Date: Thu, 31 Aug 2023 06:03:32 GMT From: Philip Paeps <philip@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: d6f580f7470f - main - security/vuxml: catch up with recent FreeBSD SAs Message-ID: <202308310603.37V63WGV001101@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by philip: URL: https://cgit.FreeBSD.org/ports/commit/?id=d6f580f7470f1b7714bb26ea743ccc83344add2b commit d6f580f7470f1b7714bb26ea743ccc83344add2b Author: Philip Paeps <philip@FreeBSD.org> AuthorDate: 2023-08-31 06:01:56 +0000 Commit: Philip Paeps <philip@FreeBSD.org> CommitDate: 2023-08-31 06:01:56 +0000 security/vuxml: catch up with recent FreeBSD SAs Add FreeBSD SAs issued since FreeBSD-SA-22:13.zlib in August 2022. 2022-11-15 FreeBSD-SA-22:14.heimdal 2022-11-29 FreeBSD-SA-22:15.ping 2023-02-08 FreeBSD-SA-23:01.geli 2023-02-16 FreeBSD-SA-23:02.openssh 2023-02-16 FreeBSD-SA-23:03.openssl 2023-06-21 FreeBSD-SA-23:04.pam_krb5 2023-06-21 FreeBSD-SA-23:05.openssh 2023-08-01 FreeBSD-SA-23:06.ipv6 2023-08-01 FreeBSD-SA-23:07.bhyve 2023-08-01 FreeBSD-SA-23:08.ssh 2023-08-01 FreeBSD-SA-23:09.pam_krb5 --- security/vuxml/vuln/2023.xml | 451 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 451 insertions(+) diff --git a/security/vuxml/vuln/2023.xml b/security/vuxml/vuln/2023.xml index 2a5ec150d30c..004ff289d908 100644 --- a/security/vuxml/vuln/2023.xml +++ b/security/vuxml/vuln/2023.xml @@ -1,3 +1,454 @@ + <vuln vid="9b0d9832-47c1-11ee-8e38-002590c1f29c"> + <topic>FreeBSD -- Network authentication attack via pam_krb5</topic> + <affects> + <package> + <name>FreeBSD</name> + <range><ge>13.2</ge><lt>13.2_2</lt></range> + <range><ge>13.1</ge><lt>13.1_9</lt></range> + <range><ge>12.4</ge><lt>12.4_4</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>The problem detailed in FreeBSD-SA-23:04.pam_krb5 persisted following + the patch for that advisory.</p> + <h1>Impact:</h1> + <p>The impact described in FreeBSD-SA-23:04.pam_krb5 persists.</p> + </body> + </description> + <references> + <cvename>2023-3326</cvename> + <freebsdsa>SA-23:09.pam_krb5</freebsdsa> + </references> + <dates> + <discovery>2023-08-01</discovery> + <entry>2023-08-31</entry> + </dates> + </vuln> + + <vuln vid="291d0953-47c1-11ee-8e38-002590c1f29c"> + <topic>FreeBSD -- Potential remote code execution via ssh-agent forwarding</topic> + <affects> + <package> + <name>FreeBSD</name> + <range><ge>13.2</ge><lt>13.2_2</lt></range> + <range><ge>13.1</ge><lt>13.1_9</lt></range> + <range><ge>12.4</ge><lt>12.4_4</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>The server may cause ssh-agent to load shared libraries other than + those required for PKCS#11 support. These shared libraries may have + side effects that occur on load and unload (dlopen and dlclose).</p> + <h1>Impact:</h1> + <p>An attacker with access to a server that accepts a forwarded + ssh-agent connection may be able to execute code on the machine running + ssh-agent. Note that the attack relies on properties of operating + system-provided libraries. This has been demonstrated on other + operating systems; it is unknown whether this attack is possible using + the libraries provided by a FreeBSD installation.</p> + </body> + </description> + <references> + <cvename>2023-38408</cvename> + <freebsdsa>SA-23:08.ssh</freebsdsa> + </references> + <dates> + <discovery>2023-08-01</discovery> + <entry>2023-08-31</entry> + </dates> + </vuln> + + <vuln vid="ab437561-47c0-11ee-8e38-002590c1f29c"> + <topic>FreeBSD -- bhyve privileged guest escape via fwctl</topic> + <affects> + <package> + <name>FreeBSD</name> + <range><ge>13.2</ge><lt>13.2_2</lt></range> + <range><ge>13.1</ge><lt>13.1_9</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>The fwctl driver implements a state machine which is executed when + the guest accesses certain x86 I/O ports. The interface lets the guest + copy a string into a buffer resident in the bhyve process' memory. A + bug in the state machine implementation can result in a buffer + overflowing when copying this string.