Announcing new releases Alpha 3760.0.0, Beta 3745.1.0, Stable 3602.2.1, LTS 2022 3033.3.18 and LTS 2023 3510.3.1

10 views
Skip to first unread message

Flatcar Container Linux User

unread,
Oct 25, 2023, 7:50:06 AM10/25/23
to Flatcar Container Linux User

Hello,
We are pleased to announce a new Flatcar Container Linux release for the Alpha, Beta, Stable, LTS 2022 and LTS 2023 channels

New Alpha Release 3760.0.0

Changes since Alpha 3745.0.0

Security fixes:Bug fixes:
  • Added AWS EKS support for versions 1.24-1.28. Fixed /usr/share/amazon/eks/download-kubelet.sh to include download paths for these versions. (scripts#1210)
  • Disabled systemd-networkd’s RoutesToDNS setting by default to fix provisioning failures observed in VMs with multiple network interfaces on Azure (scripts#1206)
  • Fixed quotes handling for update-engine (Flatcar#1209)
  • Fixed the postinstall hook failure when updating from Azure instances without OEM systemd-sysext images to Flatcar Alpha 3745.x.y (update_engine#29)
Changes:
  • To make Kubernetes work by default, /usr/libexec/kubernetes/kubelet-plugins/volume/exec is now a symlink to the writable folder /var/kubernetes/kubelet-plugins/volume/exec (Flatcar#1193)
Updates:New Beta Release 3745.1.0

Changes since Beta 3732.1.0

Security fixes:Bug fixes:
  • Disabled systemd-networkd’s RoutesToDNS setting by default to fix provisioning failures observed in VMs with multiple network interfaces on Azure (scripts#1206)
  • Fixed the postinstall hook failure when updating from Azure instances without OEM systemd-sysext images to Flatcar Alpha 3745.x.y (update_engine#29)
Changes:
  • AWS OEM images now use a systemd-sysext image for layering additional platform-specific software on top of /usr
  • Reworked the VMware OEM software to be shipped as A/B updated systemd-sysext image
  • SDK: Experimental support for prefix builds to create distro independent, portable, self-contained applications w/ all dependencies included. With contributions from chewi and HappyTobi.
  • Started shipping default ssh client and ssh daemon configs in /etc/ssh/ssh_config and /etc/ssh/sshd_config which include config snippets in /etc/ssh/ssh_config.d and /etc/ssh/sshd_config.d, respectively.
  • The open-vm-tools package in VMware OEM now comes with vmhgfs-fuse, udev rules, pam and vgauth
  • To make Kubernetes work by default, /usr/libexec/kubernetes/kubelet-plugins/volume/exec is now a symlink to the writable folder /var/kubernetes/kubelet-plugins/volume/exec (Flatcar#1193)
Updates:

Changes since Alpha 3745.0.0

Security fixes:Bug fixes:
  • Disabled systemd-networkd’s RoutesToDNS setting by default to fix provisioning failures observed in VMs with multiple network interfaces on Azure (scripts#1206)
  • Fixed the postinstall hook failure when updating from Azure instances without OEM systemd-sysext images to Flatcar Alpha 3745.x.y (update_engine#29)
Changes:
  • To make Kubernetes work by default, /usr/libexec/kubernetes/kubelet-plugins/volume/exec is now a symlink to the writable folder /var/kubernetes/kubelet-plugins/volume/exec (Flatcar#1193)
Updates:New Stable Release 3602.2.1

Changes since Stable 3602.2.0

Security fixes:Bug fixes:
  • Disabled systemd-networkd’s RoutesToDNS setting by default to fix provisioning failures observed in VMs with multiple network interfaces on Azure (scripts#1206)
  • Fixed a regression in Docker resulting in file permissions being dropped from exported container images. (scripts#1231)
Changes:
  • To make Kubernetes work by default, /usr/libexec/kubernetes/kubelet-plugins/volume/exec is now a symlink to the writable folder /var/kubernetes/kubelet-plugins/volume/exec (Flatcar#1193)
Updates:New LTS-2022 Release 3033.3.18

Changes since LTS 3033.3.17

Security fixes:Bug fixes:Changes:
  • Add support for Microsoft Azure Network Adapter (MANA) NICs on Azure (scripts#1131)
Updates:New LTS-2023 Release 3510.3.1

