[USN-7275-2] Libtasn1 vulnerability
[USN-7280-1] Python vulnerability
[LSN-0109-1] Linux kernel vulnerability
[USN-7279-1] WebKitGTK vulnerabilities
[USN-7281-1] GnuTLS vulnerability
[USN-7278-1] OpenSSL vulnerabilities
[USN-7275-2] Libtasn1 vulnerability
==========================================================================
Ubuntu Security Notice USN-7275-2
February 20, 2025
libtasn1-6 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
Summary:
Libtasn1 could be made to crash if it received specially crafted network
traffic.
Software Description:
- libtasn1-6: Library to manage ASN.1 structures
Details:
USN-7275-1 fixed vulnerabilities in Libtasn1. This update provides the
corresponding updates for Ubuntu 24.04 LTS.
Original advisory details:
Bing Shi discovered that Libtasn1 inefficiently handled certificates. An
attacker could possibly use this issue to increase resource utilization
leading to a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
libtasn1-6 4.19.0-3ubuntu0.24.04.1
libtasn1-bin 4.19.0-3ubuntu0.24.04.1
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7275-2
https://ubuntu.com/security/notices/USN-7275-1
CVE-2024-12133
Package Information:
https://launchpad.net/ubuntu/+source/libtasn1-6/4.19.0-3ubuntu0.24.04.1
[USN-7280-1] Python vulnerability
==========================================================================
Ubuntu Security Notice USN-7280-1
February 20, 2025
python3.10, python3.12, python3.8 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Python could allow Server-Side Request Forgery attacks.
Software Description:
- python3.12: An interactive high-level object-oriented language
- python3.10: An interactive high-level object-oriented language
- python3.8: An interactive high-level object-oriented language
Details:
It was discovered that Python incorrectly handled parsing domain names that
included square brackets. A remote attacker could possibly use this issue
to perform a Server-Side Request Forgery (SSRF) attack.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
python3.12 3.12.7-1ubuntu2
python3.12-minimal 3.12.7-1ubuntu2
Ubuntu 24.04 LTS
python3.12 3.12.3-1ubuntu0.5
python3.12-minimal 3.12.3-1ubuntu0.5
Ubuntu 22.04 LTS
python3.10 3.10.12-1~22.04.9
python3.10-minimal 3.10.12-1~22.04.9
Ubuntu 20.04 LTS
python3.8 3.8.10-0ubuntu1~20.04.15
python3.8-minimal 3.8.10-0ubuntu1~20.04.15
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7280-1
CVE-2025-0938
Package Information:
https://launchpad.net/ubuntu/+source/python3.12/3.12.7-1ubuntu2
https://launchpad.net/ubuntu/+source/python3.12/3.12.3-1ubuntu0.5
https://launchpad.net/ubuntu/+source/python3.10/3.10.12-1~22.04.9
https://launchpad.net/ubuntu/+source/python3.8/3.8.10-0ubuntu1~20.04.15
[LSN-0109-1] Linux kernel vulnerability
Linux kernel vulnerabilities
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 LTS
- Ubuntu 22.04 LTS
Summary
Several security issues were fixed in the kernel.
Software Description
- linux - Linux kernel
- linux-aws - Linux kernel for Amazon Web Services (AWS) systems
- linux-azure - Linux kernel for Microsoft Azure Cloud systems
- linux-gcp - Linux kernel for Google Cloud Platform (GCP) systems
- linux-gke - Linux kernel for Google Container Engine (GKE) systems
- linux-gkeop - Linux kernel for Google Container Engine (GKE) systems
- linux-ibm - Linux kernel for IBM cloud systems
- linux-oracle - Linux kernel for Oracle Cloud systems
Details
In the Linux kernel, the following vulnerability has been resolved: tls:
fix use-after-free on failed backlog decryption When the decrypt request
goes to the backlog and crypto_aead_decrypt returns -EBUSY,
tls_do_decryption will wait until all async decryptions have completed.
