Brief items

Vulnerable Arm GPU drivers under active exploitation (Ars Technica)

Ars Technica reports on an Arm advisory regarding exploitable vulnerabilities in a number of its GPU drivers.

The most prevalent platform affected by the vulnerability is Google’s line of Pixels, which are one of the only Android models to receive security updates on a timely basis. Google patched Pixels in its September update against the vulnerability, which is tracked as CVE-2023-4211.

As the article notes, the story on fixes for other devices is less clear.

Comments (21 posted)

Multiple Exim security vulnerabilities disclosed

The "Zero Day Initiative" site has posted a number of advisories (1, 2, 3, 4, 5, 6) describing a number of flaws in the Exim mail server, some of which are exploitable remotely. These problems, allegedly, were first reported to the project in June 2022, well over one year ago. There is some disagreement over the timing of events, with Exim developer Heiko Schlittermann claiming that no actual information was received until last May, and an anonymous ZDI representative disputing that story.

Either way, the vulnerabilities are now disclosed, but patches are not yet on offer; Schlittermann said that "Fixes are available in a protected repository and are ready to be applied by the distribution maintainers", so hopefully that situation will change soon.

Comments (18 posted)

A local root vulnerability in glibc

Qualys has posted an advisory for a vulnerability in the GNU C Library related to the handling of the GLIBC_TUNABLES environment variable:

We successfully exploited this vulnerability and obtained full root privileges on the default installations of Fedora 37 and 38, Ubuntu 22.04 and 23.04, Debian 12 and 13; other distributions are probably also vulnerable and exploitable (one notable exception is Alpine Linux, which uses musl libc, not the glibc).

Updates from distributors are beginning to appear and should be applied on any systems with untrusted users. The curious can see the fix applied to glibc in this patch series.

Comments (43 posted)

OpenSSH 9.5 released

OpenSSH 9.5 is out. Significant changes include a transport-level ping mechanism and keystroke timing obfuscation:

This attempts to hide inter-keystroke timings by sending interactive traffic at fixed intervals (default: every 20ms) when there is only a small amount of data being sent. It also sends fake "chaff" keystrokes for a random interval after the last real keystroke. These are controlled by a new ssh_config ObscureKeystrokeTiming keyword.

Full Story (comments: 46)

Kernel release status

The current development kernel is 6.6-rc4, released on October 1. Linus said: "There's nothing particularly odd in here, if you don't count a week of no networking pull as being odd. That does result in rc4 being fairly small, but I suspect we'll just see a bigger rc5 to compensate."

Stable updates: none have been released in the last week. The 6.5.6, 6.1.56, and 5.15.134 updates are in the review process; they are due on October 6.

Comments (none posted)

Notes from the Git Contributor's Summit

For those who are curious about the recently concluded Git Contributor's Summit, Taylor Blau has posted an extensive set of notes from the event. Topics include next-generation backends, libification, backward compatibility, project management, and more.

Comments (6 posted)

Python 3.12 released

Version 3.12 of the Python programming language has been released. The "What’s New In Python 3.12" page has plenty of details. Highlights of the release include isolated subinterpreter support, more improvements to error messages, more flexible f-strings, Linux perf support for profiling, and lots more.

Comments (14 posted)