Read Time:7 Second
FEDORA-EPEL-2024-6bc0ac05e1
Packages in this update:
python-asyncssh-2.13.2-5.el9
Update description:
Backport upstream fix for CVE-2023-48795
Daily Archives: March 11, 2024
USN-6681-2: Linux kernel vulnerabilities
Read Time:1 Minute, 48 Second
Wenqing Liu discovered that the f2fs file system implementation in the
Linux kernel did not properly validate inode types while performing garbage
collection. An attacker could use this to construct a malicious f2fs image
that, when mounted and operated on, could cause a denial of service (system
crash). (CVE-2021-44879)
It was discovered that the DesignWare USB3 for Qualcomm SoCs driver in the
Linux kernel did not properly handle certain error conditions during device
registration. A local attacker could possibly use this to cause a denial of
service (system crash). (CVE-2023-22995)
Bien Pham discovered that the netfiler subsystem in the Linux kernel
contained a race condition, leading to a use-after-free vulnerability. A
local user could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2023-4244)
It was discovered that a race condition existed in the Bluetooth subsystem
of the Linux kernel, leading to a use-after-free vulnerability. A local
attacker could use this to cause a denial of service (system crash) or
possibly execute arbitrary code. (CVE-2023-51779)
It was discovered that a race condition existed in the ATM (Asynchronous
Transfer Mode) subsystem of the Linux kernel, leading to a use-after-free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2023-51780)
It was discovered that a race condition existed in the Rose X.25 protocol
implementation in the Linux kernel, leading to a use-after- free
vulnerability. A local attacker could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2023-51782)
Alon Zahavi discovered that the NVMe-oF/TCP subsystem of the Linux kernel
did not properly handle connect command payloads in certain situations,
leading to an out-of-bounds read vulnerability. A remote attacker could use
this to expose sensitive information (kernel memory). (CVE-2023-6121)
It was discovered that the VirtIO subsystem in the Linux kernel did not
properly initialize memory in some situations. A local attacker could use
this to possibly expose sensitive information (kernel memory).
(CVE-2024-0340)
USN-6688-1: Linux kernel (OEM) vulnerabilities
Read Time:3 Minute, 22 Second
Pratyush Yadav discovered that the Xen network backend implementation in
the Linux kernel did not properly handle zero length data request, leading
to a null pointer dereference vulnerability. An attacker in a guest VM
could possibly use this to cause a denial of service (host domain crash).
(CVE-2023-46838)
It was discovered that the Habana’s AI Processors driver in the Linux
kernel did not properly initialize certain data structures before passing
them to user space. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2023-50431)
Murray McAllister discovered that the VMware Virtual GPU DRM driver in the
Linux kernel did not properly handle memory objects when storing surfaces,
leading to a use-after-free vulnerability. A local attacker in a guest VM
could use this to cause a denial of service (system crash) or possibly
execute arbitrary code. (CVE-2023-5633)
It was discovered that the CIFS network file system implementation in the
Linux kernel did not properly validate certain SMB messages, leading to an
out-of-bounds read vulnerability. An attacker could use this to cause a
denial of service (system crash) or possibly expose sensitive information.
(CVE-2023-6610)
It was discovered that the VirtIO subsystem in the Linux kernel did not
properly initialize memory in some situations. A local attacker could use
this to possibly expose sensitive information (kernel memory).
(CVE-2024-0340)
Lonial Con discovered that the netfilter subsystem in the Linux kernel did
not properly handle element deactivation in certain cases, leading to a
use-after-free vulnerability. A local attacker could use this to cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2024-1085)
Notselwyn discovered that the netfilter subsystem in the Linux kernel did
not properly handle verdict parameters in certain cases, leading to a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly execute arbitrary code.
