Arch Linux Security Advisory ASA-201911-7 ========================================= Severity: Critical Date : 2019-11-04 CVE-ID : CVE-2019-13720 Package : electron Type : arbitrary code execution Remote : Yes Link : https://security.archlinux.org/AVG-1061 Summary ======= The package electron before version 7.0.1-1 is vulnerable to arbitrary code execution. Resolution ========== Upgrade to 7.0.1-1. # pacman -Syu "electron>=7.0.1-1" The problem has been fixed upstream in version 7.0.1. Workaround ========== None. Description =========== A use-after-free vulnerability has been found in the audio component of the chromium browser before 78.0.3904.87. Google is aware of reports that an exploit for this vulnerability exists in the wild. Impact ====== A remote attacker can execute arbitrary code on the affected host. References ========== https://github.com/electron/electron/commit/25b3ee29cf9a8e3f59dcbabf7345b5b… https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-des… https://crbug.com/1019226 https://security.archlinux.org/CVE-2019-13720

1 0

[ASA-201911-6] samba: multiple issues
by Christian Rebischke 04 Nov '19

04 Nov '19

Arch Linux Security Advisory ASA-201911-6 ========================================= Severity: Medium Date : 2019-11-03 CVE-ID : CVE-2019-10218 CVE-2019-14833 CVE-2019-14847 Package : samba Type : multiple issues Remote : Yes Link : https://security.archlinux.org/AVG-1057 Summary ======= The package samba before version 4.10.10-1 is vulnerable to multiple issues including arbitrary filesystem access, insufficient validation and denial of service. Resolution ========== Upgrade to 4.10.10-1. # pacman -Syu "samba>=4.10.10-1" The problems have been fixed upstream in version 4.10.10. Workaround ========== None. Description =========== - CVE-2019-10218 (arbitrary filesystem access) An issue has been found in Samba before 4.10.10 where a malicious server can craft a pathname containing separators and return this to client code, causing the client to use this access local pathnames for reading or writing instead of SMB network pathnames. - CVE-2019-14833 (insufficient validation) A security issue has been found in Samba before 4.10.10, where the check password script does not receive the full password string when the password contains multi-byte (non-ASCII) characters. Since Samba Version 4.5.0 a Samba AD DC can use a custom command to verify the password complexity. The command can be specified with the "check password script" smb.conf parameter. This command is called when Samba handles a user password change or a new user password is set. The script receives the new cleartext password string in order to run custom password complexity checks like dictionary checks to avoid weak user passwords. If the check password script parameter is not specified, Samba runs the internal password quality checks. The internal check makes sure that a password contains characters from three of five different characters categories. - CVE-2019-14847 (denial of service) A denial of service has been found in Samba before 4.10.10, where users with the "get changes" extended access right can crash the AD DC LDAP server by requesting an attribute using the range= syntax. By default, the supported versions of Samba impacted by this issue run using the "standard" process model, which is unaffected. This is controlled by the -M or --model parameter to the samba binary. Unsupported Samba versions before Samba 4.7 use a single process for the LDAP server, and so are impacted. Samba 4.8, 4.9 and 4.10 are impacted if -M prefork or -M single is used. To mitigate this issue, select -M standard (the default). Impact ====== An attacker is able to access and write on files via arbitrary paths or crash the application. References ========== https://www.samba.org/samba/security/CVE-2019-10218.html https://www.samba.org/samba/ftp/patches/security/samba-4.10.9-security-2019… https://www.samba.org/samba/security/CVE-2019-14833.html https://download.samba.org/pub/samba/patches/security/samba-4.10.9-security… https://www.samba.org/samba/security/CVE-2019-14847.html https://security.archlinux.org/CVE-2019-10218 https://security.archlinux.org/CVE-2019-14833 https://security.archlinux.org/CVE-2019-14847

1 0

[ASA-201911-5] ghostscript: sandbox escape
by Christian Rebischke 04 Nov '19

04 Nov '19

Arch Linux Security Advisory ASA-201911-5 ========================================= Severity: High Date : 2019-11-03 CVE-ID : CVE-2019-14811 CVE-2019-14812 CVE-2019-14813 CVE-2019-14817 Package : ghostscript Type : sandbox escape Remote : No Link : https://security.archlinux.org/AVG-1031 Summary ======= The package ghostscript before version 9.50-1 is vulnerable to sandbox escape. Resolution ========== Upgrade to 9.50-1. # pacman -Syu "ghostscript>=9.50-1" The problems have been fixed upstream in version 9.50. Workaround ========== None. Description =========== - CVE-2019-14811 (sandbox escape) Safer Mode Bypass by .forceput Exposure in .pdf_hook_DSC_Creator. - CVE-2019-14812 (sandbox escape) Safer Mode Bypass by .forceput Exposure in setuserparams - CVE-2019-14813 (sandbox escape) Safer Mode Bypass by .forceput Exposure in setsystemparams - CVE-2019-14817 (sandbox escape) Safer Mode Bypass by .forceput Exposure in .pdfexectoken and other procedures. Impact ====== An attacker is able to escape the sandbox provided by ghostscript. References ========== https://marc.info/?l=oss-security&m=156699539604858 http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=885444fcbe10dc427… http://git.ghostscript.com/?p=ghostpdl.git;a=commitdiff;h=cd1b1cacadac2479e… https://security.archlinux.org/CVE-2019-14811 https://security.archlinux.org/CVE-2019-14812 https://security.archlinux.org/CVE-2019-14813 https://security.archlinux.org/CVE-2019-14817

1 0