LinuxSecurity.com

Two fixes posted August 13 correct separate per-CPU map failures on Linux systems whose logical CPU IDs contain gaps. 

Border Gateway Protocol (BGP) is still trust-based. In the past, a router would announce it originated a block of address space, and its neighbors would take that claim at face value. That trust model is the reason a single misconfiguration or a deliberate false announcement can pull traffic for someone else’s network across the planet, and why routing security has become a core concern for anyone responsible for keeping services reachable. 

A Linux security tool can catch a system call and still record the wrong thing.

Linux Audit can tell defenders that a system call ran while leaving out the setting that explains what the call did.

This week’s Linux security updates cover several areas administrators cannot afford to overlook. Debian, Ubuntu, Fedora, SUSE, openSUSE, and other distributions released fixes for privilege escalation, remote code execution, denial of service, and flaws affecting network-facing services.

A proposed Linux kernel patch addresses a private-futex race that a recent security fix left unresolved. Security researcher Hyunwoo Kim found that a rare sequence involving nested vfork() calls can allow two tasks sharing the same memory to run concurrently and reach private futex hash initialization at nearly the same time.

Public exploit code is now available for SCTPhantom, a Linux kernel flaw that researchers used to escape an unprivileged container and take control of the underlying host. 

Modern Linux kernel hardening has made many traditional exploit techniques harder to use, but new research from IBM Research Europe and Vrije Universiteit Amsterdam suggests attackers may have a much larger set of alternatives than defenders realized.

A Linux vulnerability scan can create almost as many questions as it answers. The scan may identify dozens of affected packages, several CVEs marked High or Critical, and a mix of fixes that are available now or still working through a distribution's update process.