Changes since LTS 3510.3.0

Security fixes:Bug fixes:
  • Disabled systemd-networkd’s RoutesToDNS setting by default to fix provisioning failures observed in VMs with multiple network interfaces on Azure (scripts#1206)
  • Triggered re-reading of partition table to fix adding partitions to the boot disk (scripts#1202)
Changes:
  • To make Kubernetes work by default, /usr/libexec/kubernetes/kubelet-plugins/volume/exec is now a symlink to the writable folder /var/kubernetes/kubelet-plugins/volume/exec (Flatcar#1193)
Updates:Detailed Security Report

Security fix: With the Alpha 3760.0.0, Beta 3745.1.0, Stable 3602.2.1, LTS 2022 3033.3.18 and LTS 2023 3510.3.1 releases we ship fixes for the CVEs listed below.

Alpha 3760.0.0

  • Go

    • CVE-2023-39323 CVSSv3 score: 9.8(Critical)
      Line directives ("//line") can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compilation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploiting this issue significantly more complex.
    • CVE-2023-39325 CVSSv3 score: n/a
      A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded by the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. With the fix applied, HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit (MaxConcurrentStreams). New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function.

  • curl

    • CVE-2023-38545 CVSSv3 score: n/a
      This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local name resolving and instead passes on the resolved address only. Due to this bug, the local variable that means "let the host resolve the name" could get the wrong value during a slow SOCKS5 handshake, and contrary to the intention, copy the too long host name to the target buffer instead of copying just the resolved address there. The target buffer being a heap based buffer, and the host name coming from the URL that curl has been told to operate with.

    • CVE-2023-38546 CVSSv3 score: n/a
      This flaw allows an attacker to insert cookies at will into a running program
      using libcurl, if the specific series of conditions are met.

      libcurl performs transfers. In its API, an application creates "easy handles"
      that are the individual handles for single transfers.

      libcurl provides a function call that duplicates en easy handle called
      curl_easy_duphandle.

      If a transfer has cookies enabled when the handle is duplicated, the
      cookie-enable state is also cloned - but without cloning the actual
      cookies. If the source handle did not read any cookies from a specific file on
      disk, the cloned version of the handle would instead store the file name as
      none (using the four ASCII letters, no quotes).

      Subsequent use of the cloned handle that does not explicitly set a source to
      load cookies from would then inadvertently load cookies from a file named
      none - if such a file exists and is readable in the current directory of the
      program using libcurl. And if using the correct file format of course.

  • glibc

    • CVE-2023-4911 CVSSv3 score: n/a
      A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binaries with SUID permission to execute code with elevated privileges.

  • grub

    • CVE-2023-4692 CVSSv3 score: n/a
      There is an out-of-bounds write in grub-core/fs/ntfs.c. An attacker may leverage this vulnerability by presenting a specially crafted NTFS filesystem image leading to GRUB’s heap metadata corruption. Additionally, in some circumstances, the attack may also corrupt the UEFI firmware heap metadata. As a result arbitrary code execution and secure boot protection bypass may be achieved.

    • CVE-2023-4693 CVSSv3 score: n/a
      There is an out-of-bounds read at grub-core/fs/ntfs.c. A physically present attacker may leverage that by presenting a specially crafted NTFS file system image to read arbitrary memory locations. A successful attack may allow sensitive data cached in memory or EFI variables values to be leaked presenting a high confidentiality risk.

Beta 3745.1.0

  • curl

    • CVE-2023-38039 CVSSv3 score: 7.5(High)
      When curl retrieves an HTTP response, it stores the incoming headers so that
      they can be accessed later via the libcurl headers API.

      However, curl did not have a limit in how many or how large headers it would
      accept in a response, allowing a malicious server to stream an endless series
      of headers and eventually cause curl to run out of heap memory.

    • CVE-2023-38545 CVSSv3 score: n/a
      This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy
      handshake.

      When curl is asked to pass along the host name to the SOCKS5 proxy to allow
      that to resolve the address instead of it getting done by curl itself, the
      maximum length that host name can be is 255 bytes.

      If the host name is detected to be longer, curl switches to local name
      resolving and instead passes on the resolved address only. Due to this bug,
      the local variable that means "let the host resolve the name" could get the
      wrong value during a slow SOCKS5 handshake, and contrary to the intention,
      copy the too long host name to the target buffer instead of copying just the
      resolved address there.

