Brief items

A new Polkit vulnerability

Qualys has announced the disclosure of a local-root vulnerability in Polkit. They are calling it "PwnKit" and have even provided a proof-of-concept video.

Successful exploitation of this vulnerability allows any unprivileged user to gain root privileges on the vulnerable host. Qualys security researchers have been able to independently verify the vulnerability, develop an exploit, and obtain full root privileges on default installations of Ubuntu, Debian, Fedora, and CentOS. Other Linux distributions are likely vulnerable and probably exploitable. This vulnerability has been hiding in plain sight for 12+ years and affects all versions of pkexec since its first version in May 2009.

Updates from distributors are already rolling out.

Comments (42 posted)

Kernel release status

The current development kernel is 5.17-rc1, released on January 23. Linus said:

5.17 doesn't seem to be slated to be a huge release, and everything looks fairly normal. We've got a bit more activity than usual in a couple of corners of the kernel (random number generator and the fscache rewrite stand out), but even with those things, the big picture view looks very much normal: the bulk is various driver updates, with architectures updates, documentation, and tooling being the bulk of the rest.

Note that "basic" support for case-insensitive filesystem was added to the NFS client after the 5.17-rc1 release.

Stable updates: 5.16.2, 5.15.16, 5.10.93, and 5.4.173 were released on January 20. The massive 5.16.3, 5.15.17, 5.10.94, 5.4.174, 4.19.226, 4.14.263, 4.9.298, and 4.4.300 stable updates are in the review process; they are due at any time. What does "massive" mean? It turns out that 5.16.3 broke Greg Kroah-Hartman's scripts, which were not prepared for the possibility of more than 1,000 patches in a single update.

Note that, while it has not been announced formally, the end of 4.4.x is coming and there may not be many (if any) releases after 4.4.300.

Comments (none posted)

Netfilter project: Settlement with Patrick McHardy

The netfilter project, which works on packet-filtering for the Linux kernel, has announced that it has reached a settlement (English translation) with Patrick McHardy that is "legally binding and it governs any legal enforcement activities" on netfilter programs and libraries as well as the kernel itself. McHardy has been employing questionable practices in doing GPL enforcement in Germany over the last six years or more. The practice has been called "copyright trolling" by some and is part of what led to the creation of The Principles of Community-Oriented GPL Enforcement.

This settlement establishes that any decision-making around netfilter-related enforcement activities should be based on a majority vote. Thus, each active coreteam member at the time of the enforcement request holds one right to vote. This settlement covers past and new enforcement, as well as the enforcement of contractual penalties related to past declarations to cease-and-desist.

Full Story (comments: 29)

Git 2.35.0 released

Version 2.35.0 of the Git source-code management system has been released. There are a lot of changes, as usual; see the announcement and this GitHub blog entry for details.

Comments (10 posted)

Rust 1.58.1 released

Anybody who upgraded to the recent Rust 1.58.0 release will probably want to move on to Rust 1.58.1; among other things it contains a fix for a security vulnerability in the standard library. "We recommend all users to update their toolchain immediately and rebuild their programs with the updated compiler".

Comments (90 posted)

Conill: the FSF’s relationship with firmware is harmful to free software users

Ariadne Conill writes about the FSF's policy toward proprietary firmware and, specifically, the rules for "Respects Your Freedom" certification.

Purism was able to accomplish this by making the Librem 5 have not one, but two processors: when the phone first boots, it uses a secondary CPU as a service processor, which loads all of the relevant blobs (such as those required to initialize the DDR4 memory) before starting the main CPU and shutting itself off. In this way, they could have all the blobs they needed to use, without having to worry about them being user visible from PureOS. Under the policy, that left them free and clear for certification.

This is not a new story; see Papering over a binary blob from 2011, for example.

Comments (117 posted)