CVE-2023-2640 is enabled because the Ubuntu OverlayFS module does not convert file security capabilities before files are copied. As a result, an unprivileged user can create a new directory structure and enter a new user namespace with administrative-like capabilities. They can then mount an OverlayFS mount, ultimately creating a file with capabilities applicable to the init user namespace and effectively escalating the user’s privileges to root.
CVE-2023-32629 is similar to CVE-2023-2640, but affects slightly different kernel versions, and exploitation results from a different code flow. The result is the same: the file has capabilities that are applicable to the init user namespace, which effectively escalates the user’s privileges to root.
Ubuntu has released a security bulletin about these issues and has made fixing updates available. Users are urged to update their kernels to mitigate these vulnerabilities.
- Researchers have discovered serious flaws, including a deliberate backdoor, in the encryption algorithm used in TETRA (Terrestrial Trunked Radio) systems.
- TETRA is a technology used for critical data and voice radio communications globally, including in critical infrastructure, police forces, and military intelligence agencies.
- The backdoor could allow someone to snoop on communications, learn how a system works, and potentially send commands that could disrupt critical infrastructure.
- The vulnerabilities, collectively referred to as TETRABURST, were discovered by Dutch security analysts and are being addressed through patches and mitigations.
For over 25 years, TETRA, a technology used for critical data and voice radio communications, has been shrouded in secrecy to prevent scrutiny of its security properties. However, a group of researchers in the Netherlands has recently exposed serious flaws in its encryption algorithm, including a deliberate backdoor. This backdoor, known to vendors but not necessarily to customers, exists in radios sold for commercial use in critical infrastructure. It could allow someone to snoop on communications, learn how a system operates, and potentially send commands that could disrupt critical services.
The researchers discovered a total of five vulnerabilities in the TETRA standard, which they've named TETRABURST. These vulnerabilities could allow for real-time decryption, message injection, user deanonymization, or session key pinning. The impact of these vulnerabilities is significant, particularly for law enforcement, military, and critical infrastructure operators who rely on TETRA for secure communications.
The researchers have coordinated with radio manufacturers to create patches and mitigations for these vulnerabilities. However, not all issues can be fixed with a patch, and it's unclear which manufacturers have prepared them for customers. The researchers plan to present their findings at the BlackHat security conference, releasing detailed technical analysis and the previously secret TETRA encryption algorithms.
- Researchers have discovered a method to automatically construct adversarial attacks on Large Language Models (LLMs), causing them to produce harmful content.
- These attacks are universal and transferable, affecting both open-source and closed-source LLMs, including popular ones like ChatGPT, BARD, and CLAUDE.
- The adversarial attacks are difficult to patch, raising concerns about the safety of LLMs, especially as they are increasingly used in autonomous systems.
- The researchers have disclosed their findings to the companies hosting the attacked LLMs, but the fundamental challenge of addressing adversarial attacks on LLMs remains.
A recent study by researchers at Carnegie Mellon University and the Center for AI Safety has revealed a significant vulnerability in Large Language Models (LLMs). They have found a way to automatically construct adversarial attacks on these models. These attacks involve specially crafted sequences of characters that, when appended to a user query, can induce the LLM to produce harmful content, even if it goes against the model's safety measures.
What makes these attacks particularly concerning is their universal and transferable nature. They were initially built to target open-source LLMs, but the researchers found that they also work on many closed-source, publicly available chatbots like ChatGPT, BARD, and CLAUDE. This raises serious safety concerns, especially as LLMs are increasingly used in more autonomous systems.
The researchers have disclosed their findings to the companies hosting the attacked LLMs. However, it remains unclear how to address the underlying challenge posed by adversarial attacks on LLMs. The researchers hope that their work will spur future research in these directions, emphasizing the importance of considering these potential threats as we increase our usage and reliance on AI models.
- A critical vulnerability, CVE-2023-24489, has been discovered in Citrix ShareFile, a popular cloud-based file-sharing application.
- The vulnerability allows unauthenticated arbitrary file upload and remote code execution (RCE).
- The vulnerability has been assigned a CVSS score of 9.8, indicating its critical severity.
- The first attempts to exploit this vulnerability have been observed, and users are advised to apply the latest security updates as soon as possible.
CVE-2023-24489 is a cryptographic bug in Citrix ShareFile's Storage Zones Controller, a .NET web application running under IIS. This vulnerability allows unauthenticated attackers to upload arbitrary files, leading to remote code execution. Attackers can exploit this vulnerability by taking advantage of errors in ShareFile's handling of cryptographic operations. The application uses AES encryption with CBC mode and PKCS7 padding but does not correctly validate decrypted data. This oversight allows attackers to generate valid padding and execute their attack, leading to unauthenticated arbitrary file upload and remote code execution.
Researchers at Assetnote dissected the vulnerability and published the first proof-of-concept (PoC) for this CVE. Other PoCs for this have been released on GitHub, increasing the likelihood of attackers leveraging this vulnerability in their attacks and further demonstrating the severity of the issue. As of the publishing timestamp of this post, GreyNoise has observed IPs attempting to exploit this vulnerability.
Citrix has released a security update addressing the ShareFile vulnerability. Users are advised to apply the update to protect their systems from potential attacks. The fixed version of the customer-managed ShareFile Storage Zones Controller is ShareFile Storage Zones Controller 5.11.24 and later versions.
Sign up for Mandos Way
Join Mandos Way for tips and strategies to make security your business accelerator. Receive weekly cybersecurity briefs for you and your team.
No spam. Unsubscribe anytime.
