libusrsctp (0.9.3.0+20190901-1) vulnerabilities

[Alexandre Pétillon]

1) Focal Fossa 20.04 LTS
2) libusrsctp (0.9.3.0+20190901-1)
3) upgrade to 0.9.4.0 or 0.9.5.0
4) I've been in touch with Byron Campen by email who is in charge of the bug B1795697 (https://bugzilla.mozilla.org/show_bug.cgi?id=1795697) related to CVE-2022-46871 (https://nvd.nist.gov/vuln/detail/CVE-2022-46871) which could impact Kurento Media Server (a service we use in my company). According to him, the 0.9.5.0 release of libusrsctp (https://github.com/sctplab/usrsctp) includes the patch (https://github.com/sctplab/usrsctp/commit/939d48f9632d69bf170c7a84514b312b6b42257d). Firefox was using a very old version of the library.

According to another direct contact I had with the Mozilla security team (Dan Veditz), the problems they found were mainly race conditions (https://cwe.mitre.org/data/definitions/364.html) which in at least one case could lead to a Use After Free vulnerability (https://cwe.mitre.org/data/definitions/416.html).

The version in Ubuntu 20.04 is also affected by CVE-2019-20503.

Conclusion: versions 0.9.4.0 and 0.9.5.0 of the library would not be impacted. Previous versions are potentially impacted.

Alexandre

[Alex Murray (alexmurray)]

Thanks for the detailed information - I can't see a good reason to keep this bug private, would you mind if I make it publicly visible?

[Alexandre Pétillon (ekynox360)]

No problem to make this bug public. It's done.

[Marc Deslauriers (mdeslaur)]

Thanks for taking the time to report this bug and helping to make Ubuntu better. Since the package referred to in this bug is in universe or multiverse, it is community maintained. If you are able, I suggest coordinating with upstream and posting a debdiff for this issue. When a debdiff is available, members of the security team will review it and publish the package. See the following link for more information: https://wiki.ubuntu.com/SecurityTeam/UpdateProcedures

[Alexandre Pétillon (ekynox360)]

No reply from the maintainer Jonas Smedegaard (https://tracker.debian.org/pkg/libusrsctp) to my email of 28 April. The Debian Security Team has responded. So Debian's tracking for CVE-2022-46871 has just been updated https://security-tracker.debian.org/tracker/CVE-2022-46871 :

- libusrsctp 0.9.3.0+20190127-2 is vulnerable,
- libusrsctp 0.9.3.0+20201102-2 is safe,
- libusrsctp 0.9.5.0-2 is safe.

[Ubuntu Foundations Team Bug Bot (crichton)]

The attachment "debdiff between libusrsctp_0.9.3.0+20190901-1 and libusrsctp_0.9.3.0+20201102-2" seems to be a debdiff. The ubuntu-sponsors team has been subscribed to the bug report so that they can review and hopefully sponsor the debdiff. If the attachment isn't a patch, please remove the "patch" flag from the attachment, remove the "patch" tag, and if you are member of the ~ubuntu-sponsors, unsubscribe the team.

[This is an automated message performed by a Launchpad user owned by ~brian-murray, for any issue please contact him.]

[Seth Arnold (seth-arnold)]

Hello Alexandre, thanks for trying to address this issue.

This debdiff looks broken, however. 1.2 megabytes is way too large for us to review, and there's loads of lines like this in the output:

Binary files /tmp/YQmq31NfW8/libusrsctp-0.9.3.0+20190901/fuzzer/CORPUS_CONNECT/addip-000000 and /tmp/ew3w5N9rtN/libusrsctp-0.9.3.0+20201102/fuzzer/CORPUS_CONNECT/addip-000000 differ

The debdiff ought to be only a little bit larger than whatever the specific security fix is.

Thanks

[Marc Deslauriers (mdeslaur)]

Unsubscribing ubuntu-security-sponsors for now since there is no appropriate debdiff to sponsor.

Please re-subscribe the team once you've attached a new debdiff that includes the minimal changes to fix the security issue. Thanks!

[Luís Infante da Câmara (luis220413)]

@ekynox360 Your debdiff also fixes CVE-2019-20503.

The upstream commits that fix the security issues are:
* for CVE-2019-20503, https://github.com/sctplab/usrsctp/commit/790a7a2555aefb392a5a69923f1e9d17b4968467;
* for CVE-2022-46871, https://github.com/sctplab/usrsctp/commit/939d48f9632d69bf170c7a84514b312b6b42257d.

[Launchpad Janitor (janitor)]

[Expired for libusrsctp (Ubuntu) because there has been no activity for 60 days.]