NEWS
NEWS
Linux Kernel continues to offer mitigation for Spectre Mitigation, SpeakUp Trojan targets Linux servers, KDE Plasma 5.15 beta arrives, Canonical announces latest Ubuntu Core for IoT, vulnerabilities found in Cisco routers, two new malware campaigns, and US government shutdown ties up $139.2 million in grant funding.
Linux Kernel Continues to Offer Mitigation for Spectre Mitigation
Usually, you want to mitigate all possible vulnerabilities unless you are talking about Meltdown and Spectre which are a class or family of dozens of vulnerabilities. But what sys admins hate more than these vulnerabilities are mitigations offered to these vulnerabilities (https://www.zdnet.com/article/linux-kernel-gets-another-option-to-disable-spectre-mitigations/). Some of these mitigations have a massive impact on performance, while not offering any significant protection.
Gauging the pros and cons, sys admins have gone as far as asking the Linux kernel community to give them an option to disable these mitigations (https://www.phoronix.com/scan.php?page=news_item&px=Global-Switch-Skip-Spectre-Melt). The Linux kernel community always listens.
Linux Kernel 4.15 added the ability for sys admins to disable the kernel's built-in mitigations for the Spectre v2 vulnerability, then Linux Kernel 4.17 offered the option to disable all mitigations for Spectre v4, and now Linux Kernel 4.19 allows admins to disable mitigations for Spectre v1.
You may or may not trust the NSA, but they have a very decent guide on GitHub (https://github.com/nsacyber/Hardware-and-Firmware-Security-Guidance) to help keep up with all Spectre-related vulnerabilities.
SpeakUp Trojan Targets Linux Servers
Researchers at Check Point have found a new Trojan called SpeakUp that's infecting Linux servers. SpeakUp exploits known vulnerabilities in Linux and is targeting servers in China.
According to Check Point, "SpeakUp acts to propagate internally within the infected subnet, and beyond to new IP ranges, exploiting remote code execution vulnerabilities. In addition, SpeakUp presented the ability to infect Mac devices with the undetected backdoor" (https://research.checkpoint.com/speakup-a-new-undetected-backdoor-linux-trojan/).
The Trojan has spread beyond China and is fast spreading across East Asia and Latin America. It's not sparing even AWS-hosted Linux servers. Check Point said six Linux distributions and macOS are vulnerable, but they didn't name exactly which six Linux distributions.
SpeakUp's initial infection vector targets a known vulnerability in ThinkPHP and then uses command injection techniques for uploading a PHP shell that serves and executes a Perl backdoor. After executing the script to install the backdoor, it deletes the file to remove any evidence.
Check Point warns that while the initial payload of SpeakUp is mining, it poses a much bigger threat. "The threat actor behind this campaign can at any given time deploy additional payloads, potentially more intrusive and offensive. It has the ability to scan the surrounding network of an infected server and distribute the malware."
KDE Plasma 5.15 Beta Arrives
The KDE community has announced its first release of 2019 – Plasma 5.15 Beta. One of the major highlights of the beta release is increased focus on usability and productivity.
The KDE community has teamed up with the Visual Design Group (VDG) contributors to get feedback on all the paper cut bugs in the software to create an intuitive and consistent workflow for users.
The release has enhanced integration with third-party technologies like GTK and Firefox, so users can choose the apps they like without worrying about a subpar experience.
Massive improvements have been made to the Discover software management tool, something similar to App Store. Users can now perform the distribution upgrade within Discover. It also offers fine-grained control over which packages users want to update.
Discover also now supports app extensions offered with Flatpak packages and lets you choose which ones to install.
If you are a KDE Plasma user, you can test the beta and provide the community with feedback. Some of the best beta distributions to try are openSUSE Tumbleweed, Arch Linux, and KDE neon.
Buy this article as PDF
(incl. VAT)
Buy Linux Magazine
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
![Learn More](https://www.linux-magazine.com/var/linux_magazin/storage/images/media/linux-magazine-eng-us/images/misc/learn-more/834592-1-eng-US/Learn-More_medium.png)
News
-
NVIDIA Released Driver for Upcoming NVIDIA 560 GPU for Linux
Not only has NVIDIA released the driver for its upcoming CPU series, it's the first release that defaults to using open-source GPU kernel modules.
-
OpenMandriva Lx 24.07 Released
If you’re into rolling release Linux distributions, OpenMandriva ROME has a new snapshot with a new kernel.
-
Kernel 6.10 Available for General Usage
Linus Torvalds has released the 6.10 kernel and it includes significant performance increases for Intel Core hybrid systems and more.
-
TUXEDO Computers Releases InfinityBook Pro 14 Gen9 Laptop
Sporting either AMD or Intel CPUs, the TUXEDO InfinityBook Pro 14 is an extremely compact, lightweight, sturdy powerhouse.
-
Google Extends Support for Linux Kernels Used for Android
Because the LTS Linux kernel releases are so important to Android, Google has decided to extend the support period beyond that offered by the kernel development team.
-
Linux Mint 22 Stable Delayed
If you're anxious about getting your hands on the stable release of Linux Mint 22, it looks as if you're going to have to wait a bit longer.
-
Nitrux 3.5.1 Available for Install
The latest version of the immutable, systemd-free distribution includes an updated kernel and NVIDIA driver.
-
Debian 12.6 Released with Plenty of Bug Fixes and Updates
The sixth update to Debian "Bookworm" is all about security mitigations and making adjustments for some "serious problems."
-
Canonical Offers 12-Year LTS for Open Source Docker Images
Canonical is expanding its LTS offering to reach beyond the DEB packages with a new distro-less Docker image.
-
Plasma Desktop 6.1 Released with Several Enhancements
If you're a fan of Plasma Desktop, you should be excited about this new point release.