- wlug - list.wlug.org.nz

Ransomware attackers quickly weaponize PHP vulnerability with 9.8 severity rating
by Peter Reutemann 17 Jun '24

17 Jun '24

'Ransomware criminals have quickly weaponized an easy-to-exploit vulnerability in the PHP programming language that executes malicious code on web servers, security researchers said. As of Thursday, Internet scans performed by security firm Censys had detected 1,000 servers infected by a ransomware strain known as TellYouThePass, down from 1,800 detected on Monday. The servers, primarily located in China, no longer display their usual content; instead, many list the site’s file directory, which shows all files have been given a .locked extension, indicating they have been encrypted. An accompanying ransom note demands roughly $6,500 in exchange for the decryption key. The vulnerability, tracked as CVE-2024-4577 and carrying a severity rating of 9.8 out of 10, stems from errors in the way PHP converts Unicode characters into ASCII. A feature built into Windows known as Best Fit allows attackers to use a technique known as argument injection to convert user-supplied input into characters that pass malicious commands to the main PHP application. Exploits allow attackers to bypass CVE-2012-1823, a critical code execution vulnerability patched in PHP in 2012. CVE-2024-4577 affects PHP only when it runs in a mode known as CGI, in which a web server parses HTTP requests and passes them to a PHP script for processing. Even when PHP isn’t set to CGI mode, however, the vulnerability may still be exploitable when PHP executables such as php.exe and php-cgi.exe are in directories that are accessible by the web server. This configuration is extremely rare, with the exception of the XAMPP platform, which uses it by default. An additional requirement appears to be that the Windows locale—used to personalize the OS to the local language of the user—must be set to either Chinese or Japanese.' -- source: https://arstechnica.com/security/2024/06/thousands-of-servers-infected-with… Cheers, Peter

2 1

Raspberry Pi is Now a Public Company
by Peter Reutemann 12 Jun '24

12 Jun '24

'Who would have thought that Raspberry Pi, the maker of the tiny, cheap, single-board computers, would become a public company? Yet, this is exactly what's happening: Raspberry Pi priced its IPO on the London Stock Exchange on Tuesday morning at $3.56 per share, valuing it at $689 million. Shortly after that, the company's shares jumped a nice 32% to $4.70. It means that Raspberry Pi could end up raising more than $200 million during its IPO process. Raspberry Pi has sold 60 million units since its inception. In 2023 alone, Raspberry Pi generated $266 million in revenue and $66 million in gross profit. Raspberry Pi Ltd, the public company, is the commercial subsidiary of the Raspberry Pi Foundation. The Foundation says it wants to make it easier for people to learn coding through a low-cost, programmable computer. It also remains the main shareholder of Raspberry Pi Ltd.' -- source: https://tech.slashdot.org/story/24/06/11/144251 Cheers, Peter

1 0

One-Line Patch For Intel Meteor Lake Yields Up To 72% Better Performance
by Peter Reutemann 11 Jun '24

11 Jun '24

'Michael Larabel reports via Phoronix: Covered last week on Phoronix was a new patch from Intel that with tuning to the P-State CPU frequency scaling driver was showing big wins for Intel Core Ultra "Meteor Lake" performance and power efficiency. I was curious with the Intel claims posted for a couple benchmarks and thus over the weekend set out to run many Intel Meteor Lake benchmarks on this one-line kernel patch... The results are great for boosting the Linux performance of Intel Core ultra laptops with as much as 72% better performance. [...] When looking at the CPU power consumption overall, for the wide variety of workloads tested it was just a slight uptick in power use and thus overall leading to slightly better power efficiency too. See all the data here. So this is quite a nice one-line Linux kernel patch for Meteor Lake and will hopefully be mainlined to the Linux kernel for Linux 6.11 if not squeezing it in as a "fix" for the current Linux 6.10 cycle. It's just too bad though that it took six months after launch for this tuned EPP value to be determined. Fresh benchmarks between Intel Core Ultra and AMD Ryzen on the latest Linux software will be coming up soon on Phoronix.' -- source: https://hardware.slashdot.org/story/24/06/10/2031256 Cheers, Peter