(CVE-2024-1086)
Chenyuan Yang discovered that the RDS Protocol implementation in the Linux
kernel contained an out-of-bounds read vulnerability. An attacker could use
this to possibly cause a denial of service (system crash). (CVE-2024-23849)
It was discovered that a race condition existed in the Bluetooth subsystem
in the Linux kernel, leading to a null pointer dereference vulnerability. A
privileged local attacker could use this to possibly cause a denial of
service (system crash). (CVE-2024-24860)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
– Architecture specifics;
– Block layer;
– ACPI drivers;
– Android drivers;
– EDAC drivers;
– GPU drivers;
– InfiniBand drivers;
– Media drivers;
– Multifunction device drivers;
– MTD block device drivers;
– Network drivers;
– NVME drivers;
– PHY drivers;
– PWM drivers;
– SCSI drivers;
– SPMI drivers;
– TTY drivers;
– Userspace I/O drivers;
– Ceph distributed file system;
– EFI Variable file system;
– Ext4 file system;
– F2FS file system;
– GFS2 file system;
– JFS file system;
– SMB network file system;
– BPF subsystem;
– Logical Link Layer;
– Netfilter;
– Unix domain sockets;
– AppArmor security module;
(CVE-2024-26599, CVE-2023-52604, CVE-2023-52439, CVE-2024-26627,
CVE-2024-26601, CVE-2024-26628, CVE-2023-52607, CVE-2023-52456,
CVE-2023-52602, CVE-2023-52443, CVE-2023-52599, CVE-2023-52603,
CVE-2024-26588, CVE-2024-26581, CVE-2023-52600, CVE-2024-26624,
CVE-2023-52584, CVE-2024-26625, CVE-2023-52606, CVE-2023-52463,
CVE-2023-52464, CVE-2023-52597, CVE-2023-52595, CVE-2023-52458,
CVE-2023-52457, CVE-2023-52438, CVE-2023-52469, CVE-2023-52462,
CVE-2024-26589, CVE-2024-26592, CVE-2024-26594, CVE-2023-52601,
CVE-2023-52593, CVE-2023-52436, CVE-2023-52447, CVE-2023-52587,
CVE-2023-52445, CVE-2023-52454, CVE-2023-52451, CVE-2023-52605,
CVE-2024-26597, CVE-2023-52448, CVE-2023-52598, CVE-2024-26591,
CVE-2023-52449, CVE-2023-52444, CVE-2023-52583, CVE-2023-52589,
CVE-2024-26598, CVE-2023-52470, CVE-2023-52594, CVE-2023-52588,
CVE-2023-52467, CVE-2024-26600)
USN-6658-2: libxml2 vulnerability
Read Time:20 Second
USN-6658-1 fixed a vulnerability in libxml2. This update
provides the corresponding updates for Ubuntu 14.04 LTS,
Ubuntu 16.04 LTS, and Ubuntu 18.04 LTS.
Original advisory details:
It was discovered that libxml2 incorrectly handled certain XML documents. A
remote attacker could possibly use this issue to cause libxml2 to crash,
resulting in a denial of service, or possibly execute arbitrary code.
Magnet Goblin Exploits Ivanti Vulnerabilities
Read Time:5 Second
The threat actor uses custom Linux malware to pursue financial gain, according to Check Point Research
Incognito Darknet Market Mass-Extorts Buyers, Sellers
Read Time:3 Minute, 42 Second
Borrowing from the playbook of ransomware purveyors, the darknet narcotics bazaar Incognito Market has begun extorting all of its vendors and buyers, threatening to publish cryptocurrency transaction and chat records of users who refuse to pay a fee ranging from $100 to $20,000. The bold mass extortion attempt comes just days after Incognito Market administrators reportedly pulled an “exit scam” that left users unable to withdraw millions of dollars worth of funds from the platform.
An extortion message currently on the Incognito Market homepage.
In the past 24 hours, the homepage for the Incognito Market was updated to include a blackmail message from its owners, saying they will soon release purchase records of vendors who refuse to pay to keep the records confidential.
