[Security] Mitigation & Patch

elcore · 06-20-2023, 03:32 AM

Quote:

Fedora builds OpenH264 on its own and then uploads binary files back to Cisco where they're downloaded by Fedora users.

Comment source.

Meanwhile, Slackware stuck with outdated gmp plugin built by mozilla, which has 1. known security issues and 2. is hosted on servers where https cert has expired.

elcore · 06-20-2023, 06:05 AM

Sorry that last link's supposed to be 3662 not 3643. And ffmpeg openh264 works totally fine here, it's just gmp-api that's failing.

Additionally, to respect the thread title and talk more about the patch, rather than just mitigation:
This script from SBo is good for building libopenh264.so.2.3.1, h264dec, and h264enc.

Code:

# Slackware build script for openh264

# Copyright 2022-2023 Vijay Marcel
# All rights reserved.

Currently, it does not build libgmpopenh264.so (which is what Fedora appears to be doing, and also gentoo).
So now, there's no mechanism to upgrade gmp plugin, and everyone here relies on mozilla to ship one over insecure connection.
Only thing that made me realize this, is the habit of blocking port 80 in my house.

Regarding the patch for SBo script, gentoo ebuild was very helpful as it contains many hints on how to mitigate this properly.
Personally, I just pulled from github and copied gmp-api-Firefox114_2 into openh264 source tree and included yet another make command:

Code:

cp -R $CWD/gmp-api-* $TMP/$PRGNAM-$VERSION/gmp-api

Code:

make -C $TMP/$PRGNAM-$VERSION PREFIX="/usr" LIBDIR_NAME="lib${LIBDIRSUFFIX}" SHAREDLIB_DIR="/usr/lib${LIBDIRSUFFIX}"
make DESTDIR="$PKG" PREFIX="/usr" LIBDIR_NAME="lib${LIBDIRSUFFIX}" SHAREDLIB_DIR="/usr/lib${LIBDIRSUFFIX}" install

make OS=linux ARCH=$ARCH
install -Dm755 h264dec $PKG/usr/bin/h264dec
install -Dm755 h264enc $PKG/usr/bin/h264enc

make OS=linux ARCH=$ARCH plugin
install -Dm755 libgmpopenh264.so* $PKG/usr/lib${LIBDIRSUFFIX}/mozilla/plugins/gmp-gmpopenh264/system-installed/
install -Dm755 gmpopenh264.info $PKG/usr/lib${LIBDIRSUFFIX}/mozilla/plugins/gmp-gmpopenh264/system-installed/

I'm looking into simple ways to add another function for:

Code:

#/etc/profile.d/gmpopenh264.sh
MOZ_GMP_PATH="/usr/lib64/mozilla/plugins/gmp-gmpopenh264/system-installed"
export MOZ_GMP_PATH

And default firefox preference containing:

Code:

pref("media.gmp-gmpopenh264.autoupdate", false);
pref("media.gmp-gmpopenh264.version", "system-installed");

To prevent the browser from overwriting new plugin with the old, vulnerable one.
I've already solved it locally, just looking to improve the SlackBuild TBH.

marav · 06-26-2023, 07:18 AM

Vim

Code:

Divide-by-zero vulnerability in function scroll_cursor_bot

https://github.com/vim/vim/issues/12528

Patch:
Release >= 9.0.1664

marav · 06-26-2023, 04:59 PM

xfsprogs

Code:

"de.po:3087: 'msgstr' is not a valid C format string, unlike 'msgid'" error when building xfsprogs-6.3.0

https://savannah.gnu.org/bugs/index.php?64332#comment1

Patch:
https://gitweb.gentoo.org/repo/gento...0f6bc64e91e50b

marav · 07-24-2023, 10:19 AM

Pipewire

Code:

add missing stdbool.h include to version.h.in

Patch:
Rebuild to add missing include (which breaks building clients):
https://gitlab.freedesktop.org/pipew..._requests/1664

ponce · 07-24-2023, 03:08 PM

from Tavis Ormandy:

"Hello, this is CVE-2023-20593, a use-after-free in AMD Zen2 processors.

Yes, you read that right

This includes at least the following products:

- AMD Ryzen 3000 Series Processors
- AMD Ryzen PRO 3000 Series Processors
- AMD Ryzen Threadripper 3000 Series Processors
- AMD Ryzen 4000 Series Processors with Radeon Graphics
- AMD Ryzen PRO 4000 Series Processors
- AMD Ryzen 5000 Series Processors with Radeon Graphics
- AMD Ryzen 7020 Series Processors with Radeon Graphics
- AMD EPYC 7002 Series Processors

[...]

The practical result here is that you can spy on the registers of other
processes. No system calls or privileges are required.

It works across virtual machines and affects all operating systems.