      The target buffer being a heap based buffer, and the host name coming from the
      URL that curl has been told to operate with.

    • CVE-2023-38546 CVSSv3 score: n/a
      This flaw allows an attacker to insert cookies at will into a running program
      using libcurl, if the specific series of conditions are met.

      libcurl performs transfers. In its API, an application creates "easy handles"
      that are the individual handles for single transfers.

      libcurl provides a function call that duplicates en easy handle called
      curl_easy_duphandle.

      If a transfer has cookies enabled when the handle is duplicated, the
      cookie-enable state is also cloned - but without cloning the actual
      cookies. If the source handle did not read any cookies from a specific file on
      disk, the cloned version of the handle would instead store the file name as
      none (using the four ASCII letters, no quotes).

      Subsequent use of the cloned handle that does not explicitly set a source to
      load cookies from would then inadvertently load cookies from a file named
      none - if such a file exists and is readable in the current directory of the
      program using libcurl. And if using the correct file format of course.

  • glibc

    • CVE-2023-4527 CVSSv3 score: n/a
      A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash.
    • CVE-2023-4806 CVSSv3 score: n/a
      A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the nss_gethostbyname2_r and nss_getcanonname_r hooks without implementing the nss*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags.

  • lua

    • CVE-2022-33099 CVSSv3 score: 7.5(High)
      An issue in the component luaG_runerror of Lua v5.4.4 and below leads to a heap-buffer overflow when a recursive error occurs.

  • mit-krb5

    • CVE-2023-36054 CVSSv3 score: 6.5(Medium)
      lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.

  • procps

    • CVE-2023-4016 CVSSv3 score: 5.5(Medium)
      Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimited amounts of unfiltered data into the process heap.

  • samba

    • CVE-2021-44142 CVSSv3 score: 8.8(High)
      The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "…enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root.
    • CVE-2022-1615 CVSSv3 score: 5.5(Medium)
      In Samba, GnuTLS gnutls_rnd() can fail and give predictable random values.
Stable 3602.2.1

  • Linux

    • CVE-2023-31085 CVSSv3 score: 5.5(Medium)
      An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0.

    • CVE-2023-34324 CVSSv3 score: n/a

    • CVE-2023-4244 CVSSv3 score: 7(High)
      A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

      Due to a race condition between nf_tables netlink control plane transaction and nft_set element garbage collection, it is possible to underflow the reference counter causing a use-after-free vulnerability.

      We recommend upgrading past commit 3e91b0ebd994635df2346353322ac51ce84ce6d8.

    • CVE-2023-42754 CVSSv3 score: n/a
      A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash the system.

    • CVE-2023-5197 CVSSv3 score: 6.6(Medium)
      A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

      Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free.

      We recommend upgrading past commit f15f29fd4779be8a418b66e9d52979bb6d6c2325.

  • curl

    • CVE-2023-38545 CVSSv3 score: n/a
      This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy
      handshake.
      When curl is asked to pass along the host name to the SOCKS5 proxy to allow
      that to resolve the address instead of it getting done by curl itself, the
      maximum length that host name can be is 255 bytes.
      If the host name is detected to be longer, curl switches to local name
      resolving and instead passes on the resolved address only. Due to this bug,
      the local variable that means "let the host resolve the name" could get the
      wrong value during a slow SOCKS5 handshake, and contrary to the intention,
      copy the too long host name to the target buffer instead of copying just the
      resolved address there.
      The target buffer being a heap based buffer, and the host name coming from the
      URL that curl has been told to operate with.

    • CVE-2023-38546 CVSSv3 score: n/a
      This flaw allows an attacker to insert cookies at will into a running program
      using libcurl, if the specific series of conditions are met.

      libcurl performs transfers. In its API, an application creates "easy handles"
      that are the individual handles for single transfers.

      libcurl provides a function call that duplicates en easy handle called
      curl_easy_duphandle.

      If a transfer has cookies enabled when the handle is duplicated, the
      cookie-enable state is also cloned - but without cloning the actual
      cookies. If the source handle did not read any cookies from a specific file on
      disk, the cloned version of the handle would instead store the file name as
      none (using the four ASCII letters, no quotes).