</p> + <h1>Impact:</h1> + <p>A malicious, privileged software running in a guest VM can exploit + the buffer overflow to achieve code execution on the host in the bhyve + userspace process, which typically runs as root. Note that bhyve runs + in a Capsicum sandbox, so malicious code is constrained by the + capabilities available to the bhyve process.</p> + </body> + </description> + <references> + <cvename>2023-3494</cvename> + <freebsdsa>SA-23:07.bhyve</freebsdsa> + </references> + <dates> + <discovery>2023-08-01</discovery> + <entry>2023-08-31</entry> + </dates> + </vuln> + + <vuln vid="3dabf5b8-47c0-11ee-8e38-002590c1f29c"> + <topic>FreeBSD -- Remote denial of service in IPv6 fragment reassembly</topic> + <affects> + <package> + <name>FreeBSD-kernel</name> + <range><ge>13.2</ge><lt>13.2_2</lt></range> + <range><ge>13.1</ge><lt>13.1_9</lt></range> + <range><ge>12.4</ge><lt>12.4_4</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>Each fragment of an IPv6 packet contains a fragment header which + specifies the offset of the fragment relative to the original packet, + and each fragment specifies its length in the IPv6 header. When + reassembling the packet, the kernel calculates the complete IPv6 payload + length. The payload length must fit into a 16-bit field in the IPv6 + header.</p> + <p>Due to a bug in the kernel, a set of carefully crafted packets can + trigger an integer overflow in the calculation of the reassembled + packet's payload length field.</p> + <h1>Impact:</h1> + <p>Once an IPv6 packet has been reassembled, the kernel continues + processing its contents. It does so assuming that the fragmentation + layer has validated all fields of the constructed IPv6 header. This bug + violates such assumptions and can be exploited to trigger a remote + kernel panic, resulting in a denial of service.</p> + </body> + </description> + <references> + <cvename>2023-3107</cvename> + <freebsdsa>SA-23:06.ipv6</freebsdsa> + </references> + <dates> + <discovery>2023-08-01</discovery> + <entry>2023-08-31</entry> + </dates> + </vuln> + + <vuln vid="e31a8f8e-47bf-11ee-8e38-002590c1f29c"> + <topic>FreeBSD -- ssh-add does not honor per-hop destination constraints</topic> + <affects> + <package> + <name>FreeBSD</name> + <range><ge>12.4</ge><lt>12.4_3</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>When using ssh-add(1) to add smartcard keys to ssh-agent(1) with + per-hop destination constraints, a logic error prevented the constraints + from being sent to the agent resulting in keys being added to the agent + without constraints.</p> + <h1>Impact:</h1> + <p>A malicious server could leverage the keys provided by a forwarded + agent that would normally not be allowed due to the logic error.</p> + </body> + </description> + <references> + <cvename>2023-28531</cvename> + <freebsdsa>SA-23:05.openssh</freebsdsa> + </references> + <dates> + <discovery>2023-06-21</discovery> + <entry>2023-08-31</entry> + </dates> + </vuln> + + <vuln vid="41af0277-47bf-11ee-8e38-002590c1f29c"> + <topic>FreeBSD -- Network authentication attack via pam_krb5</topic> + <affects> + <package> + <name>FreeBSD</name> + <range><ge>13.2</ge><lt>13.2_1</lt></range> + <range><ge>13.1</ge><lt>13.1_8</lt></range> + <range><ge>12.4</ge><lt>12.4_3</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>pam_krb5 authenticates the user by essentially running kinit(1) with + the password, getting a `ticket-granting ticket' (tgt) from the Kerberos + KDC (Key Distribution Center) over the network, as a way to verify the + password.