Kernel Security and Hardware Enablement Stack Refresh
Ubuntu 24.04.2 LTS ships with the Linux 6.11 kernel from the HWE (Hardware Enablement) series, replacing the original 6.8 kernel. Beyond hardware support, the kernel upgrade integrates hundreds of security fixes. The 6.11 kernel addresses multiple privilege escalation flaws, denial-of-service vectors, and information leaks. Notable fixes include patches for speculative execution vulnerabilities like Spectre-BHB on Arm systems and Retbleed mitigations on x86. A critical use-after-free in the ksmbd kernel SMB server that could allow remote code execution by an unauthenticated attacker (CVE-2024-22099) was resolved. Another high-severity heap buffer overflow in the WiFi stack (CVE-2024-27010) was fixed, preventing potential code execution when processing malicious packets. The kernel also strengthens user namespace restrictions to limit container breakout risks, a direct response to CVEs like CVE-2024-21626 found in runc but mitigated at the kernel level. With this HWE kernel, Ubuntu 24.04.2 ensures that even newly deployed systems are safe from known kernel-level exploits out of the box.
High-Profile Vulnerability Patches in Core Userspace Components
Since the 24.04.1 release, the Ubuntu Security Team has issued over 50 USNs (Ubuntu Security Notices). The point release bundles all of these, closing multiple remote code execution and privilege escalation gaps.
OpenSSH (regreSSHion Fix)
CVE-2024-6387, dubbed “regreSSHion,” is a signal handler race condition in the OpenSSH server (sshd) that can lead to unauthenticated remote code execution on glibc-based Linux systems. Ubuntu 24.04.2 includes openssh 1:9.6p1-3ubuntu13.2 or later, which removes the vulnerable code path and adds a forced delay to thwart timing attacks. This is arguably the most critical patch in the update, as sshd is often exposed to the internet.
Curl and libcurl Flaws
The ubiquitous data-transfer library received fixes for CVE-2024-0853, a cookie injection vulnerability during cross-protocol redirects, and CVE-2024-2002, a double-free that could crash or potentially lead to code execution under specific conditions. The version shipped is at least 8.5.0-2ubuntu10.1. These patches protect everything from command-line tools to desktop applications that rely on libcurl.
GLibc Security Errata
The GNU C Library (glibc) 2.39 received critical fixes, including a heap buffer overflow in the iconv() function (CVE-2024-2961) that can be triggered when converting to ISO-2022-CN-EXT, allowing crafted inputs to achieve code execution. Also addressed is CVE-2024-33599, a stack exhaustion crash in the Name Service Switch parser, and CVE-2024-33600, a null pointer dereference. These library-level patches preempt attacks on nearly every compiled application.
OpenSSL 3.0.13 and TLS Security
OpenSSL was updated to 3.0.13, plugging a denial-of-service via excessive X.509 policy tree depth (CVE-2024-2511) and a timing side-channel in ECDSA nonces (CVE-2024-4741 for specific curves). Although many high-profile TLS issues were addressed earlier, this update ensures robust cryptographic operations.
Samba and File Sharing
Samba 4.19.5+ closes CVE-2024-22417, an AD DC denial-of-service vulnerability, and CVE-2018-14628, an information disclosure in LDAP. File servers are prime targets, so these fixes reduce lateral movement risks in enterprise deployments.
Additional Critical Package Updates
- Firefox and Thunderbird: The default browser ships as a snap and auto-updates, but the base repositories include all dependent libraries. Thunderbird in the repository is updated to 115.11.0, fixing CVE-2024-38528, a use-after-free in JavaScript handling, and other high-severity memory safety bugs.
- Vim and Neovim: Patches for CVE-2024-22667, a stack-based buffer overflow in Vim < 9.1.0100 that can be exploited when opening a crafted file.
- Binutils: Fixed CVE-2024-25260, an integer overflow in the Binary File Descriptor library, preventing code execution through malformed ELF binaries.
- CUPS (Printing): Patches for CVE-2024-35235, allowing local privilege escalation via symbolic link attacks in cups-browsed.
- GStreamer multimedia framework: Multiple CVEs (CVE-2024-23504, CVE-2024-23505) fixed out-of-bounds reads and writes in media parsing, shielding users from malicious audio/video files.
- X.Org and Wayland: Display servers received backports fixing local privilege escalation via buffer overflows (CVE-2024-31080, CVE-2024-31081). Wayland compositors also hardened against input handling vulnerabilities.
The point release refreshes over 150 source packages with security patches, ensuring that a fresh installation does not immediately require a massive download of updates—reducing the attack surface window after provisioning.
Kernel Hardening and Mitigation Improvements
- Control Flow Integrity (CFI): The kernel and key userspace binaries are compiled with Clang’s CFI to prevent control-flow hijacking attacks such as ROP/JOP.
- Stack Clash protection: System-wide guard pages and stack probing prevent attacker-controlled stack smashing across memory regions.
- Zero-copy networking hardening: Improvements to io_uring and BPF prevent privilege escalation from unprivileged containers.
- AppArmor profile updates: Several default profiles (e.g., for snap confinement, CUPS, libvirtd) were tightened. The new kernel allows AppArmor IOMMU integration for per-device DMA restrictions on compatible hardware.
- Kernel Lockdown: In UEFI Secure Boot mode, the kernel lockdown prevents even root from tampering with kernel memory, blocking module loading and /dev/mem access. The 6.11 kernel extends lockdown to kexec and hibernation paths.
- BPF JIT hardening: All BPF programs are compiled with constant blinding and stack depth checking to avoid speculative execution leaks.
These mitigations combine with the latest microcode packages to defend against side-channel and transient execution exploits.
Desktop and Container Security Enhancements
The default Ubuntu Desktop benefits from security-focused under-the-hood changes. The GNOME 46.2 desktop environment includes fixes for several denial-of-service flaws in the JavaScript engine and thumbnailers. PulseAudio is replaced by PipeWire 1.0.5, which implements more rigorous sandboxing for audio clients, limiting the blast radius of a compromised application. Snap confinement gains additional interfaces for GPU and audio, but with stricter AppArmor rules that prevent unauthorized access to system resources.
For container workloads, Docker 26.1.3 (from the repository) incorporates fixes for runc CVE-2024-21626 (host file descriptor leak) and BuildKit CVE-2024-23651, which allowed a malicious build context to mount arbitrary host directories. The point release also updates containerd to 1.7.14 and libcontainer patches, ensuring that containerized applications cannot easily escape to the host. LXD 6.0.1 ships with fixes for virtiofsd socket leaks and improved user namespace mapping that obviates the need for privileged containers in many cases.
Applying the Ubuntu 24.04.2 LTS Point Release
Existing 24.04 users receive these patches automatically via security updates. Running sudo apt update && sudo apt full-upgrade brings systems in line. Fresh installs using the 24.04.2 ISO include all fixes. For servers, Canonical’s Landscape or unattended-upgrades handles deployment. Pro subscribers (free for five machines) receive extended security maintenance for universe packages.