[$] Developers split over split-lock detection
A "split lock" is a low-level memory-bus lock taken by the
processor for a memory range that crosses a cache line. Most processors
disallow split locks, but x86 implements them, Split locking may be convenient
for developers, but it comes at a cost: a single split-locked instruction can
occupy the memory bus for around 1,000 clock cycles. It is thus understandable
that interest in eliminating split-lock operations is high. What is perhaps
less understandable is that a patch set intended to detect split locks has been
pending since (at least) May 2018, and it still is not poised to enter the
mainline.
VPN hijacking on Linux (and beyond) systems
William Tolley has disclosed a severe VPN-related problem
in most current systems: "I am reporting a vulnerability that exists on most
Linux distros, and other *nix operating systems which allows a network adjacent
attacker to determine if another user is connected to a VPN, the virtual IP
address they have been assigned by the VPN server, and whether or not there is
an active connection to a given website. Additionally, we are able to determine
the exact seq and ack numbers by counting encrypted packets and/or examining
their size. This allows us to inject data into the TCP stream and hijack
connections." There are various partial mitigations available, but a full
solution to the problem has not yet been worked out. Most VPNs are vulnerable,
but Tor evidently is not.
Security updates for Friday
Security updates have been issued by Debian (libav), Fedora
(kernel, libuv, and nodejs), Oracle (firefox), Red Hat (firefox and
java-1.7.1-ibm), SUSE (clamav, cloud-init, dnsmasq, dpdk, ffmpeg, munge, opencv,
and permissions), and Ubuntu (librabbitmq).
[$] Debian votes on init systems
In November, the topic of init systems and, in particular,
support for systems other than systemd reappeared on the Debian mailing lists.
After one month of sometimes fraught discussion, this issue has been brought to
the project's developers to decide in the form of a general resolution (GR) —
the first such since the project voted on the status of debian-private
discussions in 2016. The issues under discussion are complex, so the result is
one of the most complex ballots seen for some time in Debian, with seven options
to choose from.
Stable kernels 5.4.2, 5.3.15, and 4.19.88
Greg Kroah-Hartman has announced the release of the 5.4.2,
5.3.15, and 4.19.88 stable kernels. They contain a relatively large collection
of important fixes throughout the tree; users of those kernel series should
upgrade.
[Update: A bit later, the 4.14.158, 4.9.206, and 4.4.206 stable
kernels were also released.]