If one of them fails, tls_do_decryption will return -EBADMSG and
tls_decrypt_sg jumps to the error path, releasing all the pages. But the
pages have been passed to the async callback, and have already been
released by tls_decrypt_done. The only true async case is when
crypto_aead_decrypt returns -EINPROGRESS. With -EBUSY, we already waited
so we can tell tls_sw_recvmsg that the data is available for immediate
copy, but we need to notify tls_decrypt_sg (via the new ->async_done
flag) that the memory has already been released. (CVE-2024-26800)
In the Linux kernel, the following vulnerability has been resolved:
inet: inet_defrag: prevent sk release while still in use ip_local_out()
and other functions can pass skb->sk as function argument. If the skb is
a fragment and reassembly happens before such function call returns, the
sk must not be released. This affects skb fragments reassembled via
netfilter or similar modules, e.g. openvswitch or ct_act.c, when run as
part of tx pipeline. Eric Dumazet made an initial analysis of this bug.
Quoting Eric: Calling ip_defrag() in output path is also implying
skb_orphan(), which is buggy because output path relies on sk not
disappearing. A relevant old patch about the issue was : 8282f27449bf
(“inet: frag: Always orphan skbs inside ip_defrag()”) [..
net/ipv4/ip_output.c depends on skb->sk being set, and probably to an
inet socket, not an arbitrary one. If we orphan the packet in ipvlan,
then downstream things like FQ packet scheduler will not work properly.
We need to change ip_defrag() to only use skb_orphan() when really
needed, ie whenever frag_list is going to be used. Eric suggested to
stash sk in fragment queue and made an initial patch. However there is a
problem with this: If skb is refragmented again right after,
ip_do_fragment() will copy head->sk to the new fragments, and sets up
destructor to sock_wfree. IOW, we have no choice but to fix up sk_wmem
accouting to reflect the fully reassembled skb, else wmem will
underflow. This change moves the orphan down into the core, to last
possible moment. As ip_defrag_offset is aliased with sk_buff->sk member,
we must move the offset into the FRAG_CB, else skb->sk gets clobbered.
This allows to delay the orphaning long enough to learn if the skb has
to be queued or if the skb is completing the reasm queue. In the former
case, things work as before, skb is orphaned. This is safe because skb
gets queued/stolen and won’t continue past reasm engine. In the latter
case, we will steal the skb->sk reference, reattach it to the head skb,
and fix up wmem accouting when inet_frag inflates truesize.
(CVE-2024-26921)
In the Linux kernel, the following vulnerability has been resolved:
watchdog: cpu5wdt.c: Fix use-after-free bug caused by cpu5wdt_trigger
When the cpu5wdt module is removing, the origin code uses del_timer() to
de-activate the timer. If the timer handler is running, del_timer()
could not stop it and will return directly. If the port region is
released by release_region() and then the timer handler
cpu5wdt_trigger() calls outb() to write into the region that is
released, the use-after-free bug will happen. Change del_timer() to
timer_shutdown_sync() in order that the timer handler could be finished
before the port region is released. (CVE-2024-38630)
In the Linux kernel, the following vulnerability has been resolved:
exec: Fix ToCToU between perm check and set-uid/gid usage When opening a
file for exec via do_filp_open(), permission checking is done against
the file’s metadata at that moment, and on success, a file pointer is
passed back. Much later in the execve() code path, the file metadata
(specifically mode, uid, and gid) is used to determine if/how to set the
uid and gid. However, those values may have changed since the
permissions check, meaning the execution may gain unintended privileges.
For example, if a file could change permissions from executable and not
set-id: ———x 1 root root 16048 Aug 7 13:16 target to set-id and non-
executable: —S—— 1 root root 16048 Aug 7 13:16 target it is possible to
gain root privileges when execution should have been disallowed. While
this race condition is rare in real-world scenarios, it has been
observed (and proven exploitable) when package managers are updating the
setuid bits of installed programs. Such files start with being
world-executable but then are adjusted to be group-exec with a set-uid
bit. For example, “chmod o-x,u+s target” makes “target” executable only
by uid “root” and gid “cdrom”, while also becoming setuid-root:
-rwxr-xr-x 1 root cdrom 16048 Aug 7 13:16 target becomes: -rwsr-xr– 1
root cdrom 16048 Aug 7 13:16 target But racing the chmod means users
without group “cdrom” membership can get the permission to execute
“target” just before the chmod, and when the chmod finishes, the exec
reaches brpm_fill_uid(), and performs the setuid to root, violating the
expressed authorization of “only cdrom group members can setuid to
root”. Re-check that we still have execute permissions in case the
metadata has changed. It would be better to keep a copy from the
perm-check time, but until we can do that refactoring, the least-bad
option is to do a full inode_permission() call (under inode lock). It is
understood that this is safe against dead-locks, but hardly optimal.
