The "Zero Day Initiative" site has posted a number of advisories (1, 2, 3, 4, 5, 6)describing a number of flaws in the Exim mail server, some of which areexploitable remotely. These problems, allegedly, were first reported tothe project in June 2022, well over one year ago. There is somedisagreement over the timing of events, with Exim developer HeikoSchlittermann claimingthat no actual information was received until last May, and an anonymousZDI representative disputingthat story.Either way, the vulnerabilities are now disclosed, but patches are not yeton offer; Schlittermann said that "Fixes are available in a protectedrepository and are ready to be applied by the distributionmaintainers", so hopefully that situation will change soon.
On September 27, 1983, Richard Stallman announced thefounding of the GNU project. His goal, which seemed wildly optimisticand unattainable at the time, was to write a complete Unix-like operatingsystem from the beginningand make it freely available. Exactly 40years later, the GNU projectcelebrated with a hacker meeting inSwitzerland. Your editor had the good fortune to be able to attend.
Security updates have been issued by Debian (firefox-esr, jetty9, and vim), Gentoo (Fish, GMP, libarchive, libsndfile, Pacemaker, and sudo), Oracle (nodejs:16 and nodejs:18), Red Hat (virt:av and virt-devel:av), Slackware (mozilla), SUSE (chromium, firefox, Golang Prometheus, iperf, libqb, and xen), and Ubuntu (linux-raspi).
While the CVE process was created in response to real problems, it's increasingly clear that CVE numbers arecreating problems of their own. At the 2023 GNU Tools Cauldron,Siddhesh Poyarekar expressed the frustration that toolchain developers havefelt as the result of arguing with security researchers about CVE-numberassignments. In response, the GNU toolchain community is trying to bettercharacterize what is - and is not - considered to be a security-relevantbug in its software.
Using larger block sizes in the kernel for I/O is a recurring topic instorage and block-layer circles. The topic came up in discussions at the Linux Storage, Filesystem, Memory-Management and BPF Summit (LSFMM)back in May. One of the participants in those discussions, Hannes Reinecke, gavea talk at Open Source Summit Europe 2023 with an overview of the reasonsbehind using larger blocks for I/O, the current status of that work, andwhere it all might lead from here.
The AI boom is clearly upon us, but there are still plenty of questionsswirling around this technology. Some of those questions are legal onesand there have been lawsuits filed to try to get clarification-and perhapsmonetary damages. Van Lindberg is a lawyer who is well-known in theopen-source world; he came to OpenSource Summit Europe2023 in Bilbao, Spain to try to put the currentwork in AI into its legal context.
Version118.0 of the Firefox browser has been released. Changes includeimproved fingerprinting prevention and automated translation: "Automatedtranslation of web content is now available to Firefox users! Unlikecloud-based alternatives, translation is done locally in Firefox, so thatthe text being translated does not leave your machine."
Security updates have been issued by Debian (exempi, glib2.0, lldpd, and netatalk), Fedora (curl, libppd, and linux-firmware), Oracle (kernel), and SUSE (Cadence, frr, modsecurity, python-CairoSVG, python-GitPython, and tcpreplay).
The 1.0 version of the LibrePCB "free, cross-platform, easy-to-use electronic design automation suite to draw schematics and design printed circuit boards". As noted in a blog post back in May, a grant has helped spur development of the tool. The focus for the release has been in adding features that were needed so that "there should be no show stopper anymore which prevents you from using LibrePCB for more complex PCB [printed circuit board] designs". New features include a 3D viewer and export format for working with designs in a mechanical computer aided design (CAD) tool, support for manufacturer part number (MFN) management, and lots of board editor features such as thermal relief pads in planes, blind & buried vias,keepout zones, and more. [Thanks to Alphonse Ogulla.]
The last year or so has seen the posting of a few new filesystem types thatare aimed at supporting container workloads. PuzzleFS, presented at the2023 Kangrejos gathering by ArielMiculas, is another contender in this area, but it has some features of itsown, including a novel compression mechanism and an implementation writtenin Rust.
The6.5.5,6.1.55,5.15.133,5.10.197,5.4.257,4.19.295, and4.14.326stable kernel updates have all been released; each contains another set ofimportant fixes.
