Blog Section
Kees Cook, former chief sysadmin of kernel.org and leader of the Ubuntu Security Team, now working at Google on securing Android and ChromeOS, has published a set of patches implementing stack offset randomization for system call handling. These patches enhance kernel security by altering the stack placement, making stack attacks significantly more difficult and […]
Linus Torvalds reviewed the patches for enabling driver development in Rust for the Linux kernel and expressed some critical remarks. The major concern was the potential for panicking in erroneous situations, such as out-of-memory scenarios where dynamic memory allocation operations, including those within the kernel, could fail. Torvalds stated that such […]
Google has released Chrome 89.0.4389.128, fixing two vulnerabilities (CVE-2021-21206, CVE-2021-21220) that have working exploits (0-day) available. The CVE-2021-21220 vulnerability was used to compromise Chrome at the Pwn2Own 2021 competition. Exploitation of this vulnerability occurs through the execution of specially crafted WebAssembly code (the vulnerability is caused by a flaw in the WebAssembly virtual machine, allowing the read or write of arbitrary data […]
The release of the main branch nginx 1.19.10 has been formed, continuing the development of new features (while only critical bug fixes and vulnerabilities are addressed in the concurrently maintained stable branch 1.18). Key changes: The default value of the 'keepalive_requests' parameter, which defines the maximum number of requests that can be sent through a single keep-alive connection, has been increased from 100 to 1000. A new directive has been added […]
The release of X.Org Server 1.20.11 has been published, addressing a vulnerability (CVE-2021-3472) that allows privilege escalation in systems where the X server runs with root privileges. The issue stems from a bug in the XInput extension, leading to the modification of memory contents outside the allocated buffer when processing ChangeFeedbackControl requests with specially crafted input. A similar issue has also been resolved in the xwayland 21.1.1 component. […]
After two and a half years since the formation of branch 12.x, FreeBSD 13.0 has been released, which is prepared for architectures amd64, i386, powerpc, powerpc64, powerpc64le, powerpcspe, armv6, armv7, aarch64, and riscv64. Additionally, images have been created for virtualization systems (QCOW2, VHD, VMDK, raw) and cloud environments such as Amazon EC2, Google Compute Engine, and Vagrant. Key innovations include the transition to a unified c […]
Research groups Forescout Research Labs and JSOF Research have published the results of a joint security study on various implementations of the compression scheme used to pack repeated names in DNS messages, mDNS, DHCP, and IPv6 RA (packing duplicate parts of domains in messages containing multiple names). The work identified 9 vulnerabilities collectively named NAME:WRECK. The issues were identified […]
Google has introduced a new declarative logic programming language called Logica, designed for data manipulation and translating programs into SQL. The new language is aimed at those looking to use logic programming syntax when writing database queries. Currently, the resulting SQL code can be executed in Google BigQuery storage or in the PostgreSQL and SQLite databases, which are still […]
Amazon has announced the creation of the OpenSearch project, which is a fork of the search, analysis, and data storage platform Elasticsearch, along with the associated web interface platform Kibana. The code is distributed under the Apache 2.0 license. In the future, it is planned to rename the Amazon Elasticsearch Service to Amazon OpenSearch Service. OpenSearch is forked from the Elasticsearch 7.10.2 codebase. Official work on the fork […]
The development of the Slackware 15.0 distribution has transitioned to the beta testing stage. Slackware has been evolving since 1993 and is the oldest of the currently existing distributions. Its features include a lack of complications and a simple initialization system in the style of classic BSD systems, making Slackware an interesting solution for learning about Unix-like systems, conducting experiments, and getting acquainted with Linux. An installation image has been prepared for download, […]
Sawyer X has announced his departure from the leadership council of the Perl project and from the Core Team. He has also stepped down from his role in release management for Perl, ceased participation in the grants committee, withdrawn from speaking at the Perl conference, and deleted his Twitter account. Nevertheless, Sawyer X expressed his willingness to complete the ongoing release […]
The formation of a new nonprofit organization, the Open-Source FPGA Foundation (OSFPGA), has been announced. This foundation aims to develop, promote, and create an environment for collaborative development of open hardware and software solutions related to the use of Field-Programmable Gate Arrays (FPGAs), which allow for reprogramming of logic after the chip has been manufactured. Key binary operations (AND, NAND, OR, NOR, and XOR) in such […]