Sponsored By:

• Linode: Sign up using the link on this page and receive a $100 60-day credit towards your new account.
• Kolide: Kolide can help you nail third-party audits and internal compliance goals with endpoint security for your entire fleet.

Support Linux Action News

Links:

• A new privilege escalation vulnerability in the Linux kernel — The vulnerability consists of a stack buffer overflow due to an integer underflow vulnerability inside the nft_payload_copy_vlan function, which is invoked with nft_payload expressions as long as a VLAN tag is present in the current skb.
• netfilter: nft_payload: add C-VLAN support · torvalds/linux@f6ae9f1
• CVE-2023-0179
• CVE-2023-0179- Red Hat Customer Portal
• [net,3/3] netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits - Patchwork
• oss-sec: Re: CVE-2023-0179: Linux kernel stack buffer overflow in nftables: PoC and writeup
• libvirt 9.0 Released For Latest Linux Virtualization API — Libvirt 9.0 adds support for external snapshot deletion with QEMU using its existing API, libvirt 9.0 with QEMU now supports PASST as "Plug A Simple Socket Transport" for connecting an emulated network device to the host's network, QEMU external back-end support for SWTPM as a software Trusted Platform Module (TPM), support for passing file descriptors rather than passing files for the QEMU disk, and other additions.
• JFS Filesystem’s Days are Numbered — IBM developed the JFS file-system originally in the 90's for AIX and the second-generation implementation then ported to Linux after it was made open-source.
• Firefox 109.0 Ships Manifest Version 3 — Manifest Version 3 (MV3) extension support is now enabled by default (MV2 remains enabled/supported). This major update also ushers an exciting user interface change in the form of the new extensions button.
• Here’s what’s going on in the world of extensions
• Manage your extensions using the extensions button in the toolbar
• Manifest v3 signing available November 21 on Firefox Nightly
• Google delays start of Manifest V2 Chrome extension deprecation — The original plan called for Chrome Beta, Dev, and Canary builds to start experiments that turned off Manifest V2 extension support. Additionally, Manifest V3 would be required to get the “Featured” badge in the Chrome Web Store. 
• Firefox 109 Adds New Extensions Button, Manifest V3 Support — The biggest new feature is the new Unified Extensions button in the toolbar.
• Chrome’s “Manifest V3” plan to limit ad-blocking extensions is delayed
• Chrome Users Beware: Manifest V3 is Deceitful and Threatening — Manifest V3, or Mv3 for short, is outright harmful to privacy efforts. It will restrict the capabilities of web extensions

Sponsored By:

• Linode: Sign up using the link on this page and receive a $100 60-day credit towards your new account.
• Kolide: Kolide can help you nail third-party audits and internal compliance goals with endpoint security for your entire fleet.

Support Linux Action News

Links:

• Shikitega - AT&T Alien Labs — New stealthy malware targeting Linux
• LINUX Unplugged 474: Linux’s Malware Inevitability
• New Linux malware combines unusual stealth with a full suite of capabilities — "Threat actors continue to search for ways to deliver malware in new ways to stay under the radar and avoid detection," AT&T Alien Labs researcher Ofer Caspi wrote.
• New Linux malware evades detection using multi-stage deployment
• Shape-shifting cryptominer savaging Linux endpoints and IoT — The malware was dubbed "Shikitega" for its extensive use of the popular Shikata Ga Nai polymorphic encoder, which allows the malware to "mutate" its code to avoid detection. Shikitega alters its code each time it runs through one of several decoding loops that AT&T said each deliver multiple attacks, beginning with an ELF file that's just 370 bytes.
• Next-Gen Linux Malware Takes Over Devices With Unique Tool Set
• OpenWrt 22.03 Released With Updated Firewall, Support For 180+ New Devices - Phoronix
• [OpenWrt Wiki] OpenWrt 22.03.0 - First Stable Release - 6 September 2022
• Linux Foundation Announces Open Wallet Foundation — The Linux Foundation, a global nonprofit organization enabling innovation through open source, today announced the intention to form the OpenWallet Foundation (OWF), a new collaborative effort to develop open source software to support interoperability for a wide range of wallet use cases.
• Linux Foundation announces the OpenWallet Foundation to develop interoperable digital wallets
• Welcoming PyTorch to the Linux Foundation
• Facebook Transfers PyTorch AI Framework to Linux Foundation for Governance — Today we are more than thrilled to welcome PyTorch to the Linux Foundation. Honestly, it’s hard to capture how big a deal this is for us in a single post but I’ll try.
• PyTorch strengthens its governance by joining the Linux Foundation
• Google Pixelbook is no more, proving the world wasn’t ready for premium Chromebooks | TechRadar
• Linux Plumbers Conference - YouTube
• LPC 2022: Rust Linux Drivers Capable Of Achieving Performance Comparable To C Code - Phoronix
• IO_uring Continues To Prove Very Exciting: Promising io_uring_spawn Announced — It also continues to be relentlessly optimized by Jens Axboe and others for maximum performance potential. The latest innovation around IO_uring that was announced this week at Linux Plumbers Conference 2022 in Dublin is io_uring_spawn.
• An io_uring-based user-space block driver
• A pair of Rust kernel modules
• Compiling Rust with GCC: an update
• Mesa’s Rust OpenCL Implementation Merged
• Adding rusticl (!15439) · Merge requests · Mesa / mesa · GitLab
• LPC 2022 - Kernel Summit - Lansdowne - YouTube