Back in May, Andre Almeida presented somework toward the creation of user-space spinlocks using adaptivespinning. At that time, the work was stalled because there is, in Linux,currently no way to quickly determine whether a given thread is actuallyexecuting on a CPU. Some progress has since been made on that front; atthe 2023Open Source Summit Europe, Almeida returned to discuss how thatdifficulty might be overcome.
Security updates have been issued by Debian (gsl), Fedora (dotnet6.0 and dotnet7.0), Oracle (libwebp), Slackware (bind, cups, and seamonkey), SUSE (kernel and rust, rust1.72), and Ubuntu (cups, flac, gnome-shell, imagemagick, and python3.5).
All that Ankur Arora seemingly wanted to do with thispatch set was to make the process of clearing huge pages on x86systems go a little faster. What resulted was an extensive discussion onthe difficulties of managing preemption correctly in the kernel. It may bethat some changes will come to the plethora of preemption models that thekernel currently offers.
Security updates have been issued by Debian (mutt, netatalk, and python2.7), Fedora (chromium, golang-github-prometheus-exporter-toolkit, golang-github-xhit-str2duration, and golang-gopkg-alecthomas-kingpin-2), Oracle (dmidecode, frr, libwebp, open-vm-tools, and thunderbird), Red Hat (libwebp and open-vm-tools), SUSE (cups, frr, mariadb, openvswitch3, python39, qemu, redis7, rubygem-rails-html-sanitizer, and skopeo), and Ubuntu (bind9, cups, and libppd).
The "limited" C API for CPython extensions has been around for well over adecade at this point, but it has not seen much uptake. It is meant to giveextensions an API that will allow binaries built with it to be used formultiple versions of CPython, because those binaries will only access the stableABI that will not change when CPython does. Victor Stinner has beenworking on better definition for the API; as part of that work, he suggested that some of the C extensions in thestandard library start using it in an effort for CPython to "eat itsown dog food". The resulting discussion showed that there is still a fairamount of confusion about this API-and the thrust of Stinner's overall plan.
JDK 21, the reference implementation of the Java 21 language specification,hasbeen released. "This release includes fifteen JEPs [1], includingthe final versions of Record Patterns (440), Pattern Matching for switch(441), and Virtual Threads (444)".
The security of digital products has become a topic of regulationin recent years. Currently, the European Union is moving forwardwith another new law, which, if it comes into effect in a formclose to the current draft, will affect software developers worldwide.This new proposal, called the "CyberResilience Act" (CRA), brings mandatory security requirements on alldigital products, both softwareand hardware, that are available in Europe. While it aims at a worthy goal, theproposal is causing a stir among open-source communities.
Security updates have been issued by Debian (chromium, flac, gnome-shell, libwebp, openjdk-11, and xrdp), Fedora (giflib), Oracle (kernel), Red Hat (busybox, dbus, firefox, frr, kpatch-patch, libwebp, open-vm-tools, and thunderbird), Slackware (netatalk), SUSE (flac, gcc12, kernel, libeconf, libwebp, libxml2, and thunderbird), and Ubuntu (binutils, c-ares, libraw, linux-intel-iotg, nodejs, python-django, and vsftpd).
Processes in a Linux system run within their own virtual address spaces.Their virtual addresses map to physical pages provided by the hardware, butthe kernel takes pains to hide the physical addresses of those pages;processes normally have no way of knowing (and no need to know) where theirmemory is located in physical memory. As a result, the system calls formemory management also deal in virtual addresses. Gregory Price iscurrently trying to create an exception to this rule with aproposal for a new system call that would operate on memory using physicaladdresses.
Much of the kernel's performance is dependent on caching - keeping usefulinformation around for future use to avoid the cost of looking it up again.The kernel aggressively caches pages of file data, directory entries,inodes, slab objects, and much more. Without active measures, though,caches will tend to grow without bounds, leading to memory exhaustion. Thekernel's "shrinker" mechanism exists to be that active measure, butshrinkers have some performance difficulties of their own. Thispatch series from Qi Zheng seeks to address one of the worst of thoseby removing some locking overhead.
