Post Syndicated from corbet original https://lwn.net/Articles/947825/
The 6.6-rc6 kernel prepatch is out for
testing. “So the previous week has been pretty calm, and a lot of the
”
discussion has been about future changes as so often happens late in the
release cycle.
Post Syndicated from corbet original https://lwn.net/Articles/947819/
The 6.1.58 stable kernel update has been
released; it consists mostly of a handful of reverts in the NFS subsystem.
Post Syndicated from corbet original https://lwn.net/Articles/946733/
The primary job of a compiler is to translate source code into a binary
form that can be run by a computer. Increasingly, though, developers want
more from their tools, compilers included. Since the compiler must
understand the code it is being asked to translate, it is in a good
position to provide information about how that code will execute — and
where things might go wrong. At the 2023 GNU Tools Cauldron,
David Malcolm talked about recent work to improve the diagnostic output
from the GCC compiler.
Post Syndicated from corbet original https://lwn.net/Articles/947733/
Version
23.10 of the Ubuntu distribution is out. Changes include support for
hardware-backed full-disk encryption, tighter control over user namespaces,
a new App Center application, and more.
Post Syndicated from corbet original https://lwn.net/Articles/947727/
Version
23.05.0 of the OpenWrt distribution has been released: “OpenWrt
“. Along with
23.05 supports over 1790 devices. Support for over 200 new devices was
added in addition to the device support by OpenWrt 22.03
new device support, this release features a switch to the mbedtls
cryptographic library, the ability to include utilities written in Rust, an
updated toolchain, and more.
Post Syndicated from corbet original https://lwn.net/Articles/947710/
Security updates have been issued by Debian (chromium, tomcat9, and webkit2gtk), Fedora (cacti, cacti-spine, grafana-pcp, libcue, mbedtls, samba, and vim), Oracle (kernel, libvpx, and thunderbird), Red Hat (bind and galera, mariadb), SUSE (exiv2, go1.20, go1.21, and kernel), and Ubuntu (ffmpeg).
Post Syndicated from corbet original https://lwn.net/Articles/947606/
The Civil Infrastructure Platform project has announced
that it will be maintaining the 6.1 kernel for a minimum of ten years past
its initial release (and, thus, through 2032).
CIP kernels are maintained like regular long-term-stable (LTS)
kernels, and developers of the CIP kernel are also involved in LTS
kernel review and testing. While regular LTS kernels are moving
back to 2 years maintenance, CIP kernels are set up for 10
years. In order to enable this extended lifetime, CIP kernels are
scoped-down in actively supported kernel features and target
architecture. At the same time, CIP kernels accept non-invasive
backports from newer mainline kernels that enable new hardware.
Post Syndicated from corbet original https://lwn.net/Articles/947173/
Programs running in the BPF machine can, depending on how they are
attached, perform a number of privileged operations; the ability to load
and run those programs, thus, must be a privileged operation in its own
right. Almost since the beginning of the extended-BPF era, developers have
struggled to find a way to allow users to run the programs they need
without giving away more privilege than is necessary. Earlier this year,
the idea of a BPF token ran into some
opposition from security-oriented developers. Andrii Nakryiko has since
returned with an
updated patch set that significantly increases the granularity of the
privileges that can be conferred with a BPF token.
Post Syndicated from corbet original https://lwn.net/Articles/947570/
Security updates have been issued by Debian (libcue, org-mode, python3.7, and samba), Fedora (libcue, oneVPL, oneVPL-intel-gpu, and xen), Mageia (glibc), Oracle (glibc, kernel, libssh2, libvpx, nodejs, and python-reportlab), Slackware (libcaca), SUSE (gsl, ImageMagick, kernel, opensc, python-urllib3, qemu, rage-encryption, samba, and xen), and Ubuntu (curl and samba).
Post Syndicated from corbet original https://lwn.net/Articles/946626/
The LWN.net Weekly Edition for October 12, 2023 is available.
