Brief items

The "Hertzbleed" vulnerability

Today's branded, logo-equipped vulnerability is known as Hertzbleed; it affects x86 processors (at least) and can be exploited in some situations to extract cryptographic keys from a remote server.

Hertzbleed takes advantage of our experiments showing that, under certain circumstances, the dynamic frequency scaling of modern x86 processors depends on the data being processed. This means that, on modern processors, the same program can run at a different CPU frequency (and therefore take a different wall time) when computing, for example, 2022 + 23823 compared to 2022 + 24436.

Comments (29 posted)

Processor MMIO stale-data vulnerabilities

The mainline kernel has just received a set of patches addressing a new set of (seemingly) Intel-specific hardware vulnerabilities.

Processor MMIO Stale Data Vulnerabilities are a class of memory-mapped I/O (MMIO) vulnerabilities that can expose data. The sequences of operations for exposing data range from simple to very complex. Because most of the vulnerabilities require the attacker to have access to MMIO, many environments are not affected. System environments using virtualization where MMIO access is provided to untrusted guests may need mitigation. These vulnerabilities are not transient execution attacks. However, these vulnerabilities may propagate stale data into core fill buffers where the data can subsequently be inferred by an unmitigated transient execution attack. Mitigation for these vulnerabilities includes a combination of microcode update and software changes, depending on the platform and usage model.

Three separate CVE numbers have been issued for variants of this vulnerability; more information can be found in this documentation patch. Stable updates containing these fixes are in the review process and should be released shortly.

Comments (1 posted)

"Total cookie protection" from Firefox

Mozilla has announced the enabling of its "total cookie protection" feature in all versions of the Firefox browser.

Total Cookie Protection works by creating a separate “cookie jar” for each website you visit. Instead of allowing trackers to link up your behavior on multiple sites, they just get to see behavior on individual sites. Any time a website, or third-party content embedded in a website, deposits a cookie in your browser, that cookie is confined to the cookie jar assigned to only that website. No other websites can reach into the cookie jars that don’t belong to them and find out what the other websites’ cookies know about you.

Comments (21 posted)

Kernel release status

The current development kernel is 5.19-rc2, released on June 12. Linus said:

And yes, because I expected the rc2 week to be fairly quiet, I did a system update on my workstation, and as a result I spent a day or two then sorting out most of the fallout from the resulting compiler upgrade to gcc-12. Some of it ended up being a bit heavy-handed, and we'll be tweaking things further. And some of it ends up being an actual compiler misfeature.

Stable updates: 5.18.3, 5.17.14, 5.15.46, and 5.10.121 were released on June 9, followed by 5.18.4, 5.17.15, 5.15.47, 5.10.122, 5.4.198, 4.19.247, 4.14.283, and 4.9.318 on June 14. Note that 5.17.15 will be the last 5.17.x release.

The relatively small 5.18.5, 5.15.48, 5.10.123, 5.4.199, 4.19.248, 4.14.284, and 4.9.319 stable updates, containing mainly the mitigations for the latest round of hardware vulnerabilities, are in the review process; they are due on or after June 16.

Comments (none posted)

CFP for the Kernel and Maintainers Summits

The 2022 Kernel Summit and Maintainers Summit will be held in Dublin; the Kernel Summit will run as part of the Linux Plumbers Conference (September 12-14) while the Maintainers Summit will be on September 15. The call for proposals for both events has been posted. The deadline for the Kernel Summit is tight (June 19), so this is not the time for anybody wanting to speak to procrastinate.

Comments (none posted)

Quote of the week

While there are many proponents of "eBPF is good for everything and your grandma" approach, this opinion is not universally shared. One big risk is that this will eventually lead to possibility of having whole drivers / core code written in eBPF, which could potentially lead to decreased maintainability and supportability, also due to big fragmentation of the code (eBPF programs might not necessarily be shipped together with the kernel codebase).

This could potentially be a big risk for distros as well, as we (as a distro vendor) might be very quickly losing control over what is actually running in the context of the kernel they are bound to be supporting.

— Jiri Kosina

Comments (3 posted)

Diving into GCC internals

For those who would like to know more about how GCC works, David Malcolm has enhanced his GCC for new contributors guide with a section on GCC internals. It includes a good overview of the various GCC passes and the internal representations used to describe a program at various stages.

Full Story (comments: none)

K9 mail to become Thunderbird on Android

The Thunderbird project's announcement of its plans for an Android client contain a bit of a surprise:

To that end, we’re thrilled to announce that today, K-9 Mail officially joins the Thunderbird family. And [K9 maintainer Christian Ketterer] has already joined the full-time Thunderbird staff, bringing along his valuable expertise and experience with mobile platforms.

Ultimately, K-9 Mail will transform into Thunderbird on Android.

That means the name itself will change and adopt Thunderbird branding. Before that happens, we need to reach certain development milestones that will bring K-9 Mail into alignment with Thunderbird’s feature set and visual appearance.

Comments (34 posted)

Plasma 5.25.0 released

Version 5.25.0 of the KDE-based Plasma desktop has been released. New features include support for touchpad and touchscreen gestures, an "overview" mode for navigating between windows, additional color configuration options, and more.

Comments (1 posted)

Mourning Marina Zhurakhinskaya

From Sage Sharp comes the sad news that Marina Zhurakhinskaya, the founder of the Outreach Program for Women (now known as Outreachy), has passed away. "Marina died on Saturday after winning her struggle with cancer for three years. We would like to elevate Marina's message to encourage people to test themselves for genetic markers for breast cancer".

See this Software Freedom Conservancy post for more information her life and work.

Full Story (comments: 10)