      Subsequent use of the cloned handle that does not explicitly set a source to
      load cookies from would then inadvertently load cookies from a file named
      none - if such a file exists and is readable in the current directory of the
      program using libcurl. And if using the correct file format of course.

LTS-2022 3033.3.18

  • Linux

    • CVE-2023-31085 CVSSv3 score: 5.5(Medium)
      An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0.

    • CVE-2023-34324 CVSSv3 score: n/a

    • CVE-2023-39189 CVSSv3 score: 6(Medium)
      A flaw was found in the Netfilter subsystem in the Linux kernel. The nfnl_osf_add_callback function did not validate the user mode controlled opt_num field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.

    • CVE-2023-39192 CVSSv3 score: 6(Medium)
      A flaw was found in the Netfilter subsystem in the Linux kernel. The xt_u32 module did not validate the fields in the xt_u32 structure. This flaw allows a local privileged attacker to trigger an out-of-bounds read by setting the size fields with a value beyond the array boundaries, leading to a crash or information disclosure.

    • CVE-2023-39193 CVSSv3 score: 6(Medium)
      A flaw was found in the Netfilter subsystem in the Linux kernel. The sctp_mt_check did not validate the flag_count field. This flaw allows a local privileged (CAP_NET_ADMIN) attacker to trigger an out-of-bounds read, leading to a crash or information disclosure.

    • CVE-2023-4244 CVSSv3 score: 7(High)
      A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

      Due to a race condition between nf_tables netlink control plane transaction and nft_set element garbage collection, it is possible to underflow the reference counter causing a use-after-free vulnerability.

      We recommend upgrading past commit 3e91b0ebd994635df2346353322ac51ce84ce6d8.

    • CVE-2023-42752 CVSSv3 score: n/a
      An integer overflow flaw was found in the Linux kernel. This issue leads to the kernel allocating skb_shared_info in the userspace, which is exploitable in systems without SMAP protection since skb_shared_info contains references to function pointers.

    • CVE-2023-42753 CVSSv3 score: 7.8(High)
      An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the h->nets array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer out-of-bound. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.

    • CVE-2023-42754 CVSSv3 score: n/a
      A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash the system.

    • CVE-2023-42755 CVSSv3 score: 5.5(Medium)
      A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the rsvp_classify function. This issue may allow a local user to crash the system and cause a denial of service.

    • CVE-2023-45871 CVSSv3 score: n/a
      An issue was discovered in drivers/net/ethernet/intel/igb/igb_main.c in the IGB driver in the Linux kernel before 6.5.3. A buffer size may not be adequate for frames larger than the MTU.

    • CVE-2023-4623 CVSSv3 score: n/a
      A use-after-free vulnerability in the Linux kernel's net/sched: sch_hfsc (HFSC qdisc traffic control) component can be exploited to achieve local privilege escalation.

      If a class with a link-sharing curve (i.e. with the HFSC_FSC flag set) has a parent without a link-sharing curve, then init_vf() will call vttree_insert() on the parent, but vttree_remove() will be skipped in update_vf(). This leaves a dangling pointer that can cause a use-after-free.

      We recommend upgrading past commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f.

    • CVE-2023-4921 CVSSv3 score: n/a
      A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation.

      When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue().

      We recommend upgrading past commit 8fc134fee27f2263988ae38920bc03da416b03d8.

    • CVE-2023-5197 CVSSv3 score: 6.6(Medium)
      A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

      Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free.

      We recommend upgrading past commit f15f29fd4779be8a418b66e9d52979bb6d6c2325.

  • curl

    • CVE-2023-38545 CVSSv3 score: n/a
      This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy
      handshake.

      When curl is asked to pass along the host name to the SOCKS5 proxy to allow
      that to resolve the address instead of it getting done by curl itself, the
      maximum length that host name can be is 255 bytes.

      If the host name is detected to be longer, curl switches to local name
      resolving and instead passes on the resolved address only. Due to this bug,
      the local variable that means "let the host resolve the name" could get the
      wrong value during a slow SOCKS5 handshake, and contrary to the intention,
      copy the too long host name to the target buffer instead of copying just the
      resolved address there.

      The target buffer being a heap based buffer, and the host name coming from the
      URL that curl has been told to operate with.

