Diff for "SecurityTeam/KnowledgeBase"

KnowledgeBase

Differences between revisions 13 and 69 (spanning 56 versions)

Ubuntu Security Team • Roadmap • Getting Involved • Knowledge Base • FAQ • Contacts

Contents

Security updates
Policies
Features
Process
Problems
Security updates
Policies
Features
Process
Problems

Security updates

Announcements

Official Ubuntu Security Notices (USNs)
Ubuntu security update notifications additional information

Media coverage

In order to stay secure, Ubuntu users should simply apply all Ubuntu security updates to their systems when they become available.

For some vulnerabilities that are highlighted by the media, we've provided additional information as part of our KnowledgeBase:

2024

Native BHI (Branch History Injection) (CVE-2024-2201)

2023

Gather Data Sampling (GDS) Downfall (CVE-2022-40982)

2022

2021

2020

2019

2018

2017

2016

2015

Vulnerability Resources

Update processes

Update techniques

How to prepare an updated package
How to handle backporting security updates
- schroot/sbuild setup
- virtual machine setup
How to test the update
- QA Regression Testing
- Proof of Concept (PoC)
- Build test suites (eg, 'make check')
ABI compatibility (eg, check-symbols, nm)
Checklists
Media coverage

Policies

Features

Feature Matrix (for all releases since Dapper, see the Historical Feature Matrix.)
Security Hardening Compiler Flags
AppArmor Profiles
Applications Built with PIE
AppArmor docs
SELinux docs

Process

Problems

DebuggingSecurity for bug reports
DebuggingApparmor for bug reports dealing with AppArmor profiles

CategorySecurityTeam

SecurityTeam/KnowledgeBase (last edited 2025-04-17 11:05:59 by yhontyk)

-  ⇤ ← Revision 13 as of 2009-03-12 19:01:15 → 
  Size: 2119
  Editor: pool-71-114-228-211
  Comment: add links in the Policy section
+   ← Revision 69 as of 2024-04-24 13:30:26 → ⇥
  Size: 7580
  Editor: rodrigo-zaiden
  Comment:
-Deletions are marked like this.
+Additions are marked like this.
 Line 7:
+=== Announcements ===
 * Official [[https://ubuntu.com/security/notices|Ubuntu Security Notices]] (USNs)
 * Ubuntu security update notifications [[SecurityTeam/UpdateNotifications|additional information]]

=== Media coverage ===
In order to stay secure, Ubuntu users should simply apply all Ubuntu security updates to their systems when they become available.

For some vulnerabilities that are highlighted by the media, we've provided additional information as part of our !KnowledgeBase:

==== 2024 ====

 * [[ https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Native-BHI | Native BHI (Branch History Injection) (CVE-2024-2201) ]]

==== 2023 ====

 * [[ https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GDS_Downfall | Gather Data Sampling (GDS) Downfall (CVE-2022-40982) ]]

==== 2022 ====
 * [[ https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Retbleed | Retbleed and related return predictor microarchitectural flaws (CVE-2022-29901, CVE-2022-28693, CVE-2022-23816, CVE-2022-23825) ]]
 * [[ https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/DirtyPipe | Page cache overwrite with pipes flaw in the Linux Kernel (CVE-2022-0847 aka Dirty Pipe) ]]
 * [[ https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/BHI | Branch History Injection Microarchitectural flaws (CVE-2022-0001, CVE-2022-0002, CVE-2022-23960) ]]

==== 2021 ====
 * [[ https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Log4Shell | Apache Log4j 2 remote code execution (CVE-2021-44228 [aka Log4Shell])]]
 * [[ https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass2021 | GRUB2 Secure Boot Bypass (CVE-2020-14372, CVE-2020-25632, CVE-2020-25647, CVE-2020-27749, CVE-2020-27779, CVE-2021-20225, CVE-2021-20233, CVE-2021-3418)]]

==== 2020 ====
 * [[ https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Platypus | Intel power side-channels (CVE-2020-8694 and CVE-2020-8695, aka Platypus)]]
 * [[ https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GRUB2SecureBootBypass | GRUB2 Secure Boot Bypass (CVE-2020-10713, CVE-2020-14308, CVE-2020-14309, CVE-2020-14310, CVE-2020-14311, CVE-2020-15705, CVE-2020-15706, CVE-2020-15707, aka BootHole)]]
 * [[ https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SRBDS | Special Register Buffer Data Sampling (SRBDS) Hardware Vulnerability in Intel CPUs (CVE-2020-0543, aka Crosstalk)]]