Security updates have been issued by Debian (c-ares and samba), Fedora (borgbackup, firefox, and libwebp), Oracle (.NET 6.0 and kernel), Slackware (libwebp), SUSE (chromium and firefox), and Ubuntu (atftp, dbus, gawk, libssh2, libwebp, modsecurity-apache, and mutt).
The Software Freedom Conservancy(SFC) has announcedthe availability of videos from thefirst-ever Free and Open Source Yearly(FOSSY) conference, which was held in July in Portland, Oregon in the US.
The fstat()system call retrieves some of the metadata - owner, size, protections,timestamps, and so on - associated with an open file descriptor. One mightnot think of it as a performance-critical system call, but there areworkloads that make a lot of fstat() calls; it is not somethingthat should be slowed unnecessarily. As it turns out, though, the GNU CLibrary (glibc) has been doing exactly that, but a fix is in the works.
Security updates have been issued by Debian (firefox-esr, libwebp, ruby-loofah, and ruby-rails-html-sanitizer), Fedora (open-vm-tools and salt), Oracle (.NET 7.0, dmidecode, flac, gcc, httpd:2.4, keylime, libcap, librsvg2, and qemu-kvm), Red Hat (.NET 6.0 and .NET 7.0), Slackware (libarchive and mozilla), SUSE (chromium and kernel), and Ubuntu (curl, firefox, ghostscript, open-vm-tools, postgresql-9.5, and thunderbird).
The "Common Vulnerabilities andExposures" (CVE) system was launched late in the previous century (September1999) to track vulnerabilities insoftware. Over the years since, it has had a somewhat checkeredreputation, along with some some attempts toreplace it, but CVE numbers are still the only effective way to trackvulnerabilities. While that can certainly be useful, theCVE-assignment (and severity scoring) process is not without its problems.The prominence of CVE numbers, and the consequent increase in "reputation" for a reporter, have combined to create a system that canbe-and is-actively gamed. Meanwhile, the organizations that oversee thesystem are ultimately not doing a particularly stellar job.
The6.5.3,6.4.16, and6.1.53stable kernel updates have been released; each contains a large number ofimportant fixes. Note that the 6.4.x line ends with 6.4.16.
Security updates have been issued by Debian (e2guardian), Fedora (libeconf), Red Hat (dmidecode, kernel, kernel-rt, keylime, kpatch-patch, libcap, librsvg2, linux-firmware, and qemu-kvm), Slackware (mozilla), SUSE (chromium and shadow), and Ubuntu (cups, dotnet6, dotnet7, file, flac, and ruby-redcloth).
The GCC stack-protector feature detects stack-based buffer overruns byputting a canary value on the stack and noticing if that value is changed.Itturns out, though, that dynamically allocated local variables (such asvariable-length arrays and space obtained with alloca()) areplaced beyond the canary, so overflows of those variables will not bedetected. As a result, arm64 binaries built with vulnerable versions ofGCC are not as protected as they should be and need to be rebuilt.
Arduino has emerged as one of theprime success stories of the open-hardware movement. In recent years, thecompany has shifted its focus toward Internet of Things (IoT)applications. As part of this transformation, it has completely redesignedits open-source integrated development environment (IDE), adding a moreprofessional feature set for its hobbyist target audience. If you haveexperimented with Arduino in the past, but have lost track of itsprogress, now might be a good time to give it another try.
Ars Technica reports on a credential-stealing Trojan horse that would infect only some of those who installed the "Free Download Manager". The article is based on a Kaspersky report that details the malicious payload offered up at that site from 2020 to 2022.
Security updates have been issued by Debian (node-cookiejar and orthanc), Oracle (firefox, kernel, and kernel-container), Red Hat (flac and httpd:2.4), Slackware (vim), SUSE (python-Django, terraform-provider-aws, terraform-provider-helm, and terraform-provider-null), and Ubuntu (c-ares, curl, linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-raspi, and linux-ibm, linux-ibm-5.4).
Linus Torvalds released6.6-rc1 and closed the 6.6 merge window on September10. At thatpoint, 12,230 non-merge changesets had been pulled into the mainlinerepository, which is exactly 500 more than were pulled for 6.5 at this stagein the cycle. Over 7,000 of those changes were pulled after our first-half summary was written; theybrought a fair amount of new functionality with them. Read on for anoverview of those changes.
LWN.net