Language Selection

English French German Italian Portuguese Spanish

Critical Linux vulnerability imperils users, even after “silent” fix

Filed under
Linux
Security

For years, the Linux operating system has contained a high-severity vulnerability that gives untrusted users with restricted accounts nearly unfettered "root" access over machines, including servers running in shared Web hosting facilities and other sensitive environments. Surprisingly, most users remain wide open even now, more than a month after maintainers of the open-source OS quietly released an update that patched the gaping hole.

The severity of the bug, which resides in the Linux kernel's "perf," or performance counters subsystem, didn't become clear until Tuesday, when attack code exploiting the vulnerability became publicly available (note: some content on this site is not considered appropriate in many work environments). The new script can be used to take control of servers operated by many shared Web hosting providers, where dozens or hundreds of people have unprivileged accounts on the same machine.

rest here




More in Tux Machines

Today in Techrights

Leftovers: OSS

  • Are Low-Code Platforms a Good Fit for Feds?
    Open-source code platforms — in part, because they’re often free — have long been a popular choice for digital service creation and maintenance. In recent years, however, some agencies have turned to low-code solutions for intuitive visual features such as drag-and-drop design functionality. As Forrester Research notes, low-code platforms are "application platforms that accelerate app delivery by dramatically reducing the amount of hand-coding required."
  • Crunchy Data Brings Enterprise Open Source POSTGRESQL To U.S. Government With New DISA Security Technical Implementation Guide
    Crunchy Data — a leading provider of trusted open source PostgreSQL and enterprise PostgreSQL technology, support and training — is pleased to announce the publication of a PostgreSQL Security Technical Implementation Guide (STIG) by the U.S. Department of Defense (DoD), making PostgreSQL the first open source database with a STIG. Crunchy Data collaborated with the Defense Information Systems Agency (DISA) to evaluate open source PostgreSQL against the DoD's security requirements and developed the guide to define how open source PostgreSQL can be deployed and configured to meet security requirements for government systems.
  • Democratizing IoT design with open source development boards and communities
    The Internet of Things (IoT) is at the heart of what the World Economic Forum has identified as the Fourth Industrial Revolution, an economic, technical, and cultural transformation that combines the physical, digital, and biological worlds. It is driven by such technologies as ubiquitous connectivity, big data, analytics and the cloud.

Software and today's howtos

Security and Bugs

  • Security updates for Thursday
  • Devops embraces security measures to build safer software
    Devops isn’t simply transforming how developers and operations work together to deliver better software faster, it is also changing how developers view application security. A recent survey from software automation and security company Sonatype found that devops teams are increasingly adopting security automation to create better and safer software.
  • This Xfce Bug Is Wrecking Users’ Monitors
    The Xfce desktop environment for Linux may be fast and flexible — but it’s currently affected by a very serious flaw. Users of this lightweight alternative to GNOME and KDE have reported that the choice of default wallpaper in Xfce is causing damaging to laptop displays and LCD monitors. And there’s damning photographic evidence to back the claims up.