==== 2019 ====
 * [[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/runC | runC / docker.io Privileged Container Escape (CVE-2019-5736)]]
 * [[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SnapSocketParsing | Snap Socket Parsing (CVE-2019-7304)]]
 * [[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/MDS | Microarchitectural Data Sampling (MDS) (CVE-2018-12126, CVE-2018-12127, CVE-2018-12130, and CVE-2019-11091)]]
 * [[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SACKPanic | SACK Panic and Other TCP Denial of Service Issues (CVE-2019-11477, CVE-2019-11478, and CVE-2019-11479)]]
 * [[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/k8s-CVE-2019-11247 | Kubernetes API Server Vulnerability (CVE-2019-11247) ]]
 * [[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/http2 | HTTP/2 Denial of Service Vulnerabilities ]]
 * [[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/TAA_MCEPSC_i915 | TSX Asynchronous Abort (TAA, CVE-2019-11135), Intel® Processor Machine Check Error (MCEPSC, CVE-2018-12207), and i915 graphics (CVE-2019-0155, CVE-2019-0154) vulnerabilities]]

==== 2018 ====
 * [[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Pop_SS | Mov/Pop SS vulnerabilities (CVE-2018-8897 and CVE-2018-1087) ]] 
 * [[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Variant4 | Variant 4 of Side Channel issues (CVE-2018-3639)]]
 * [[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/LazyFP | Lazy FP Save/Restore (CVE-2018-3665)]]
 * [[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/BCBS | Bounds Check Bypass Store (BCBS) (CVE-2018-3693) ]]
 * [[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/NetSpectre | NetSpectre ]]
 * [[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/L1TF | L1 Terminal Fault (L1TF) (CVE-2018-3615, CVE-2018-3620, and CVE-2018-3646)]]

==== 2017 ====
 * [[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/BlueBorne | BlueBorne bluetooth vulnerabilities (CVE-2017-1000250, CVE-2017-1000251)]]
 * [[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/SpectreAndMeltdown | Spectre and Meltdown vulnerabilities (CVE-2017-5753, CVE-2017-5754, and CVE-2017-5715) ]]

==== 2016 ====
 * [[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/OpenSSHClientRoaming|OpenSSH Client Roaming (CVE-2016-0777, CVE-2016-0778)]]
 * [[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/httpoxy|httpoxy CGI application vulnerability]]

==== 2015 ====
 * [[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/GHOST|GHOST (CVE-2015-0235)]]
 * [[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/VENOM|VENOM (CVE-2015-3456)]]
 * [[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/LogJam|LogJam (CVE-2015-4000)]]
 * [[https://wiki.ubuntu.com/SecurityTeam/KnowledgeBase/Stagefright|Stagefright (CVE-2015-1538, CVE-2015-1539, CVE-2015-3824, CVE-2015-3826, CVE-2015-3827, CVE-2015-3828, CVE-2015-3829)]]
-Line 9:
+Line 72:
+ * [[https://ubuntu.com/security/cve|Ubuntu CVE Tracker]] (web view)
-Line 14:
+Line 78:
- * [[SecurityUpdateProcedures| Security Update Procedures]]
+ * [[SecurityTeam/UpdateProcedures|Security update procedures]]
-Line 20:
+Line 84:
+ * [[SecurityTeam/UpdateProcedures#Preparing%20an%20update|How to prepare an updated package]]
-Line 21:
+Line 86:
+  * [[SecurityTeam/BuildEnvironment|schroot/sbuild setup]]
  * [[SecurityTeam/TestingEnvironment|virtual machine setup]]
-Line 27:
+Line 94:
+ * [[SecurityTeam/UpdatePublication#Media_coverage|Media coverage]]
-Line 29:
+Line 97:
- * [[https://wiki.ubuntu.com/DebuggingSecurity#Local%20Denial%20of%20Service|Local denial of service (DoS) policy]]
 * [[RootSudo|Sudo (including root password) policy]]
 * [[https://wiki.ubuntu.com/DebuggingSecurity#Local%20Network%20Privacy|Open network ports and local network privacy policy]]
 * [[https://wiki.ubuntu.com/DebuggingSecurity#Permissive%20Home%20Directory Permissions|Home directory permissions policy]]
+ * [[SecurityTeam/Policies|Ubuntu Security Policies]]
-Line 36:
+Line 101:
+ * [[Security/Features|Feature Matrix]] (for all releases since Dapper, see the [[Security/Features/Historical|Historical Feature Matrix]].)
-Line 41:
+Line 107:
+== Process ==
 * [[SecurityTeam/BugTriage|Bug Triage]]
 * [[SecurityTeam/ReleaseCycle|Release Cycle Actions]]

Ubuntu Wiki