All posts by corbet

Security updates for Tuesday

Post Syndicated from corbet original https://lwn.net/Articles/1037308/

Security updates have been issued by AlmaLinux (kernel and kernel-rt), Debian (openafs and qemu), Fedora (buildah, containers-common, podman, python-flask, and snapshot), Mageia (postgresql, python-django, and udisks2), Oracle (kernel and libxml2), Red Hat (apache-commons-beanutils, firefox, httpd, httpd:2.4, kernel, kernel-rt, mod_http2, qt5-qt3d, and thunderbird), Slackware (libxml2), SUSE (firebird, go1.25-openssl, ImageMagick, microcode_ctl, netty, netty-tcnative, and ovmf), and Ubuntu (libetpan and postgresql-14, postgresql-16, postgresql-17).

npm debug and chalk packages compromised (Aikido)

Post Syndicated from corbet original https://lwn.net/Articles/1037167/

The Aikido blog describes
an apparently ongoing series of phishing attacks against npm package
maintainers, resulting in the uploading of compromised versions of heavily
used packages:

All together, these packages have more than 2 billion downloads per
week.

The packages were updated to contain a piece of code that would be
executed on the client of a website, which silently intercepts
crypto and web3 activity in the browser, manipulates wallet
interactions, and rewrites payment destinations so that funds and
approvals are redirected to attacker-controlled accounts without
any obvious signs to the user.

[$] Rug pulls, forks, and open-source feudalism

Post Syndicated from corbet original https://lwn.net/Articles/1036465/

Like almost all human endeavors, open-source software development involves
a range of power dynamics. Companies, developers, and users are all
concerned with the power to influence the direction of the software — and,
often, to profit from it. At the 2025 Open
Source Summit Europe, Dawn Foster talked about how those dynamics can
play out, with an eye toward a couple of tactics — rug pulls and forks — that
are available to try to shift power in one direction or another.

[$] The dependency tracker for complex deadlock detection

Post Syndicated from corbet original https://lwn.net/Articles/1036222/

Deadlocks are a constant threat in concurrent settings with shared
data; it is thus not surprising that the kernel project has long since
developed tools to detect potential deadlocks so they can be fixed before
they affect production users. Byungchul Park thinks that he has developed
a better tool that can detect more deadlock-prone situations. At the 2025 Open
Source Summit Europe, he presented an introduction to his dependency
tracker (or “DEPT”) tool and the kinds of problems it can detect.

[$] LWN.net Weekly Edition for September 4, 2025

Post Syndicated from corbet original https://lwn.net/Articles/1035384/

Inside this week’s LWN.net Weekly Edition:

  • Front: Maintaining curl; GNOME governance; Guix in Debian; Tracking untrusted data in the kernel; 32-Bit support; systemd v258.
  • Briefs: bcachefs maintenance; Linux from Scratch 12.4; Elf spec; Niri 25.08; Python documentary; GNOME executive director; Quotes; …
  • Announcements: Newsletters, conferences, security updates, patches, and more.

The hidden vulnerabilities of open source (FastCode)

Post Syndicated from corbet original https://lwn.net/Articles/1036373/

The FastCode site has a
lengthy article on how large language models make open-source projects
far more vulnerable to XZ-style attacks.

Open source maintainers, already overwhelmed by legitimate
contributions, have no realistic way to counter this threat. How do
you verify that a helpful contributor with months of solid commits
isn’t an LLM generated persona? How do you distinguish between
genuine community feedback and AI created pressure campaigns? The
same tools that make these attacks possible are largely
inaccessible to volunteer maintainers. They lack the resources,
skills, or time to deploy defensive processes and systems.

The detection problem becomes exponentially harder when LLMs can
generate code that passes all existing security reviews,
contribution histories that look perfectly normal, and social
interactions that feel authentically human. Traditional code
analysis tools will struggle against LLM generated backdoors
designed specifically to evade detection. Meanwhile, the human
intuition that spot social engineering attacks becomes useless when
the “humans” are actually sophisticated language models.

Security updates for Tuesday

Post Syndicated from corbet original https://lwn.net/Articles/1036369/

Security updates have been issued by AlmaLinux (kernel, mod_http2, postgresql, postgresql:15, and python39:3.9), Debian (libsndfile), Mageia (ceph, glibc, and golang), Oracle (postgresql and python39:3.9), Red Hat (aide, postgresql:12, postgresql:13, postgresql:15, and postgresql:16), SUSE (git, govulncheck-vulndb, jetty-minimal, nginx, python-future, and ruby2.5), and Ubuntu (imagemagick).

GNOME loses another executive director

Post Syndicated from corbet original https://lwn.net/Articles/1036218/

The GNOME Foundation has announced
that Steven Deobald will be leaving the position of Executive Director
after just four months.

We are extremely grateful to Steven for all this and more. Despite
these many positive achievements, Steven and the board have come to
the conclusion that Steven is not the right fit for the Executive
Director role at this time. We are therefore bidding Steven a fond
farewell.

[$] The future of 32-bit support in the kernel

Post Syndicated from corbet original https://lwn.net/Articles/1035727/

Arnd Bergmann started his Open
Source Summit Europe 2025 talk with a clear statement of position: 32-bit
systems are obsolete when it comes to use in any sort of new products. The
only reason to work with them at this point is when there is existing
hardware and software to support. Since Bergmann is the overall maintainer
for architecture support in the kernel, he is frequently asked whether
32-bit support can be removed. So, he concluded, the time has come to talk
more about that possibility.

[$] The challenge of maintaining curl

Post Syndicated from corbet original https://lwn.net/Articles/1034966/

Keynote sessions at Open Source Summit events tend not to allow much time for
detailed talks, and the 2025 Open
Source Summit Europe did not diverge from that pattern. Even so,
Daniel Stenberg, the maintainer of the curl
project, managed to cram a lot into the 15 minutes given to him.
Like the maintainers of many other projects, Stenberg is feeling some
stress, and the problems appear to be getting worse over time.

[$] The need to reliably preserve our community history

Post Syndicated from corbet original https://lwn.net/Articles/1034849/

The Internet is a wonderful thing; it allows anybody to look up
information of interest. Included in all of that is the history of the
free-software development community; how we got to where we are says a lot
about why things are the way they are and what might come next. So the
takeover of Groklaw rings a loud alarm; we have been reminded that history
stored on the Internet is an ephemeral thing and cannot be expected to
remain available forever.

[$] Shadow-stack control in clone3()

Post Syndicated from corbet original https://lwn.net/Articles/1034442/

Shadow stacks are a control-flow-integrity feature designed to defend
against exploits that manipulate a thread’s call stack. The kernel first
gained support for hardware-implemented shadow
stacks, for the x86 architecture, in the 6.6 release; 64-bit Arm
support followed in 6.13. This feature does not give user space much
control over the allocation of shadow stacks for new threads, though; a patch
series from Mark Brown may, after many attempts, finally be about
to change that situation.

Security updates for Tuesday

Post Syndicated from corbet original https://lwn.net/Articles/1035110/

Security updates have been issued by Debian (ffmpeg, firebird3.0, and luajit), Fedora (chromium, python3-docs, and python3.13), Oracle (aide, firefox, glibc, libxml2, and tomcat), Red Hat (aide, git, kernel, kernel-rt, libarchive, pam, python-cryptography, python3, python3.12, and webkit2gtk3), SUSE (cmake3, ffmpeg-4, kernel, kubernetes1.18, libqt4, minikube, net-tools, pam, postgresql16, proftpd, python-urllib3, python311, python312, python36, tomcat10, tomcat11, and webkit2gtk3), and Ubuntu (nginx).