(CVE-2024-43882)
In the Linux kernel, the following vulnerability has been resolved:
vsock/virtio: Initialization of the dangling pointer occurring in
vsk->trans During loopback communication, a dangling pointer can be
created in vsk->trans, potentially leading to a Use-After-Free
condition. This issue is resolved by initializing vsk->trans to NULL.
(CVE-2024-50264)
In the Linux kernel, the following vulnerability has been resolved:
hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer
When hvs is released, there is a possibility that vsk->trans may not be
initialized to NULL, which could lead to a dangling pointer. This issue
is resolved by initializing vsk->trans to NULL. (CVE-2024-53103)
Update instructions
The problem can be corrected by updating your kernel livepatch to the
following versions:
Ubuntu 20.04 LTS
aws - 109.1
aws - 109.2
azure - 109.1
azure - 109.2
gcp - 109.1
gcp - 109.2
generic - 109.1
generic - 109.2
gkeop - 109.1
gkeop - 109.2
ibm - 109.1
ibm - 109.2
lowlatency - 109.1
lowlatency - 109.2
oracle - 109.1
oracle - 109.2
Ubuntu 18.04 LTS
aws - 109.1
aws - 109.2
azure - 109.1
azure - 109.2
gcp - 109.1
gcp - 109.2
generic - 109.1
generic - 109.2
lowlatency - 109.1
lowlatency - 109.2
oracle - 109.1
oracle - 109.2
Ubuntu 16.04 LTS
aws - 109.1
aws - 109.2
azure - 109.1
gcp - 109.1
generic - 109.1
generic - 109.2
lowlatency - 109.1
lowlatency - 109.2
Ubuntu 22.04 LTS
aws - 109.1
aws - 109.2
azure - 109.1
azure - 109.2
gcp - 109.1
gcp - 109.2
generic - 109.1
generic - 109.2
gke - 109.1
gke - 109.2
ibm - 109.1
ibm - 109.2
oracle - 109.1
oracle - 109.2
Support Information
Livepatches for supported LTS kernels will receive upgrades for a period
of up to 13 months after the build date of the kernel.
Livepatches for supported HWE kernels which are not based on an LTS
kernel version will receive upgrades for a period of up to 9 months
after the build date of the kernel, or until the end of support for that
kernel’s non-LTS distro release version, whichever is sooner.
References
- CVE-2024-26800
- CVE-2024-26921
- CVE-2024-38630
- CVE-2024-43882
- CVE-2024-50264
- CVE-2024-53103
[USN-7279-1] WebKitGTK vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7279-1
February 20, 2025
webkit2gtk vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
Summary:
Several security issues were fixed in WebKitGTK.