    • CVE-2023-38546 CVSSv3 score: n/a
      This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.

      libcurl performs transfers. In its API, an application creates "easy handles"
      that are the individual handles for single transfers.

      libcurl provides a function call that duplicates en easy handle called
      curl_easy_duphandle.

      If a transfer has cookies enabled when the handle is duplicated, the
      cookie-enable state is also cloned - but without cloning the actual
      cookies. If the source handle did not read any cookies from a specific file on
      disk, the cloned version of the handle would instead store the file name as
      none (using the four ASCII letters, no quotes).

      Subsequent use of the cloned handle that does not explicitly set a source to
      load cookies from would then inadvertently load cookies from a file named
      none - if such a file exists and is readable in the current directory of the
      program using libcurl. And if using the correct file format of course.

LTS-2023 3510.3.1

  • Linux

    • CVE-2023-31085 CVSSv3 score: 5.5(Medium)
      An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2. There is a divide-by-zero error in do_div(sz,mtd->erasesize), used indirectly by ctrl_cdev_ioctl, when mtd->erasesize is 0.

    • CVE-2023-34324 CVSSv3 score: n/a

    • CVE-2023-4244 CVSSv3 score: 7(High)
      A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

      Due to a race condition between nf_tables netlink control plane transaction and nft_set element garbage collection, it is possible to underflow the reference counter causing a use-after-free vulnerability.

      We recommend upgrading past commit 3e91b0ebd994635df2346353322ac51ce84ce6d8.

    • CVE-2023-42754 CVSSv3 score: n/a
      A NULL pointer dereference flaw was found in the Linux kernel ipv4 stack. The socket buffer (skb) was assumed to be associated with a device before calling __ip_options_compile, which is not always the case if the skb is re-routed by ipvs. This issue may allow a local user with CAP_NET_ADMIN privileges to crash the system.

    • CVE-2023-42755 CVSSv3 score: 5.5(Medium)
      A flaw was found in the IPv4 Resource Reservation Protocol (RSVP) classifier in the Linux kernel. The xprt pointer may go beyond the linear part of the skb, leading to an out-of-bounds read in the rsvp_classify function. This issue may allow a local user to crash the system and cause a denial of service.

    • CVE-2023-5197 CVSSv3 score: 6.6(Medium)
      A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation.

      Addition and removal of rules from chain bindings within the same transaction causes leads to use-after-free.

      We recommend upgrading past commit f15f29fd4779be8a418b66e9d52979bb6d6c2325.

  • curl

    • CVE-2023-38545 CVSSv3 score: n/a
      This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy
      handshake.

      When curl is asked to pass along the host name to the SOCKS5 proxy to allow
      that to resolve the address instead of it getting done by curl itself, the
      maximum length that host name can be is 255 bytes.

      If the host name is detected to be longer, curl switches to local name
      resolving and instead passes on the resolved address only. Due to this bug,
      the local variable that means "let the host resolve the name" could get the
      wrong value during a slow SOCKS5 handshake, and contrary to the intention,
      copy the too long host name to the target buffer instead of copying just the
      resolved address there.

      The target buffer being a heap based buffer, and the host name coming from the
      URL that curl has been told to operate with.

    • CVE-2023-38546 CVSSv3 score: n/a
      This flaw allows an attacker to insert cookies at will into a running program
      using libcurl, if the specific series of conditions are met.

      libcurl performs transfers. In its API, an application creates "easy handles"
      that are the individual handles for single transfers.

      libcurl provides a function call that duplicates en easy handle called
      curl_easy_duphandle.

      If a transfer has cookies enabled when the handle is duplicated, the
      cookie-enable state is also cloned - but without cloning the actual
      cookies. If the source handle did not read any cookies from a specific file on
      disk, the cloned version of the handle would instead store the file name as
      none (using the four ASCII letters, no quotes).

      Subsequent use of the cloned handle that does not explicitly set a source to
      load cookies from would then inadvertently load cookies from a file named
      none - if such a file exists and is readable in the current directory of the
      program using libcurl. And if using the correct file format of course.

Best,
The Flatcar Container Linux Maintainers

Reply all
Reply to author
Forward
This conversation is locked
You cannot reply and perform actions on locked conversations.
0 new messages