Docker fave Alpine Linux suffers bug miscreants can exploit to poison containers • The Register Forums

User topics

Article topics

Log in Sign up

Other stories you might like

FabricScape: Microsoft warns of vuln in Service Fabric

Not trying to spin this as a Linux security hole, surely?

Richard Speed Wed 29 Jun 2022 // 13:40 UTC

Microsoft is flagging up a security hole in its Service Fabric technology when using containerized Linux workloads, and urged customers to upgrade their clusters to the most recent release.
The flaw is tracked as CVE-2022-30137, an elevation-of-privilege vulnerability in Microsoft's Service Fabric. An attacker would need read/write access to the cluster as well as the ability to execute code within a Linux container granted access to the Service Fabric runtime in order to wreak havoc.
Through a compromised container, for instance, a miscreant could gain control of the resource's host Service Fabric node and potentially the entire cluster.

Continue reading
How refactoring code in Safari's WebKit resurrected 'zombie' security bug

Fixed in 2013, reinstated in 2016, exploited in the wild this year

Jeff Burt Tue 21 Jun 2022 // 08:31 UTC

A security flaw in Apple's Safari web browser that was patched nine years ago was exploited in the wild again some months ago – a perfect example of a "zombie" vulnerability.
That's a bug that's been patched, but for whatever reason can be abused all over again on up-to-date systems and devices – or a bug closely related to a patched one.
In a write-up this month, Maddie Stone, a top researcher on Google's Project Zero team, shared details of a Safari vulnerability that folks realized in January this year was being exploited in the wild. This remote-code-execution flaw could be abused by a specially crafted website, for example, to run spyware on someone's device when viewed in their browser.

Continue reading
Linus Torvalds says Rust is coming to the Linux kernel 'real soon now'

Maintainer lack of familiarity won't be an issue, chief insists, citing his own bafflement when faced with Perl

Thomas Claburn in San Francisco Thu 23 Jun 2022 // 19:30 UTC

At The Linux Foundation's Open Source Summit in Austin, Texas on Tuesday, Linus Torvalds said he expects support for Rust code in the Linux kernel to be merged soon, possibly with the next release, 5.20.
At least since last December, when a patch added support for Rust as a second language for kernel code, the Linux community has been anticipating this transition, in the hope it leads to greater stability and security.
In a conversation with Dirk Hohndel, chief open source officer at Cardano, Torvalds said the patches to integrate Rust have not yet been merged because there's far more caution among Linux kernel maintainers than there was 30 years ago.

Continue reading
Cisco warns of security holes in its security appliances

Bugs potentially useful for rogue insiders, admin account hijackers

Jessica Lyons Hardcastle Wed 22 Jun 2022 // 20:16 UTC

Cisco has alerted customers to another four vulnerabilities in its products, including a high-severity flaw in its email and web security appliances.
The networking giant has issued a patch for that bug, tracked as CVE-2022-20664. The flaw is present in the web management interface of Cisco's Secure Email and Web Manager and Email Security Appliance in both the virtual and hardware appliances. Some earlier versions of both products, we note, have reached end of life, and so the manufacturer won't release fixes; it instead told customers to migrate to a newer version and dump the old.
This bug received a 7.7 out of 10 CVSS severity score, and Cisco noted that its security team is not aware of any in-the-wild exploitation, so far. That said, given the speed of reverse engineering, that day is likely to come.

Continue reading
WSL2 on Windows Server 2022 hits Windows Update

Devs who like a Linux flavor to their server code get a gift from Redmond

Richard Speed Wed 22 Jun 2022 // 18:30 UTC

Microsoft has made it official. Windows Subsystem for Linux 2 distributions are now supported on Windows Server 2022.
The technology emerged in preview form last month and represented somewhat of an about-face from the Windows giant, whose employees had previously complained that while the tech was handy for desktop users, sticking it on a server might mean it gets used for things for which it wasn't intended.
(And Windows Server absolutely had to have the bloated user interface of its desktop stablemate as well, right?)