</p> + <p>Normally, the system running the pam_krb5 module will also have a + keytab, a key provisioned by the KDC. The pam_krb5 module will use the + tgt to get a service ticket and validate it against the keytab, ensuring + the tgt is valid and therefore, the password is valid.</p> + <p>However, if a keytab is not provisioned on the system, pam_krb5 has + no way to validate the response from the KDC, and essentially trusts the + tgt provided over the network as being valid.</p> + <h1>Impact:</h1> + <p>In a non-default FreeBSD installation that leverages pam_krb5 for + authentication and does not have a keytab provisioned, an attacker that + is able to control both the password and the KDC responses can return a + valid tgt, allowing authentication to occur for any user on the + system.</p> + </body> + </description> + <references> + <cvename>2023-3326</cvename> + <freebsdsa>SA-23:04.pam_krb5</freebsdsa> + </references> + <dates> + <discovery>2023-06-21</discovery> + <entry>2023-08-31</entry> + </dates> + </vuln> + + <vuln vid="c8eb4c40-47bd-11ee-8e38-002590c1f29c"> + <topic>FreeBSD -- Multiple vulnerabilities in OpenSSL</topic> + <affects> + <package> + <name>FreeBSD</name> + <range><ge>13.1</ge><lt>13.1_7</lt></range> + <range><ge>12.4</ge><lt>12.4_2</lt></range> + <range><ge>12.3</ge><lt>12.3_12</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <h2>X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)</h2> + <p>There is a type confusion vulnerability relating to X.400 address processing + inside an X.509 GeneralName. X.400 addresses were parsed as an ASN1_STRING but + the public structure definition for GENERAL_NAME incorrectly specified the type + of the x400Address field as ASN1_TYPE. This field is subsequently interpreted by + the OpenSSL function GENERAL_NAME_cmp as an ASN1_TYPE rather than an + ASN1_STRING.</p> + <h2>Timing Oracle in RSA Decryption (CVE-2022-4304)</h2> + <p>A timing based side channel exists in the OpenSSL RSA Decryption + implementation.</p> + <h2>Use-after-free following BIO_new_NDEF (CVE-2023-0215)</h2> + <p>The public API function BIO_new_NDEF is a helper function used for streaming + ASN.1 data via a BIO. It is primarily used internally to OpenSSL to support + the SMIME, CMS and PKCS7 streaming capabilities, but may also be called + directly by end user applications.</p> + <p>The function receives a BIO from the caller, prepends a new BIO_f_asn1 filter + BIO onto the front of it to form a BIO chain, and then returns the new head + of the BIO chain to the caller. Under certain conditions, for example if a + CMS recipient public key is invalid, the new filter BIO is freed and the + function returns a NULL result indicating a failure. However, in this case, + the BIO chain is not properly cleaned up and the BIO passed by the caller + still retains internal pointers to the previously freed filter BIO.</p> + <h2>Double free after calling PEM_read_bio_ex (CVE-2022-4450)</h2> + <p>The function PEM_read_bio_ex() reads a PEM file from a BIO and parses and + decodes the "name" (e.g. "CERTIFICATE"), any header data and the payload + data. If the function succeeds then the "name_out", "header" and "data" + arguments are populated with pointers to buffers containing the relevant + decoded data. The caller is responsible for freeing those buffers. It is + possible to construct a PEM file that results in 0 bytes of payload data. In + this case PEM_read_bio_ex() will return a failure code but will populate the + header argument with a pointer to a buffer that has already been freed.