Post Syndicated from corbet original https://lwn.net/Articles/947411/
Version
8.4.0 of the curl data-transfer tool has been released, mostly in
response to a relatively severe security vulnerability that can be
triggered when a SOCKS5 proxy server is in use. See this
blog post for details on what went wrong. “In hindsight, shipping a
”
heap overflow in code installed in over twenty billion instances is not an
experience I would recommend.
Post Syndicated from corbet original https://lwn.net/Articles/947409/
Security updates have been issued by Debian (curl, mediawiki, tomcat10, and tomcat9), Fedora (libcaca, oneVPL, oneVPL-intel-gpu, and tracker-miners), Gentoo (curl), Mageia (cups and firefox, thunderbird), Red Hat (curl, kernel, kernel-rt, kpatch-patch, libqb, libssh2, linux-firmware, python-reportlab, tar, and the virt:rhel module), Slackware (curl, libcue, libnotify, nghttp2, and samba), SUSE (conmon, curl, glibc, kernel, php-composer2, python-reportlab, samba, and shadow), and Ubuntu (curl, dotnet6, dotnet7, firefox, libx11, samba, tiff, and webkit2gtk).
Post Syndicated from corbet original https://lwn.net/Articles/947236/
The GitHub blog describes
a vulnerability in the libcue library (which is used by the GNOME
desktop) that can be exploited by a remote attacker to run code on a
desktop system if the target can be convinced to click on a malicious link.
The video shows me clicking a link in a webpage, which causes a cue
sheet to be downloaded. Because the file is saved to ~/Downloads,
it is then automatically scanned by tracker-miners. And because it
has a .cue filename extension, tracker-miners uses libcue to parse
the file. The file exploits the vulnerability in libcue to gain
code execution and pop a calculator.
Post Syndicated from corbet original https://lwn.net/Articles/947233/
Security updates have been issued by Fedora (chromium, firefox, and kernel), Gentoo (less and libcue), Red Hat (bind, libvpx, nodejs, and python3), Scientific Linux (firefox and thunderbird), SUSE (conmon, go1.20, go1.21, shadow, and thunderbird), and Ubuntu (libcue, ring, and ruby-kramdown).
Post Syndicated from corbet original https://lwn.net/Articles/946394/
One of the significant features added to the mainline kernel during the 6.6
merge window was multi-grain timestamps, which allow the kernel to
selectively store file modification times with higher resolution without
hurting performance. Unfortunately, this feature also caused some
surprising regressions, and was quickly ushered back out of the kernel as a
result. It is instructive to look at how this feature went wrong, and how
the developers involved plan to move forward from here.
Post Syndicated from corbet original https://lwn.net/Articles/947054/
Linus has released 6.6-rc5 for testing.
“Things are back to normal, and we have a networking pull this
”
week.
Post Syndicated from corbet original https://lwn.net/Articles/946851/
Red Hat has announced
that its longstanding “rhsa-announce” mailing list will be shut down on
October 10. That is the list that receives security advisories for
Red Hat Enterprise Linux and a whole slew of related products. Anybody who
was counting on that list for Red Hat security advisories will need to find
an alternative; a few options are listed in the announcement.
Post Syndicated from corbet original https://lwn.net/Articles/946254/
On its surface, the BPF virtual machine resembles many other computer
architectures; it has registers and instructions to perform the usual
operations. But there is a key difference: BPF programs must pass the
kernel’s verifier before they can be run. The verifier imposes a long list
of additional restrictions so that it can prove to itself that any given
program is safe to run; getting past those checks can be a source of
frustration for BPF developers. At the 2023 GNU Tools Cauldron,
José Marchesi looked at the problem of compiling for verified architectures
and how the compiler can generate code that will pass verification.
Post Syndicated from corbet original https://lwn.net/Articles/946732/
Ferrous Systems has announced
that its Ferrocene Rust compiler will be released under the Apache-2.0 and
MIT licenses.
Ferrocene is the main Rust compiler – rustc – but quality managed
and qualified for use in automotive and industrial environments
(currently by ISO 26262 and IEC 61508) by Ferrous Systems. It
operates as a downstream to the Rust project, further increasing
its testing and quality on specific platforms.
The license is free, but this is not being run as an open-source project;
specifically, contributions from the “general public” are not accepted.