Post Syndicated from corbet original https://lwn.net/Articles/959457/

The LWN.net Weekly Edition for February 1, 2024 is available.

Post Syndicated from corbet original https://lwn.net/Articles/960357/

Version 2.39
of the GNU C Library has been released. Changes include integration with
the x86 shadow-stack mechanism, a couple of
new posix_spawn() variants for working with control groups, pidfd_spawn() and
pidfd_spawnp(), the C2X stdbit.h header, the removal
of the libcrypt library, and more. See the release notes
for details.

Post Syndicated from corbet original https://lwn.net/Articles/960344/

Version
24.2 of the LibreOffice office suite is available. Changes include
AutoRecovery enabled by default, styling of comments, better floating-table
support, improved accessibility, and more. See the release
notes for details.

Post Syndicated from corbet original https://lwn.net/Articles/960289/

Qualys has disclosed
a vulnerability in the GNU C Library that can be exploited by a local
attacker for root access. It was introduced in the 2.37 release, and also
backported to 2.36.

For example, we confirmed that Debian 12 and 13, Ubuntu 23.04 and
23.10, and Fedora 37 to 39 are vulnerable to this buffer
overflow. Furthermore, we successfully exploited an up-to-date,
default installation of Fedora 38 (on amd64): a Local Privilege
Escalation, from any unprivileged user to full root. Other
distributions are probably also exploitable.

Vulnerable systems with untrusted users should probably be updated in a
timely manner.

Post Syndicated from corbet original https://lwn.net/Articles/960248/

Security updates have been issued by Debian (bind9 and glibc), Fedora (ncurses), Gentoo (containerd, libaom, and xorg-server, xwayland), Mageia (python-pillow and zlib), Oracle (grub2 and tomcat), Red Hat (avahi, c-ares, container-tools:3.0, curl, firefox, frr, kernel, kernel-rt, kpatch-patch, libfastjson, libmicrohttpd, linux-firmware, oniguruma, openssh, perl-HTTP-Tiny, python-pip, python-urllib3, python3, rpm, samba, sqlite, tcpdump, thunderbird, tigervnc, and virt:rhel and virt-devel:rhel modules), SUSE (python-Pillow, slurm, slurm_20_02, slurm_20_11, slurm_22_05, slurm_23_02, and xen), and Ubuntu (libde265, linux-nvidia, mysql-8.0, openldap, pillow, postfix, and xorg-server, xwayland).

Post Syndicated from corbet original https://lwn.net/Articles/960036/

The eBPF Foundation has published a glossy document called The
State of eBPF; it seems mostly concerned with how a small number of
large companies are using and developing this technology.

No doubt, eBPF will become the new layer in the new cloud native
infrastructure stack, impacting the observability, performance,
reliability, networking, and security of all applications,
supporters say. Platform engineers will cobble together
eBPF-powered infrastructure building blocks to create platforms
that developers then deploy software on, adding business logic to
the mix, and replacing aging Linux kernel internals that cannot
keep up with today’s digital and, increasingly, cloud native world.

Post Syndicated from corbet original https://lwn.net/Articles/960008/

Security updates have been issued by Debian (pillow, postfix, and redis), Fedora (python-templated-dictionary and selinux-policy), Red Hat (gnutls, kpatch-patch, libssh, and tomcat), and Ubuntu (amanda, ceph, linux-azure, linux-azure-4.15, linux-kvm, and tinyxml).

Post Syndicated from corbet original https://lwn.net/Articles/959815/

Linus has released 6.8-rc2 for testing.
“So go out and test. It’s safe now. You trust me, right?”

Post Syndicated from corbet original https://lwn.net/Articles/959189/

While the mathematical realm of numbers is infinite, computers are only
able to represent a finite subset of them. That can lead to problems when
arithmetic operations would create numbers that the computer is unable to
store as the intended type. This condition, called “overflow” or
“wraparound” depending on the
context, can be the source of bugs, including unpleasant security
vulnerabilities, so it is worth avoiding. This patch
series from Kees Cook is intended to improve the kernel’s handling of
these situations, but it is running into a bit of resistance.