“We got one final little nasty surprise for y’all,” reads the message to Incognito Market users. “We have accumulated a list of private messages, transaction info and order details over the years. You’ll be surprised at the number of people that relied on our ‘auto-encrypt’ functionality. And by the way, your messages and transaction IDs were never actually deleted after the ‘expiry’….SURPRISE SURPRISE!!! Anyway, if anything were to leak to law enforcement, I guess nobody never slipped up.”
Incognito Market says it plans to publish the entire dump of 557,000 orders and 862,000 cryptocurrency transaction IDs at the end of May.
“Whether or not you and your customers’ info is on that list is totally up to you,” the Incognito administrators advised. “And yes, this is an extortion!!!!”
The extortion message includes a “Payment Status” page that lists the darknet market’s top vendors by their handles, saying at the top that “you can see which vendors care about their customers below.” The names in green supposedly correspond to users who have already opted to pay.
The “Payment Status” page set up by the Incognito Market extortionists.
We’ll be publishing the entire dump of 557k orders and 862k crypto transaction IDs at the end of May, whether or not you and your customers’ info is on that list is totally up to you. And yes, this is an extortion!!!!
Incognito Market said it plans to open up a “whitelist portal” for buyers to remove their transaction records “in a few weeks.”
The mass-extortion of Incognito Market users comes just days after a large number of users reported they were no longer able to withdraw funds from their buyer or seller accounts. The cryptocurrency-focused publication Cointelegraph.com reported Mar. 6 that Incognito was exit-scamming its users out of their bitcoins and Monero deposits.
CoinTelegraph notes that Incognito Market administrators initially lied about the situation, and blamed users’ difficulties in withdrawing funds on recent changes to Incognito’s withdrawal systems.
Incognito Market deals primarily in narcotics, so it’s likely many users are now worried about being outed as drug dealers. Creating a new account on Incognito Market presents one with an ad for 5 grams of heroin selling for $450.
New Incognito Market users are treated to an ad for $450 worth of heroin.
The double whammy now hitting Incognito Market users is somewhat akin to the double extortion techniques employed by many modern ransomware groups, wherein victim organizations are hacked, relieved of sensitive information and then presented with two separate ransom demands: One in exchange for a digital key needed to unlock infected systems, and another to secure a promise that any stolen data will not be published or sold, and will be destroyed.
Incognito Market has priced its extortion for vendors based on their status or “level” within the marketplace. Level 1 vendors can supposedly have their information removed by paying a $100 fee. However, larger “Level 5” vendors are asked to cough up $20,000 payments.
The past is replete with examples of similar darknet market exit scams, which tend to happen eventually to all darknet markets that aren’t seized and shut down by federal investigators, said Brett Johnson, a convicted and reformed cybercriminal who built the organized cybercrime community Shadowcrew many years ago.
“Shadowcrew was the precursor to today’s Darknet Markets and laid the foundation for the way modern cybercrime channels still operate today,” Johnson said. “The Truth of Darknet Markets? ALL of them are Exit Scams. The only question is whether law enforcement can shut down the market and arrest its operators before the exit scam takes place.”
BianLian Threat Actor Shifts Focus to Extortion-Only Tactics
Read Time:4 Second
GuidePoint said the threat actor gained initial access via vulnerabilities in a TeamCity server
NSA Launches Top 10 Cloud Security Mitigation Strategies
Read Time:5 Second
The advisory is associated with ten companion cybersecurity information sheets detailing how to implement each strategy
Third-Party Breach and Missing MFA Contributed to British Library Cyber-Attack
Read Time:9 Second
A British Library report found the most likely source of the incident was the compromise of third-party account credentials and no MFA was in place to stop the attackers
USN-6687-1: AccountsService vulnerability
Read Time:8 Second
It was discovered that AccountsService called a helper incorrectly when
performing password change operations. A local attacker could possibly use
this issue to obtain encrypted passwords.