I have written a poc for this issue that's fast enough to reconstruct
keys and passwords as users log in."

https://seclists.org/oss-sec/2023/q3/59

https://lock.cmpxchg8b.com/zenbleed.html

should be fixed with the next AMD firmware update (in the linux-firmware package)

elcore · 07-25-2023, 09:30 AM

Some news, from last thursday.
Note how the article title seems designed to cause panic.

tldr: if you got motherboards with AMI BIOS, better check your vendor for firmware upgrades soon.

Didier Spaier · 07-25-2023, 09:49 AM

CVE-2023-20593 has been fixed in the kernel-firmware package provided yesterday for -current. and 15.0, at least. I also upgraded the kernel-firmware package for Slint64-15.0 to fix this issue.

marav · 07-25-2023, 06:46 PM

xf86-video-nouveau

Code:

nv_driver.c:1451:23: warning: implicit declaration of function 'wfbScreenInit'; did you mean 'fbScreenInit'? [-Wimplicit-function-declaration]
 1451 |                 ret = wfbScreenInit(pScreen, FBStart, pScrn->virtualX,
      |                       ^~~~~~~~~~~~~
      |                       fbScreenInit

Patch:

Code:

xf86-video-nouveau calls wfbScreenInit without defining
FB_ACCESS_WRAPPER (which has other unintended side effects).
Presently, this compiles and links because compilers still support
implicit function declarations, but this is going to change fairly
soon.  This seems to be the most straightforward change to keep
the driver building.

https://gitlab.freedesktop.org/xorg/...c2117e19b9fcc7

marav · 08-08-2023, 11:14 AM

nftables

Needs this patch:
https://git.netfilter.org/nftables/c...4dade013a1e4f3

Python module also needs to be compiled separately

Code:

+    --disable-python
   make
+  cd py
+  python -m build --wheel --no-isolation

source:
https://bugs.archlinux.org/task/79229

cwizardone · 08-08-2023, 12:00 PM

Quote:

AMD "INCEPTION" CPU Vulnerability Disclosed
By Michael Larabel. 8 August 2023.
AMD has kicked off a busy Patch Tuesday by disclosing INCEPTION, a new speculative side channel attack affecting Zen 3 and Zen 4 processors...........

The full story can be found at, https://www.phoronix.com/news/AMD-INCEPTION

volkerdi · 08-08-2023, 01:29 PM

Quote:

Originally Posted by marav

nftables

Needs this patch:
https://git.netfilter.org/nftables/c...4dade013a1e4f3

Python module also needs to be compiled separately

Code:

+    --disable-python
   make
+  cd py
+  python -m build --wheel --no-isolation

source:
https://bugs.archlinux.org/task/79229

This will need to use python3, not python. Also, the python3 installer line is missing.

Due to missing modules for the new wheel installer method, this is less trivial than it appears, but ppr:kut has done some good work on the infrastructure that I suppose should be committed sooner rather than later, so I'll look into it. Thanks.

cwizardone · 08-08-2023, 02:25 PM

Quote:

Intel DOWNFALL: New Vulnerability Affecting AVX2/AVX-512 With Big Performance Implications
2 Hours Ago
This Patch Tuesday brings a new and potentially painful processor speculative execution vulnerability... Downfall, or as Intel prefers to call it is GDS: Gather Data Sampling. GDS/Downfall affects the gather instruction with AVX2 and AVX-512 enabled processors. At least the latest-generation Intel CPUs are not affected but Tigerlake / Ice Lake back to Skylake is confirmed to be impacted. There is microcode mitigation available but it will be costly for AVX2/AVX-512 workloads with GATHER instructions in hot code-paths and thus widespread software exposure particularly for HPC and other compute-intensive workloads that have relied on AVX2/AVX-512 for better performance.......

See the full article at, https://www.phoronix.com/review/downfall

Quote:

Linux 6.5 Patches Merged For Intel GDS/DOWNFALL, AMD INCEPTION
By Michael Larabel. 8 August 2023.
There used to be a time when Patch Tuesday wasn't so busy in the Linux space, but certainly not this month... Linus Torvalds just pushed the kernel code changes around AMD INCEPTION and Intel DOWNFALL as well as other security patches...........

Read the full article at, https://www.phoronix.com/news/Linux-...PTION-DOWNFALL

marav · 08-11-2023, 05:31 AM

krb5

CVE-2023-39975
Fix double-free in KDC TGS processing

Code:

In MIT krb5 release 1.21, an authenticated attacker can cause a KDC to
free the same pointer twice if it can induce a failure in
authorization data handling.

Patch:
https://github.com/krb5/krb5/commit/...26952d3641d840

marav · 08-13-2023, 06:13 AM

Pipewire 0.3.77

duplicated sinks after resume or switching audio device profiles

Code:

When my system resumes from suspend state, or switch profiles, my audio device will have multiple options, 
in fact I only have one input device and one output device

https://gitlab.freedesktop.org/pipew.../-/issues/3414

Patch:
https://gitlab.freedesktop.org/pipew...e3bdc7889c2d1e