Post Syndicated from corbet original https://lwn.net/Articles/964956/

Andrew ‘bunnie’ Huang provides an update on
his IRIS infrared chip-scanning project as the starting point for a
detailed summary on how chip customers can detect forgeries and
modifications in general.

The technique works because although silicon looks opaque at
visible light, it is transparent starting at near-infrared
wavelengths (roughly 1000 nm and longer). Today’s commodity optics
and CMOS cameras are actually capable of working with lights at
this wavelength; thus, IRIS is a low-cost and effective technique
for confirming the construction of chips down to block level. For
example, IRIS can readily help determine if a chip has the correct
amount of RAM, number of CPU cores, peripherals, bond pads,
etc. This level of verification would be sufficient to deter most
counterfeits or substitutions.

Post Syndicated from corbet original https://lwn.net/Articles/964381/

Before loading a BPF program, the kernel must verify that the program is
safe to run; among other things, that verification includes ensuring that
the program will terminate within a bounded time. That requirement has
long made writing loops in BPF a challenging task. The situation has
improved over the years for some types of loops, but others — including
linked-list traversal — are still awkward in BPF programs. A new set of
BPF primitives aims to make life easier for this use case through the
installation of what can be seen as a sort of circuit breaker.

Post Syndicated from corbet original https://lwn.net/Articles/964042/

The LWN.net Weekly Edition for March 7, 2024 is available.

Post Syndicated from corbet original https://lwn.net/Articles/964239/

The kernel’s memory-management subsystem is built on the concept of
“zones”, which were initially added to describe the physical
characteristics of the memory pages contained within them. Over time,
zones have taken on more of a policy-related role as well. With a patch
set called THP
allocator optimizations, Yu Zhao has set out to better define the role
of policy-related zones on the path toward adding two more of them, with
the ultimate purpose of improving the kernel’s support for transparent huge
pages (THPs).

Post Syndicated from corbet original https://lwn.net/Articles/964450/

Security updates have been issued by Debian (yard), Oracle (buildah and kernel), Red Hat (389-ds:1.4, edk2, frr, gnutls, haproxy, libfastjson, libX11, postgresql:12, sqlite, squid, squid:4, tcpdump, and tomcat), SUSE (apache2-mod_auth_openidc and glibc), and Ubuntu (linux-gke, python-cryptography, and python-django).

Post Syndicated from corbet original https://lwn.net/Articles/964337/

The 6.8-rc7 kernel prepatch is out for
testing.

So we finally have a week where things have calmed down, and in
fact 6.8-rc7 is smaller than usual at this point in time. So if
that keeps up (but that’s a fairly notable “if”) I won’t feel like
I need to do an rc8 this release after all.

So no guarantees, but assuming no bad surprises, we’ll have the
final 6.8 next weekend.

Post Syndicated from corbet original https://lwn.net/Articles/964305/

The
6.7.8 and
6.6.20
stable kernel updates have been released. They contain a single patch
addressing an ntfs3 filesystem build error introduced in the previous
round of updates.

Post Syndicated from corbet original https://lwn.net/Articles/963734/

The Linux kernel follows a monolithic design, and that brings a well-known
problem: all code in the kernel has access to the entirety of the kernel’s
address space. As a result, a bug in (for example) an obscure driver may
well be exploitable to wreak havoc on core-kernel data structures. Various
attempts have been made over the years to increase the degree of isolation
within the kernel. The latest of these, “SandBox
Mode” proposed by Petr Tesařík, makes it possible for the kernel to run
some limited code safely, but it has encountered a bit of a chilly reception.

Post Syndicated from corbet original https://lwn.net/Articles/963168/

The LWN.net Weekly Edition for February 29, 2024 is available.

Post Syndicated from corbet original https://lwn.net/Articles/963958/

The Open Collective
Foundation is an organization created to provide legal and financial
services for non-profit projects, many of which are associated with free
software. Projects hosted there are now beginning
to report that the Open Collective Foundation will be shutting down at
the end of the year, with an unwinding process over that time.

Unfortunately, over the past year, we have learned that Open
Collective Foundation’s business model is not sustainable with the
number of complex services we have offered and the fees we pay to
the Open Collective Inc. tech platform.

In late 2023, we made the decision to pause accepting new
collectives in order to create space for us to address the
issues. Unfortunately, it became clear that it would not be
financially feasible to make the necessary corrections, and we
determined that OCF is not viable.

Some more information can be found in the Dissolution FAQ. Note
that the Open Collective Foundation is distinct from Open Source Collective, which has hastened
to point out that it remains in operation as before, and both are
distinct from the Open Collective
platform.

Post Syndicated from corbet original https://lwn.net/Articles/963767/

Netflix has announced
the release of a tool called bpftop to help with the performance
optimization of BPF programs in the kernel:

bpftop provides a dynamic real-time view of running eBPF
programs. It displays the average execution runtime, events per
second, and estimated total CPU % for each program. This tool
minimizes overhead by enabling performance statistics only while it
is active.

