this post was submitted on 31 Jan 2024
358 points (98.6% liked)

Linux

48208 readers
773 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
top 50 comments
sorted by: hot top controversial new old
[–] [email protected] 9 points 9 months ago

Local attacker

Important detail

as i said on reddit

[–] [email protected] 11 points 9 months ago* (last edited 9 months ago)

I replied to another comment with this, but Debian 12(stable, bookworm) and 13(testing, trixie) are affected by this but 12(stable, bookworm) has a patch out in the security repo.

If you wanna know wether or not you’re affected,

apt list libc

will show your version and the one you want is 2.36-9+deb12u4

If you don’t have that,

apt update && apt upgrade

will straighten you out

13(testing, trixie) has 2.37, but it’s not fixed yet.

E: Edited to use apt list instead of apt show.

[–] [email protected] 31 points 9 months ago (2 children)

glibc is great, but holy shit the source code is obscured into oblivion, so hard to understand, with hardcoded optimizations, and compiler optimizations. I understand how difficult is to find vulnerabilities. A bit sad that the only C lib truely free software is so hard to actually read its code or even contribute to it.

[–] [email protected] 23 points 9 months ago* (last edited 9 months ago) (1 children)

For what it's worth, glibc is very much performance-critical, so this shouldn't be a surprise. Any possible optimization is worth it.

There are a ton of free software libc implementations outside of glibc. I think most implementations of libc are free software at this point. There's Bionic, the BSD libcs, musl, the Haiku libc, the OpenSolaris/OpenIndiana libc, Newlib, relibc, the ToaruOS libc, the SerenityOS libc and a bunch more. Pretty sure Wine/ReactOS also have free implementations of the Windows libc.

[–] [email protected] 2 points 9 months ago

Glibc has extensions that fragment compatibility. If Glibc is replaced by another libc, some apps prints an error, or don't work. I noticed that on Alpine.

[–] [email protected] 5 points 9 months ago* (last edited 9 months ago) (2 children)

Eventually it’ll be easier to create a compatible drop-in replacement than maintain the decades old code, if it isn’t already

[–] [email protected] 2 points 9 months ago (1 children)

Like what's happening to X. Wayland is replacing it.

[–] [email protected] 3 points 9 months ago

Wayland is not a drop-in replacement tho. It's like if glibc developers declared it obsolete and presented a "replacement" that has a completely different API and has 1/100 of glibc functionality and a plugin interface. And then all the dozens of Linux distros have to write all the plugins from scratch to add back missing functionality and do it together in perfect cooperation so that they remain compatible with each other.

[–] [email protected] 11 points 9 months ago

Unlikely, unless you drop backwards compatibility for undefined behaviour. Unless you write a complete specification on it, you'll end up either breaking old stuff, or slowly rebuilding the same problems.

[–] [email protected] 23 points 9 months ago

Imagine all the vulnerabilities that privative and low reviewed code has...

load more comments
view more: next ›