Security Leftovers
-
SANS ☛ No Excuses, Free Tools to Help Secure Authentication in Ubuntu GNU/Linux
[This is a Guest Diary by Owen Slubowski, an ISC intern as part of the SANS.edu
-
LWN ☛ Memory sealing for the GNU C Library
The mseal() system call allows a process to prevent any future changes to portions of its address space (thus "sealing" them); it was patterned after the mimmutable() system call in OpenBSD. mseal() generated a lot of discussion, but it was finally merged for the upcoming 6.10 kernel release. While mseal() was initially aimed at securing the Chrome browser, the hope was that it would be useful elsewhere; as a step toward realizing that hope, Adhemerval Zanella has posted a patch series adding support for — and use of — mseal() to the GNU C library (glibc).
This new system call is intended to increase security by making it harder for an attacker who has gained some control to make changes to a process's address space. If a region of memory has been sealed, it cannot be unmapped, remapped, or have its protections changed; some madvise() operations are also forbidden. Sealing is a one-way operation; once memory is sealed, it cannot be unsealed for the life of the process.
-
CISA ☛ 2024-06-11 [Older] Fortinet Releases Security Updates for FortiOS
-
CISA ☛ 2024-06-11 [Older] Microsoft Releases June 2024 Security Updates