1 0

Nasty Linux Bug, CVE-2024-1086, is on the loose
by Peter Reutemann 05 Jun '24

05 Jun '24

'A few months back, CVE-2024-1086, a nasty use-after-free vulnerability in the Linux kernel's netfilter, was revealed. With a Common Vulnerability Scoring System (CVSS) score of 7.8, this bug, with the foundation for most Linux network firewall and Network Address Translation (NAT) programs, was a nasty little security hole. With it, Netfliter's table component could be exploited to achieve local privilege escalation. Worse still, you didn't need to be terribly clever to use it, so a local attacker could escalate privileges from a regular user to root in no time flat. Adding insult to injury, this vulnerability was present in pretty much all the major Linux distributions, including Debian, Fedora, Red Hat, and Ubuntu. In short, pretty much any Linux distribution using any kernel version between 5.14 and 6.6.14 could be hacked. Ouch! But, the fix has been in place since January 2024, when the flaw was patched. So, if we've been good little system administrators, we shouldn't have anything to worry about, right? Right!? Wrong. The US Cybersecurity and Infrastructure Security Agency (CISA) has flagged it and added it to the Known Exploited Vulnerabilities (KEV) catalog. It turns out that it's being actively exploited in the wild.' -- source: https://opensourcewatch.beehiiv.com/p/nasty-linux-bug-cve20241086-loose Cheers, Peter

1 0

The Raspberry Pi 5 Gets an AI Upgrade
by Peter Reutemann 05 Jun '24

05 Jun '24

'Today, Raspberry Pi introduced a new kit that adds AI functionality to the Raspberry Pi 5. ZDNet reports: The Raspberry Pi AI kit combines an M.2-format Hailo 8L AI accelerator with the Raspberry Pi M.2 HAT+ to create a powerful yet power-efficient solution. The Hailo-8L NPU (Neural Processing Unit) chip, capable of 13 trillion operations per second (TOPS), is built into an M.2 2242 form factor module that attaches to the M.2 HAT+. When connected to a Raspberry Pi 5 board running the latest Raspberry Pi OS, the NPU is automatically available for AI computing tasks. The AI module also has direct access to the Raspberry Pi's camera software stack and works with both first-party and third-party cameras. The NPU allows the Raspberry Pi 5 to perform AI tasks such as object and facial recognition, human pose analysis, and more. Using an NPU frees up the Raspberry Pi 5's CPU, allowing it to focus on other tasks, making your projects more efficient and powerful. The Raspberry Pi AI kit is also compatible with the Raspberry Pi Active Cooler, ensuring optimal performance without overheating. Additionally, you can purchase a clear protective layer to prevent damage to the board, giving you peace of mind while working on your projects. The AI kit is priced at $70. It's available from Raspberry Pi Approved Resellers, including PiHut, PiShop.us, and CanaKit. ' -- source: https://hardware.slashdot.org/story/24/06/04/2037238 Cheers, Peter

1 0

CentOS 7’s Final Countdown: 30 Days Left Until Support Ends
by Peter Reutemann 04 Jun '24

04 Jun '24

'In just 30 days, we’ll witness the end of an era for Linux with the cessation of support for CentOS 7—the last supported version of this once-dominant server operating system still receiving updates. Let’s take a quick look back at its journey. Ten years ago, on July 7, 2014, CentOS 7 was released as a fully compatible fork of Red Hat Enterprise Linux 7. Since its initial CentOS 2 version in 2004, the distribution has become extremely popular, establishing itself as the go-to server operating system over the last decade. After nine minor version updates, the latest being CentOS 7.9, in November 2020, Red Hat made a significant announcement. It marked the end of CentOS as a server operating system and transitioned it to CentOS Stream—a rolling release distro and upstream public development branch for Red Hat Enterprise Linux (RHEL). To complicate things further, CentOS 8, expected to receive updates until 2029, was prematurely retired at the end of December 2021. This leaves only CentOS 7 as the only version to complete its entire maintenance period, which ends in just 30 days on June 30, 2024. So, consider this as a final reminder if you’re still using CentOS 7 and haven’t yet migrated your system. Time is running out, and here are some alternative options to switch to a RHEL-compatible and supported replacement.' -- source: https://linuxiac.com/centos-7-has-30-days-left-until-support-ends/ Cheers, Peter