</p> + <h1>Impact:</h1> + <h2>X.400 address type confusion in X.509 GeneralName (CVE-2023-0286)</h2> + <p>When CRL checking is enabled (i.e. the application sets the + X509_V_FLAG_CRL_CHECK flag), this vulnerability may allow an attacker to pass + arbitrary pointers to a memcmp call, enabling them to read memory contents or + enact a denial of service. In most cases, the attack requires the attacker to + provide both the certificate chain and CRL, neither of which need to have a + valid signature. If the attacker only controls one of these inputs, the other + input must already contain an X.400 address as a CRL distribution point, which + is uncommon. As such, this vulnerability is most likely to only affect + applications which have implemented their own functionality for retrieving CRLs + over a network.</p> + <h2>Timing Oracle in RSA Decryption (CVE-2022-4304)</h2> + <p>A timing based side channel exists in the OpenSSL RSA Decryption implementation + which could be sufficient to recover a plaintext across a network in a + Bleichenbacher style attack. To achieve a successful decryption an attacker + would have to be able to send a very large number of trial messages for + decryption. The vulnerability affects all RSA padding modes: PKCS#1 v1.5, + RSA-OEAP and RSASVE.</p> + <h2>Use-after-free following BIO_new_NDEF (CVE-2023-0215)</h2> + <p>A use-after-free will occur under certain conditions. This will most likely + result in a crash.</p> + <h2>Double free after calling PEM_read_bio_ex (CVE-2022-4450)</h2> + <p>A double free may occur. This will most likely lead to a crash. This could be + exploited by an attacker who has the ability to supply malicious PEM files + for parsing to achieve a denial of service attack.</p> + </body> + </description> + <references> + <cvename>2023-0286</cvename> + <cvename>2023-0215</cvename> + <cvename>2022-4450</cvename> + <cvename>2022-4304</cvename> + <freebsdsa>SA-23:03.openssl</freebsdsa> + </references> + <dates> + <discovery>2023-02-16</discovery> + <entry>2023-08-31</entry> + </dates> + </vuln> + + <vuln vid="09b7cd39-47bd-11ee-8e38-002590c1f29c"> + <topic>FreeBSD -- OpenSSH pre-authentication double free</topic> + <affects> + <package> + <name>FreeBSD</name> + <range><ge>12.4</ge><lt>12.4_2</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>A flaw in the backwards-compatibility key exchange route allows a + pointer to be freed twice.</p> + <h1>Impact:</h1> + <p>A remote, unauthenticated attacker may be able to cause a denial of + service, or possibly remote code execution.</p> + <p>Note that FreeBSD 12.3 and FreeBSD 13.1 include older versions of + OpenSSH, and are not affected. FreeBSD 13.2-BETA1 and later include the + fix.</p> + </body> + </description> + <references> + <cvename>2023-25136</cvename> + <freebsdsa>SA-23:02.openssh</freebsdsa> + </references> + <dates> + <discovery>2023-02-16</discovery> + <entry>2023-08-31</entry> + </dates> + </vuln> + + <vuln vid="3fcab88b-47bc-11ee-8e38-002590c1f29c"> + <topic>FreeBSD -- GELI silently omits the keyfile if read from stdin</topic> + <affects> + <package> + <name>FreeBSD-kernel</name> + <range><ge>13.1</ge><lt>13.1_6</lt></range> + <range><ge>12.4</ge><lt>12.4_1</lt></range> + <range><ge>12.3</ge><lt>12.3_11</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>When GELI reads a key file from a standard input, it doesn't store it + anywhere. If the user tries to initialize multiple providers at once, + for the second and subsequent devices the standard input stream will be + already empty. In this case, GELI silently uses a NULL key as the user + key file. If the user used only a key file without a user passphrase, + the master key was encrypted with an empty key file. This might not be + noticed if the devices were also decrypted in a batch operation.</p> + <h1>Impact:</h1> + <p>Some GELI providers might be silently encrypted with a NULL key + file.