Hírolvasó

As a result we are currently developing new data retention and disclosure policies. These policies will relate to our procedures for future government data requests, how and for what duration we store personally identifiable information such as user access records, and policies that make these explicit for our users and community.

The post goes on to detail exactly which fields in the database tables were used to fulfill the request (without identifying the targets, naturally). Meanwhile, another statement in the post leaves open the possibility that further subpoenas have been received since that time: We have waited for the string of subpoenas to subside, though we were committed from the beginning to write and publish this post as a matter of transparency, and as allowed by the lack of a non-disclosure order associated with the subpoenas received in March and April 2023.

A CISA egy közepes súlyosságú, Samsung készülékeket érintő biztonsági hiba aktív kihasználására figyelmeztetett. A CVE-2023-21492 a 11-es, 12-es és 13-as Android verziót futtató egyes Samsung készülékekre nézve jelent biztonsági kockázatot. A Samsung a problémát információfeltárási hibaként írta le, amelyet kihasználva egy privilegizált támadó megkerülheti az ASLR védelmet.

The post Samsung eszközöket használhattak kémkedésre first appeared on Nemzeti Kibervédelmi Intézet.

You can easily import audits done by Googlers into your own projects that attest to the properties of many open-source Rust crates. Then, equipped with this data, you can decide whether crates meet the security, correctness, and testing requirements for your projects.

This work uses the cargo vet tool covered here one year ago.

Thankfully, most embedded platforms almost always include some form of recovery via USB or UART, which usually involves sending a boot image to the platform’s ROM code. A few tools exist that leverage this functionality to offer quick recovery and reflashing via USB, such as STM32CubeProgrammer, SAM-BA or UUU. However, these tools are all vendor-specific, which means that developers working on various kinds of platforms have to switch between different tools and learn how to use each one.

To address this issue, Bootlin is happy to release today a new recovery and reflashing tool, called Snagboot.

In other words, out of all of the unique keys that had uploaded signatures to PyPI, only 36% of them were capable of being meaningfully verified at the time of audit. Even if all of those signatures uploaded in that 3 year period of time were made by one of those 36% of keys that are able to be meaningfully verified, that would still represent only 0.3% of all of those files.

Given all of this, the continued support of uploading PGP signatures to PyPI is no longer defensible.

Egy biztonsági kutató PoC eszközt adott közre "KeePass 2.X Master Password Dumper" néven, amely lehetővé teszi a KeePass mesterjelszó lekérdezését. Az eszköz a KeePass eddig még nem javított, CVE-2023-32784 néven nyomon követett sebezhetőségét használja ki arra, hogy a KeePass 2.x verziók esetén a memóriájából kinyerje a mesterjelszót.

The post Veszélyben lehet a KeePass jelszószéf tartalma! first appeared on Nemzeti Kibervédelmi Intézet.

Három új sebezhetőséggel bővült a CISA ismert módon kihasznált sérülékenységekről vezetett KEV (Known Exploited Vulnerabilities Catalog) nyilvántartása. A sérülékeny rendszerek használói számára javasolt a biztonsági frissítések mielőbbi telepítése.

The post Új sérülékenységek a CISA katalógusában first appeared on Nemzeti Kibervédelmi Intézet.

Az Apple többek között három nulladik napi sérülékenységhez adott ki biztonsági hibajavítást. A sebezhetőségeket a gyártói biztonsági közlemény szerint feltételezhetően aktívan kihasználják, ezért javasolt a biztonsági frissítések mielőbbi telepítése.

The post Frissítsen: Ismert módon kihasznált zero-day sérülékenységet javítottak Apple termékekben first appeared on Nemzeti Kibervédelmi Intézet.

It combines asynchronous I/O, system call polybatching, and flexible buffer management, and is IMHO the most substantial development in the Linux I/O model since Berkeley sockets (yes, I'm aware Berkeley sockets preceded Linux. Let's then say that they're the most substantial development in the UNIX I/O model to originate in Linux)

 Thanks for all the suggestions, on here, and on twitter and on mastodon, anyway who noted I could use a single fd and avoid all the pain was correct!

I hacked up an ever growing ftruncate/madvise memfd and it seemed to work fine. In order to use it for sparse I have to use it for all device memory allocations in lavapipe which means if I push forward I probably have to prove it works and scales a bit better to myself. I suspect layering some of the pb bufmgr code on top of an ever growing fd might work, or maybe just having multiple 2GB buffers might be enough.

Not sure how best to do shaderResourceResidency, userfaultfd might be somewhat useful, mapping with PROT_NONE and then using write(2) to get a -EFAULT is also promising, but I'm not sure how best to avoid segfaults for read/writes to PROT_NONE regions.

Once I got that going, though I ran headfirst into something that should have been obvious to me, but I hadn't thought through.

llvmpipe allocates all it's textures linearly, there is no tiling (even for vulkan optimal). Sparse textures are incompatible with linear implementations. For sparseImage2D you have to be able to give the sparse tile sizes from just the image format. This typically means you have to work out how large the tile that fits into a hw page is in w/h. Of course for a linear image, this would be dependent on the image stride not just the format, and you just don't have that information.

I guess it means texture tiling in llvmpipe might have to become a thing, we've thought about it over the years but I don't think there's ever been a solid positive for implementing it.

Might have to put sparse support on the back burner for a little while longer.