Post Syndicated from corbet original https://lwn.net/Articles/963805/

Security updates have been issued by Debian (engrampa and libgit2), Fedora (libxls, perl-Spreadsheet-ParseXLSX, and wpa_supplicant), Gentoo (PyYAML), Mageia (packages and thunderbird), Red Hat (firefox, kernel, linux-firmware, thunderbird, and unbound), Slackware (openjpeg), SUSE (golang-github-prometheus-prometheus, installation-images, kernel, python-azure-core, python-azure-storage-blob, salt and python-pyzmq, SUSE Manager 4.2.11, SUSE Manager 4.3, SUSE Manager Server 4.2, and wayland), and Ubuntu (dnsmasq, libde265, libxml2, openjdk-17, openjdk-21, openjdk-lts, and postgresql-12, postgresql-14, postgresql-15).

Post Syndicated from corbet original https://lwn.net/Articles/963281/

In a recent episode, “Pitchforks for RDSEED“,
we learned that there was some uncertainty around whether hardware-based
random-number generators on x86 CPUs could fail. Since the consequences of
failure in some situations (confidential-computing applications in
particular) can be catastrophic, there was some concern about this prospect
and what to do about it. Since then, the situation has come a bit more
into focus, and there would appear to be an agreed-upon plan for changes to
be made to the kernel.

Post Syndicated from corbet original https://lwn.net/Articles/963589/

Linus has released 6.8-rc6 for testing.

Last week I said that I was hoping things would calm down a bit.
Technically things did calm down a bit, and rc6 is smaller than rc5
was. But not by a huge amount, and honestly, while there’s nothing
really alarming here, there’s more here than I would really like at
this point in the release.

So this may end up being one of those releases that get an
rc8. We’ll see.

Post Syndicated from corbet original https://lwn.net/Articles/963444/

Version 2.44.0 of the Git
source-code management system has been released. There is a long list of
changes, including the git
replay command for faster, server-side rebasing, a number of
command-line completion improvements, and more.

Post Syndicated from corbet original https://lwn.net/Articles/962782/

The Linux kernel uses a number of hardening techniques to try to protect
itself against compromise; one of those is kernel address-space layout
randomization (KASLR). But randomization is of little benefit if the
kernel spills the beans on where its code has ended up. As it happens, the
kernel has been doing exactly that — since 2007, in a behavior that
predates the addition of KASLR. Some changes are in the
works to close that hole, but it is illustrative of just how hard some
secrets are to keep.

Post Syndicated from corbet original https://lwn.net/Articles/962302/

The LWN.net Weekly Edition for February 22, 2024 is available.

Post Syndicated from corbet original https://lwn.net/Articles/963036/

Version 5.10 of the
RawTherapee raw photo editor is out. The list of changes is long, and
includes improved support for many camera-specific formats. (LWN looked at RawTherapee in 2022).

Post Syndicated from corbet original https://lwn.net/Articles/963035/

Security updates have been issued by CentOS (linux-firmware and python-reportlab), Debian (unbound), Fedora (freeglut and syncthing), Red Hat (edk2, go-toolset:rhel8, java-1.8.0-ibm, kernel, kernel-rt, mysql:8.0, oniguruma, and python-pillow), Slackware (libuv and mozilla), SUSE (abseil-cpp, grpc, opencensus-proto, protobuf, python- abseil, python-grpcio, re2, bind, dpdk, firefox, hdf5, libssh, libssh2_org, libxml2, mozilla-nss, openssl-1_1, openvswitch, postgresql12, postgresql13, postgresql14, postgresql15, postgresql16, python-aiohttp, python-time-machine, python-pycryptodomex, runc, and webkit2gtk3), and Ubuntu (kernel, libspf2, linux, linux-aws, linux-aws-hwe, linux-azure, linux-azure-4.15, linux-gcp,
linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, and linux, linux-aws, linux-kvm, linux-lts-xenial).

Post Syndicated from corbet original https://lwn.net/Articles/962924/

DNS resolvers (those that handle DNSSEC, at least) are almost uniformly
vulnerable to an exploit
that has been named “KeyTrap”. In short, the right type of packet can
send a DNS system into something close to an infinite loop, taking it out
of service indefinitely.

With just a single DNS packet, hackers could paralyze all common
DNS implementations and public DNS providers. Exploiting this
attack would have serious consequences for any application that
uses the internet, including the unavailability of technologies
such as web browsers, email and instant messaging. This devastating
effect prompted major DNS vendors to call KeyTrap “The worst attack
on DNS ever discovered”

Some more information and pointers to updates can be found on the
CVE-2023-50387 page; some distributors have been faster to get updates
out than others.

(Thanks to Dave Täht).