</p> + </body> + </description> + <references> + <cvename>2023-0751</cvename> + <freebsdsa>SA-23:01.geli</freebsdsa> + </references> + <dates> + <discovery>2023-02-08</discovery> + <entry>2023-08-31</entry> + </dates> + </vuln> + + <vuln vid="a005aea9-47bb-11ee-8e38-002590c1f29c"> + <topic>FreeBSD -- Stack overflow in ping(8)</topic> + <affects> + <package> + <name>FreeBSD</name> + <range><ge>13.1</ge><lt>13.1_5</lt></range> + <range><ge>12.3</ge><lt>12.3_10</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>ping reads raw IP packets from the network to process responses in + the pr_pack() function. As part of processing a response ping has to + reconstruct the IP header, the ICMP header and if present a "quoted + packet," which represents the packet that generated an ICMP error. + The quoted packet again has an IP header and an ICMP header.</p> + <p>The pr_pack() copies received IP and ICMP headers into stack buffers + for further processing. In so doing, it fails to take into account the + possible presence of IP option headers following the IP header in either + the response or the quoted packet. When IP options are present, + pr_pack() overflows the destination buffer by up to 40 bytes.</p> + <h1>Impact:</h1> + <p>The memory safety bugs described above can be triggered by a remote + host, causing the ping program to crash.</p> + <p>The ping process runs in a capability mode sandbox on all affected + versions of FreeBSD and is thus very constrained in how it can interact + with the rest of the system at the point where the bug can occur.</p> + </body> + </description> + <references> + <cvename>2022-23093</cvename> + <freebsdsa>SA-22:15.ping</freebsdsa> + </references> + <dates> + <discovery>2022-11-29</discovery> + <entry>2023-08-31</entry> + </dates> + </vuln> + + <vuln vid="97c1b0f7-47b9-11ee-8e38-002590c1f29c"> + <topic>FreeBSD -- Multiple vulnerabilities in Heimdal</topic> + <affects> + <package> + <name>FreeBSD</name> + <range><ge>13.1</ge><lt>13.1_4</lt></range> + <range><ge>12.3</ge><lt>12.3_9</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <h1>Problem Description:</h1> + <p>Multiple security vulnerabilities have been discovered in the Heimdal + implementation of the Kerberos 5 network authentication + protocols and KDC.</p> + <ul> + <li>CVE-2022-42898 PAC parse integer overflows</li> + <li>CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and arcfour</li> + <li>CVE-2021-44758 NULL dereference DoS in SPNEGO acceptors</li> + <li>CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec</li> + <li>CVE-2019-14870 Validate client attributes in protocol-transition</li> + <li>CVE-2019-14870 Apply forwardable policy in protocol-transition</li> + <li>CVE-2019-14870 Always lookup impersonate client in DB</li> + </ul> + <h1>Impact:</h1> + <p>A malicious actor with control of the network between a client and a + service using Kerberos for authentication can impersonate either the + client or the service, enabling a man-in-the-middle (MITM) attack + circumventing mutual authentication.</p> + <p>Note that, while CVE-2022-44640 is a severe vulnerability, possibly + enabling remote code execution on other platforms, the version of + Heimdal included with the FreeBSD base system cannot be exploited in + this way on FreeBSD.</p> + </body> + </description> + <references> + <cvename>2019-14870</cvename> + <cvename>2021-44758</cvename> + <cvename>2022-3437</cvename> + <cvename>2022-42898</cvename> + <cvename>2022-44640</cvename> + <freebsdsa>SA-22:14.heimdal</freebsdsa> + </references> + <dates> + <discovery>2022-11-15</discovery> + <entry>2023-08-31</entry> + </dates> + </vuln> + <vuln vid="22fffa69-46fa-11ee-8290-a8a1599412c6"> <topic>chromium -- use after free in MediaStream</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202308310603.37V63WGV001101>