1 0

Fun With The du Command
by Lawrence D'Oliveiro 29 May '24

29 May '24

Looking at the space taken up by my copy of the Blender source code: ldo(a)theon:projects> du -ks blender 1444272 blender Most of that is in the commit history: ldo(a)theon:projects> du -ks blender/.git 1139640 blender/.git So how much isn’t? ldo(a)theon:projects> du -ks blender/.git blender 1139640 blender/.git 304632 blender Do you see what happened there? If you specify a directory, and then its containing directory on the same command, du will subtract the usage of the former from the latter. This gives you an easy way of determining the space taken up by a directory, not including particular subdirectories. This can be broken down even more: ldo(a)theon:projects> du -ks blender/.git blender/extern blender/intern blender/source blender 1139640 blender/.git 40536 blender/extern 15712 blender/intern 105188 blender/source 143196 blender Here, “extern” is various open-source libraries from other sources, that have been copied into the Blender source tree, while “intern” is code that originated from Blender itself, that has been organized into its own libraries. And as you can see, there is still a whole bunch left in other subdirectories. Does this work recursively? ldo(a)theon:projects> du -ks blender/.git blender/intern/cycles blender/intern blender 1139640 blender/.git 8880 blender/intern/cycles 6832 blender/intern 288920 blender Yes it does. Here we can see that the Cycles renderer makes up a bit over half the contents of “intern”.

1 0

datamash - basic numeric, textual and statistical operations
by Peter Reutemann 28 May '24

28 May '24

Hi everyone I quite often need to do some quick and dirty statistical calculations on the command-line and I typically use cat and sed to extract the data that I need from text files. In the past, I've then switched to LibreOffice Calc for some basic statistics like mean/stdev. Today, I finally spent a bit more time having a look around what else I can use directly on the command-line and came across the following that fits the bill perfectly: datamash - https://www.gnu.org/software/datamash/ With that tool, I can finally apply a single command-line to textual output for generating a quick mean/stdev: ... | datamash mean 1 sstdev 1 --header-out mean(field-1) sstdev(field-1) 577.62815533981 128.99238940453 Cheers, Peter

2 1

Memory Sealing 'mseal' System Call Merged For Linux 6.10
by Peter Reutemann 27 May '24

27 May '24

'"Merged this Friday evening into the Linux 6.10 kernel is the new mseal() system call for memory sealing," reports Phoronix: The mseal system call was led by Jeff Xu of Google's Chrome team. The goal with memory sealing is to also protect the memory mapping itself against modification. The new mseal Linux documentation explains: "Modern CPUs support memory permissions such as RW and NX bits. The memory permission feature improves security stance on memory corruption bugs, i.e. the attacker can't just write to arbitrary memory and point the code to it, the memory has to be marked with X bit, or else an exception will happen. Memory sealing additionally protects the mapping itself against modifications. This is useful to mitigate memory corruption issues where a corrupted pointer is passed to a memory management system... Memory sealing can automatically be applied by the runtime loader to seal .text and .rodata pages and applications can additionally seal security-critical data at runtime. A similar feature already exists in the XNU kernel with the VM_FLAGS_PERMANENT flag and on OpenBSD with the mimmutable syscall." The mseal system call is designed to be used by the likes of the GNU C Library "glibc" while loading ELF executables to seal non-writable memory segments or by the Google Chrome web browser and other browsers for protecting security sensitive data structures.' -- source: https://linux.slashdot.org/story/24/05/26/2117251 Cheers, Peter

1 0

Ubuntu 24.04 Now Runs on the Nintendo Switch (Unofficially)
by Peter Reutemann 27 May '24

27 May '24

'"The fact it's possible at all is a credit to the ingenuity of the open-source community," writes the blog OMG Ubuntu: Switchroot is an open-source project that allows Android and Linux-based distros like Ubuntu to run on the Nintendo Switch — absolutely not something Nintendo approves of much less supports, endorses, or encourages, etc! I covered the loophole that made this possible back in 2018. Back then the NVIDIA Tegra X1-powered Nintendo Switch was still new and Linux support for much of the console's internal hardware in a formative state (a polite way to say 'not everything worked'). But as the popularity of Nintendo's handheld console ballooned (to understate it) so the 'alternative OS' Switch scene grew, and before long Linux support for Switch hardware was in full bloom... A number of Linux for Switchroot (L4S) distributions have since been released, designated as Linux for Tegra (L4T) builds. As these can boot from a microSD card it's even possible to dualboot the Switch OS with Linux, which is neat! Recently, a fresh set of L4T Ubuntu images were released based on the newest Ubuntu 24.04 LTS release. These builds work on all Switch versions, from the OG (exploit-friendly) unit through to newer, patched models (where a modchip is required)... I'm told all of the Nintendo Switch internal hardware now works under Linux, including Wi-Fi, Bluetooth, sleep mode, accelerated graphics, the official dock... Everything, basically. And despite being a 7 year old ARM device the performance is said to remain decent. "Upstream snafus have delayed the release of builds with GNOME Shell..."' -- source: https://games.slashdot.org/story/24/05/26/035202 Cheers, Peter

1 0