Sponsored By:

• Kolide: Kolide can help you nail third-party audits and internal compliance goals with endpoint security for your entire fleet.
• Linode: Sign up using the link on this page and receive a $100 60-day credit towards your new account.

Support Linux Action News

Links:

• New versions of Ubuntu Touch, Mir, and Unity arrive — Various parts of Ubuntu's canceled desktop/fondleslab convergence project are all still ticking away – some officially and some thanks to user communities.
• Ubuntu Touch OTA-24 Release
• Mir release 2.10.0
• Unity 7.6 is now available for Arch Linux
• Ubuntu Touch OTA-24 Released for Ubuntu Phone Users
• Google updates 2013 Chromecast for first time in over three years — In a new batch of Chromecast updates, Google has released new firmware for the first-generation Chromecast for the first time in years.
• Chromecast firmware versions and release notes
• Eufy cameras caught sending local footage to cloud — Paul Moore, a security researcher, posted on Twitter last week a frightening security situation with Eufy home security products including camera-equipped doorbells.
• Google says Google should do a better job of patching Android phones — Project Zero calls out Android and Pixel for not fixing a GPU vulnerability.
• ClamAV 1.0.0 Released — The first version of ClamAV, which is developed by the US-based tech company Cisco and the open-source community, was released back in 2002.
• 20 Years in the Making: ClamAV Finally Hits Version 1.0
• Compute Accelerator Subsystem Being Introduced For Linux 6.2 — It's happening: the new "accel" compute accelerator subsystem is now queued for introduction with the Linux 6.2 kernel once that merge window opens in December.
• Red Hat Developers Announce Work On New “Composefs” File-System — Red Hat is working on Composefs as a way to construct and use read-only images that are verifiable and have some immediate use-cases around sharing of Podman container layers and with the verification support for use by OSTree.
• GitHub - composefs

Sponsored By:

• Linode: Sign up using the link on this page and receive a $100 60-day credit towards your new account.
• Ting: Save $25 off your first device, or $25 in service credit if you bring one!

Support Linux Action News

Links:

• Linux has been bitten by its most high-severity vulnerability in years — Dirty Pipe has the potential to smudge people using Linux and Linux derivitives.
• Catalin Cimpanu on Twitter — “DirtyPipe (CVE-2022-0847) is a vulnerability in the Linux kernel since 5.8 which allows overwriting data in arbitrary read-only files. This leads to privilege escalation. It is similar to CVE-2016-5195 “Dirty Cow” but is easier to exploit.
• Ron Amadeo on Twitter — “By my count, Dirty Pipe affects only brand-new Android 12 devices like the Pixel 6 and S22. Linux 5.8 and above has only been an Android option for five months."
• Canonical Patches “Dirty Pipe” Vulnerability in Ubuntu 21.10 and 20.04 LTS
• BLASTY on Twitter: “Hacked up a quick Dirty Pipe PoC that spawns a shell by hijacking (and restoring) the contents of a setuid binary.”
• The Dirty Pipe Vulnerability — The Dirty Pipe Vulnerability documentation
• AMD Posts Some New Linux Job Openings From Client CPU To Server — AMD would need a lot more Linux engineers to achieve the same level of timely Linux support and low-level kernel enhancements that Intel has been focused on for years, especially when it comes to Intel's open-source work beyond just the actual hardware device enablement.
• Introducing Native Matrix VoIP with Element Call! — What’s more, Element Call is built entirely on Matrix: it doesn’t need any additional servers to get going. You can run it against your existing Matrix homeserver to provide complete self-sovereignty… while still being able to talk to anyone else anywhere on the wider Matrix network! We will also be able to automatically use Matrix’s end-to-end encryption to secure all Element Call conferences
• call.element.io
• https://github.com/vector-im/element-call/issues
• Extending Matrix’s E2EE calls to multiparty
• Danielle Foré on Twitter — Okay it’s been a full month and this situation still isn’t resolved, and it sucks for you to just be completely in the dark and it’s pretty obvious something is up and people are asking what’s going on, so here is my side of the story 🧵
• Danielle gives an update on elementary Reddit Thread
• Jupiter Broadcasting East Coast Meetup