Post Syndicated from corbet original https://lwn.net/Articles/959069/

The free-software community has managed to build a body of software that is
worth, by most estimates, many billions of dollars; all of this code is
freely available to anybody who wants to use or modify it. It is an
unparalleled example of independent actors working cooperatively on a
common resource. Free software is certainly a success story, but all is
not perfect. One of the community’s greatest strengths — convincing
companies to contribute to this common resource — is also part of one of
its biggest weaknesses.

Post Syndicated from corbet original https://lwn.net/Articles/959461/

The AdaCore blog describes
some hardening features contributed to GCC for the GCC 14 release.

With -fharden-control-flow-redundancy, the compiler now verifies,
at the end of functions, whether the traversed basic blocks align
with a legitimate execution path. The purpose of this protective
measure is to detect and thwart attacks attempting to infiltrate
the middle of functions, thereby enhancing the overall security
posture of the compiled code.

Post Syndicated from corbet original https://lwn.net/Articles/958597/

The LWN.net Weekly Edition for January 25, 2024 is available.

Post Syndicated from corbet original https://lwn.net/Articles/959325/

Security updates have been issued by Debian (jinja2, openjdk-11, ruby-httparty, and xorg-server), Fedora (ansible-core and mingw-jasper), Gentoo (GOCR, Ruby, and sudo), Oracle (gstreamer-plugins-bad-free, java-17-openjdk, java-21-openjdk, python-cryptography, and xorg-x11-server), Red Hat (kernel, kernel-rt, kpatch-patch, LibRaw, python-pillow, and python-pip), Slackware (mozilla), SUSE (python-Pillow, rear118a, and redis7), and Ubuntu (libapache-session-ldap-perl and pycryptodome).

Post Syndicated from corbet original https://lwn.net/Articles/959163/

Version
122.0 of the Firefox browser it out. Changes include improved search
suggestions, improvements to the in-browser
translation feature, better line-breaking compatibility, and a shiny
new .deb package.

Post Syndicated from corbet original https://lwn.net/Articles/959127/

Security updates have been issued by Debian (kodi and squid), Fedora (ansible-core, java-latest-openjdk, mingw-python-jinja2, openssh, and pgadmin4), Gentoo (Apache XML-RPC), Red Hat (gnutls and xorg-x11-server), Slackware (postfix), SUSE (bluez and openssl-3), and Ubuntu (gnutls28, libssh, and squid).

Post Syndicated from corbet original https://lwn.net/Articles/958178/

Linus Torvalds was able to release 6.8-rc1
and close the 6.8 merge window on time despite losing power to his home for
most of a week. He noted that this merge window is “maybe a bit smaller
than usual“, but 12,239 non-merge changesets found their way into the
mainline, so it’s not that small. About 8,000 of those changes were
merged since the first-half summary was
written; the second half saw a lot of device-driver updates, but there
were other interesting changes as well.

Post Syndicated from corbet original https://lwn.net/Articles/958945/

The 6.8-rc1 kernel prepatch is out for
testing.

So this wasn’t the most pleasant merge window, but most of the
unpleasantness was entirely unrelated to the code base and almost
entirely related to nasty weather. Just a few technical
hiccups. And after a very big 6.7 release, 6.8 looks to actually be
smaller than average, although not really all that significantly
so.

Post Syndicated from corbet original https://lwn.net/Articles/958860/

The
6.7.1,
6.6.13, and
6.1.74
stable kernel updates have been released; each contains another set of
important fixes.

Post Syndicated from corbet original https://lwn.net/Articles/958438/

The proposed mseal() system call
stirred up some controversy when it was first posted in October 2023.
Since then, it has been evolving in a quieter fashion, and seems to have
reached a point where the relevant commenters are willing to accept it.
Should mseal() be merged in a future development cycle, it will
look rather different than it did at the outset.

Post Syndicated from corbet original https://lwn.net/Articles/958759/

The openSUSE News site has put up a
brief article on how Slowroll fits into the spectrum of openSUSE
distributions.

The idea behind Slowroll is to offer a distribution that improves
stability without losing access to new features in the base
packages such as the kernel, desktop environments and
packaging. These slower update cycles allow for more extensive
testing and validation of packages before their inclusion. Think of
Slowroll as more of a skip than a Leap.