Security updates for Friday
Security updates have been issued by CentOS (kernel),
Debian (ghostscript, mesa, and postgresql-common), Fedora (chromium, php-
robrichards-xmlseclibs, php-robrichards-xmlseclibs3, samba, scap-security-guide,
and wpa_supplicant), Mageia (cpio, fribidi, libapreq2, python-numpy, webkit2,
and zeromq), openSUSE (ImageMagick, kernel, libtomcrypt, qemu, ucode-intel, and
xen), Oracle (kernel), Red Hat (ghostscript, kernel, and kernel-rt), Scientific
Linux (ghostscript and kernel), SUSE (bash, enigmail, ghostscript, ImageMagick,
kernel, libjpeg-turbo, openconnect, and squid), and Ubuntu (ghostscript,
imagemagick, and postgresql-common).
Cook: Security things in Linux v5.3
Kees Cook catches up with the security improvements in the
5.3 kernel.
"In recent exploits, one of the steps for making the attacker’s
life easier is to disable CPU protections like Supervisor Mode Access (and
Execute) Prevention (SMAP and SMEP) by finding a way to write to CPU control
registers to disable these features. For example, CR4 controls SMAP and SMEP,
where disabling those would let an attacker access and execute userspace memory
from kernel code again, opening up the attack to much greater flexibility. CR0
controls Write Protect (WP), which when disabled would allow an attacker to
write to read-only memory like the kernel code itself. Attacks have been using
the kernel’s CR4 and CR0 writing functions to make these changes (since it’s
easier to gain that level of execute control), but now the kernel will attempt
to 'pin' sensitive bits in CR4 and CR0 to avoid them getting disabled. This
forces attacks to do more work to enact such register changes going
forward."
[$] The Yocto Project 3.0 release
The Yocto Project recently announced its 3.0 release,
maintaining the spring/fall cadence it has followed for the past nine years. As
well as the expected updates, it contains new thinking on getting the best of
two worlds: source builds and prebuilt binaries. This fits well into a landscape
where reproducibility and software traceability, all the way through to device
updates, are increasingly important to handle complex security issues.
Security updates for Thursday
Security updates have been issued by Arch Linux (kernel,
linux-lts, and linux-zen), CentOS (kernel, sudo, and thunderbird), Debian
(linux-4.9), Fedora (samba), openSUSE (apache2-mod_auth_openidc, kernel, qemu,
rsyslog, and ucode-intel), Oracle (kernel), Red Hat (kernel and kernel-rt),
Scientific Linux (kernel), SUSE (kernel and microcode_ctl), and Ubuntu (kernel,
libjpeg-turbo, linux, linux-hwe, linux-oem, linux, linux-hwe, linux-oem-osp1,
and qemu).
[$] LWN.net Weekly Edition for November 14, 2019
The LWN.net Weekly Edition for November 14, 2019 is
available.
