Hírolvasó

Despite its limitations, MTE is still by far the most promising path forward for improving C/C++ software security in 2023. The ability of MTE to detect memory corruption exploitation at the first dangerous access provides a significant improvement in diagnostic and potential security effectiveness.

There is a separate section on weaknesses in the current kernel implementation of MTE support.

Working directly with upstream means not only can we integrate more closely with the core distribution, but we can also get issues in other packages fixed quickly and smoothly. This is particularly important for platforms like desktop ARM64, where we still run into random app and package bugs quite often. ARM64 desktop Linux has been a niche platform (until now!), and with much less testing comes a higher propensity for bugs, so it’s very important that we can address these issues quickly. Fedora already has a very solid, fully supported ARM64 port with a large userbase in the server/headless segment, so it is an excellent base to build upon and help improve the state of desktop Linux on ARM64 for everyone.

There is a version for "adventurous users" to play with now, with an official release expected by the end of the month.

August is now upon us, and the deadline for refereed track submissions is August 6, which is right around the corner. We have already received some excellent submissions, for which we gratefully thank our submitters!

For those thinking about submitting, please polish off your ideas, and point your browsers at the call-for-proposals page. Looking forward to your submissions.

Reminder: we’ve got a tight deadline to prepare the submissions for the LPC program committee to review, so, as communicated last year, we will not be extending the deadline this year, please submit by August 6th, anywhere on earth.

Izrael legnagyobb olajfinomító üzemeltetőjének, a BAZAN Groupnak a honlapja a világ legtöbb pontjáról elérhetetlen, mivel a fenyegetési aktorok azt állítják, hogy feltörték a csoport rendszereit.

The post Kibertámadás érhette Izrael legnagyobb olajfinomítóját first appeared on Nemzeti Kibervédelmi Intézet.

Recently I have been seeing some cracks in the dike. As more and more users of FOSS come on board, they put more and more demands on developers whose numbers are not growing sufficiently fast enough to keep all the software working.

I hear from FOSS developers that too few, and sometimes no, developers are working on blocks of code. Of course this can also happen to closed-source code, but this shortness hits mostly in areas that are not considered “sexy”, such as quality assurance, release engineering, documentation and translations.

2023 első felében a Checkmarx kutatói több, a bankszektort célzó, nyílt forráskódú szoftverek ellátási láncát (Open Source Software Supply Chain Attacks) érintő támadást észleltek.

The post Szakértők a bankszektor elleni OSS SCA támadásokra figyelmeztetnek first appeared on Nemzeti Kibervédelmi Intézet.

Az Ivanti MDM termékének (EPMM) egy kritikus sebezhetőségét (CVE-2023-35078) fenyegetési szereplők kihasználták norvég államigazgatási szervek elleni támadások során. A tech cég néhány napja egy újabb sebezhetőségről (CVE-2023-35081) közölt információkat.

The post Újabb aktívan kihasznált sérülékenységről közölt információt az Ivanti first appeared on Nemzeti Kibervédelmi Intézet.

So here we are, and the 6.5 release cycle continues to look entirely normal.

In fact, it's *so* normal that we have hit on a very particular (and peculiar) pattern with the rc4 releases: we have had *exactly* 328 non-merge commits in rc4 in 6.2, 6.3 and now 6.5. Weird coincidence.

And honestly, that weird numerological coincidence is just about the most interesting thing here.

Version 8.5 of rpki-client, OpenBSD's implementation of the Resource Public Key Infrastructure (RPKI) for Relying Parties (RP), has been released.

Features include:

• updated ASPA support
• Added support for gzip and deflate HTTP Content-Encoding compression
• 30%-50% performance improvement

See the announcement for full details.

LPC 2023 will host the second edition of the Rust MC. This microconference intends to cover talks and discussions on both Rust for Linux as well as other non-kernel Rust topics. Proposals can be submitted via LPC submission system, selecting the Rust MC track.

Rust is a systems programming language that is making great strides in becoming the next big one in the domain. Rust for Linux is the project adding support for the Rust language to the Linux kernel.

Rust has a key property that makes it very interesting as the second language in the kernel: it guarantees no undefined behavior takes place (as long as unsafe code is sound). This includes no use-after-free mistakes, no double frees, no data races, etc. It also provides other important benefits, such as improved error handling, stricter typing, sum types, pattern matching, privacy, closures, generics, etc.

Possible Rust for Linux topics:

• Rust in the kernel (e.g. status update, next steps…).
• Use cases for Rust around the kernel (e.g. subsystems, drivers,
  other modules…).
• Discussions on how to abstract existing subsystems safely, on API design, on coding guidelines…
• Integration with kernel systems and other infrastructure (e.g. build system, documentation, testing and CIs, maintenance, unstable features, architecture support, stable/LTS releases, Rust versioning, third-party crates…).Updates on its subprojects (e.g. klint, pinned-init)

Possible Rust topics:

• Language and standard library (e.g. upcoming features, stabilization of the remaining features the kernel needs, memory model…).
• Compilers and codegen (e.g. rustc improvements, LLVM and Rust, rustc_codegen_gcc, Rust GCC…).
• Other tooling and new ideas (bindgen, Cargo, Miri, Clippy, Compiler Explorer, Coccinelle for Rust…).
• Educational material.
• Any other Rust topic within the Linux ecosystem.

Last year was the first edition of the Rust MC and the focus was on showing the ongoing efforts by different parties (compilers, Rust for Linux, CI, eBPF…). Shortly after the Rust MC, Rust got merged into the Linux kernel. Abstractions are getting upstreamed, with the first major drivers looking to be merged soon: Android Binder, the Asahi GPU driver and the NVMe driver (presented in that MC).

We want to be very careful with backward compatibility. We do not want another Python 3 situation, so any changes in third-party code needed to accommodate no-GIL builds should just work in with-GIL builds (although backward compatibility with older Python versions will still need to be addressed). This is not Python 4. We are still considering the requirements we want to place on ABI compatibility and other details for the two builds and the effect on backward compatibility.

As StackRot is a Linux kernel vulnerability found in the memory management subsystem, it affects almost all kernel configurations and requires minimal capabilities to trigger. However, it should be noted that maple nodes are freed using RCU callbacks, delaying the actual memory deallocation until after the RCU grace period. Consequently, exploiting this vulnerability is considered challenging.

To the best of my knowledge, there are currently no publicly available exploits targeting use-after-free-by-RCU (UAFBR) bugs. This marks the first instance where UAFBR bugs have been proven to be exploitable, even without the presence of CONFIG_PREEMPT or CONFIG_SLAB_MERGE_DEFAULT settings.