Continue reading
EndeavourOS Artemis: Arch Linux, but a bit friendlier

The Reg FOSS desk takes the latest release, 22.6, for a spin

Liam Proven in Prague Wed 29 Jun 2022 // 11:39 UTC

EndeavourOS is a rolling-release Linux distro based on Arch Linux. Although the project is relatively new, having started in 2019, it's the successor to an earlier Arch-based distro called Antergos, so it's not quite as immature as its youth might imply. It's a little more vanilla than Antergos was – for instance, it uses the Calamares cross-distro installer.
EndeavourOS hews more closely to its parent distro than, for example, Manjaro, which we looked at very recently. Unlike Manjaro, it doesn't have its own staging repositories or releases. It installs packages directly from the upstream Arch repositories, using the standard Arch package manager pacman. It also bundles yay to easily fetch packages from the Arch User Repository, AUR. The yay command takes the same switches as pacman does, so if you wanted to install, say, Google Chrome, it's as simple as yay -s google-chrome and a few seconds later, it's done.

Continue reading
Leading Arch Linux derivative Manjaro puts out version 21.3

A simpler, easier remix sounds like a good thing, but glitches like these shouldn't be in a point release

Liam Proven in Prague Wed 22 Jun 2022 // 08:30 UTC

Version 21.3 of Manjaro - codenamed "Ruah" - is here, with kernel 5.15, but don't let its beginner-friendly billing fool you: you will need a clue with this one.
Manjaro Linux is one of the more popular Arch Linux derivatives, and the new version 21.3 is the latest update to version 21, released in 2021. There are three official variants, with GNOME 42.2, KDE 5.24.5 or Xfce 4.16 desktops, plus community builds with Budgie, Cinnamon, MATE, a choice of tiling window managers (i3 or Sway), plus a Docker image.
The Reg took its latest look at Arch Linux a few months ago. Arch is one of the older rolling-release distros, and it's also famously rather minimal. The installation process isn't trivial: it's driven from the command line, and the user does a lot of the hard work, manually partitioning disks and so on.

Continue reading
Unbelievably clever: Redbean 2 – a single-file web server that runs on six OSes

'Write once, run anywhere' finally came true, thanks to APE and the Cosmopolitan libc

Liam Proven in Prague Mon 20 Jun 2022 // 10:00 UTC

A bunch of almost unbelievably clever tech tricks come together into something practical with redbean 2: a webserver plus content in a single file that runs on any x86-64 operating system.
The project is the culmination – so far – of a series of remarkable, inspired hacks by programmer Justine Tunney: αcτµαlly pδrταblε εxεcµταblε, Cosmopolitan libc, and the original redbean. It may take a little time to explain what it does, so bear with us. We promise, you will be impressed.
To begin with, redbean uses a remarkable hack known as APE, which stands for Actually Portable Executable – which its author styles αcτµαlly pδrταblε εxεcµταblε. (If you know the Greek alphabet, this reads as "actmally pdrtable execmtable", but hey, it looks cool.)

Continue reading
End-of-life smartphone? Penguins at postmarketOS aim to revive it

Alpine-based distro runs on old mobiles abandoned by Android and their manufacturers

Liam Proven in Prague Wed 15 Jun 2022 // 11:00 UTC

A Linux distro for smartphones abandoned by their manufacturers, postmarketOS, has introduced in-place upgrades.
Alpine Linux is a very minimal general-purpose distro that runs well on low-end kit, as The Reg FOSS desk found when we looked at version 3.16 last month. postmarketOS's – pmOS for short – version 22.06 is based on the same version.
This itself is distinctive. Most other third-party smartphone OSes, such as LineageOS or GrapheneOS, or the former CyanogenMod, are based on the core of Android itself.

Continue reading
Arrogant, subtle, entitled: 'Toxic' open source GitHub discussions examined

Developer interactions sometimes contain their own kind of poison

Thomas Claburn in San Francisco Wed 29 Jun 2022 // 21:23 UTC

Analysis Toxic discussions on open-source GitHub projects tend to involve entitlement, subtle insults, and arrogance, according to an academic study. That contrasts with the toxic behavior – typically bad language, hate speech, and harassment – found on other corners of the web.
Whether that seems obvious or not, it's an interesting point to consider because, for one thing, it means technical and non-technical methods to detect and curb toxic behavior on one part of the internet may not therefore work well on GitHub, and if you're involved in communities on the code-hosting giant, you may find this research useful in combating trolls and unacceptable conduct.
It may also mean systems intended to automatically detect and report toxicity in open-source projects, or at least ones on GitHub, may need to be developed specifically for that task due to their unique nature.

Continue reading

ABOUT US

MORE CONTENT

SITUATION PUBLISHING

The Register - Independent news and views for the tech community. Part of Situation Publishing

SIGN UP TO OUR DAILY NEWSLETTER

Security Scorecard

Biting the hand that feeds IT © 1998–2022

Do not sell my personal information Cookies Privacy Ts&Cs