Software Description:
- webkit2gtk: Web content engine library for GTK+
Details:
Several security issues were discovered in the WebKitGTK Web and JavaScript
engines. If a user were tricked into viewing a malicious website, a remote
attacker could exploit a variety of issues related to web browser security,
including cross-site scripting attacks, denial of service attacks, and
arbitrary code execution.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
libjavascriptcoregtk-4.1-0 2.46.6-0ubuntu0.24.10.1
libjavascriptcoregtk-6.0-1 2.46.6-0ubuntu0.24.10.1
libwebkit2gtk-4.1-0 2.46.6-0ubuntu0.24.10.1
libwebkitgtk-6.0-4 2.46.6-0ubuntu0.24.10.1
Ubuntu 24.04 LTS
libjavascriptcoregtk-4.1-0 2.46.6-0ubuntu0.24.04.1
libjavascriptcoregtk-6.0-1 2.46.6-0ubuntu0.24.04.1
libwebkit2gtk-4.1-0 2.46.6-0ubuntu0.24.04.1
libwebkitgtk-6.0-4 2.46.6-0ubuntu0.24.04.1
Ubuntu 22.04 LTS
libjavascriptcoregtk-4.0-18 2.46.6-0ubuntu0.22.04.1
libjavascriptcoregtk-4.1-0 2.46.6-0ubuntu0.22.04.1
libjavascriptcoregtk-6.0-1 2.46.6-0ubuntu0.22.04.1
libwebkit2gtk-4.0-37 2.46.6-0ubuntu0.22.04.1
libwebkit2gtk-4.1-0 2.46.6-0ubuntu0.22.04.1
libwebkitgtk-6.0-4 2.46.6-0ubuntu0.22.04.1
This update uses a new upstream release, which includes additional bug
fixes. After a standard system update you need to restart any applications
that use WebKitGTK, such as Epiphany, to make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7279-1
CVE-2025-24143, CVE-2025-24150, CVE-2025-24158, CVE-2025-24162
Package Information:
https://launchpad.net/ubuntu/+source/webkit2gtk/2.46.6-0ubuntu0.24.10.1
https://launchpad.net/ubuntu/+source/webkit2gtk/2.46.6-0ubuntu0.24.04.1
https://launchpad.net/ubuntu/+source/webkit2gtk/2.46.6-0ubuntu0.22.04.1
[USN-7281-1] GnuTLS vulnerability
==========================================================================
Ubuntu Security Notice USN-7281-1
February 20, 2025
gnutls28 vulnerability
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.10
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
GnuTLS could be made to consume resources if it decoded specially crafted
certificates.
Software Description:
- gnutls28: GNU TLS library
Details:
Bing Shi discovered that GnuTLS incorrectly handled decoding certain
DER-encoded certificates. A remote attacker could possibly use this issue
to cause GnuTLS to consume resources, leading to a denial of service.
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.10
libgnutls30t64 3.8.6-2ubuntu1.1
Ubuntu 24.04 LTS
libgnutls30t64 3.8.3-1.1ubuntu3.3
Ubuntu 22.04 LTS
libgnutls30 3.7.3-4ubuntu1.6
Ubuntu 20.04 LTS
libgnutls30 3.6.13-2ubuntu1.12
In general, a standard system update will make all the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7281-1
CVE-2024-12243
Package Information:
https://launchpad.net/ubuntu/+source/gnutls28/3.8.6-2ubuntu1.1
https://launchpad.net/ubuntu/+source/gnutls28/3.8.3-1.1ubuntu3.3
https://launchpad.net/ubuntu/+source/gnutls28/3.7.3-4ubuntu1.6
https://launchpad.net/ubuntu/+source/gnutls28/3.6.13-2ubuntu1.12
[USN-7278-1] OpenSSL vulnerabilities
==========================================================================
Ubuntu Security Notice USN-7278-1
February 20, 2025
openssl vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
Summary:
Several security issues were fixed in OpenSSL.
Software Description:
- openssl: Secure Socket Layer (SSL) cryptographic library and tools
Details:
George Pantelakis and Alicja Kario discovered that OpenSSL had a timing
side-channel when performing ECDSA signature computations. A remote
attacker could possibly use this issue to recover private data.
(CVE-2024-13176)
It was discovered that OpenSSL incorrectly handled certain memory
operations when using low-level GF(2^m) elliptic curve APIs with untrusted
explicit values for the field polynomial. When being used in this uncommon
fashion, a remote attacker could use this issue to cause OpenSSL to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2024-9143)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 24.04 LTS
libssl3t64 3.0.13-0ubuntu3.5
openssl 3.0.13-0ubuntu3.5
Ubuntu 22.04 LTS
libssl3 3.0.2-0ubuntu1.19
openssl 3.0.2-0ubuntu1.19
Ubuntu 20.04 LTS
libssl1.1 1.1.1f-1ubuntu2.24
openssl 1.1.1f-1ubuntu2.24
After a standard system update you need to reboot your computer to make all
the necessary changes.
References:
https://ubuntu.com/security/notices/USN-7278-1
CVE-2024-13176, CVE-2024-9143
Package Information:
https://launchpad.net/ubuntu/+source/openssl/3.0.13-0ubuntu3.5
https://launchpad.net/ubuntu/+source/openssl/3.0.2-0ubuntu1.19
https://launchpad.net/ubuntu/+source/openssl/1.1.1f-1ubuntu2.24
