this post was submitted on 21 Aug 2024
641 points (99.4% liked)

Linux

53424 readers
520 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
 

Last Tuesday, loads of Linux users—many running packages released as early as this year—started reporting their devices were failing to boot. Instead, they received a cryptic error message that included the phrase: “Something has gone seriously wrong.”

The cause: an update Microsoft issued as part of its monthly patch release. It was intended to close a 2-year-old vulnerability in GRUB, an open source boot loader used to start up many Linux devices. The vulnerability, with a severity rating of 8.6 out of 10, made it possible for hackers to bypass secure boot, the industry standard for ensuring that devices running Windows or other operating systems don’t load malicious firmware or software during the bootup process. CVE-2022-2601 was discovered in 2022, but for unclear reasons, Microsoft patched it only last Tuesday.

...

The reports indicate that multiple distributions, including Debian, Ubuntu, Linux Mint, Zorin OS, Puppy Linux, are all affected. Microsoft has yet to acknowledge the error publicly, explain how it wasn’t detected during testing, or provide technical guidance to those affected. Company representatives didn’t respond to an email seeking answers.

(page 4) 23 comments
sorted by: hot top controversial new old
[–] [email protected] 123 points 8 months ago (2 children)

CVE-2022-2601 was discovered in 2022, but for unclear reasons, Microsoft patched it only last Tuesday.

I respect their journalistic integrity for not speculating, but it was definitely because the NSA was exploiting it.

[–] [email protected] 4 points 8 months ago (3 children)

So all afected people were potential targets?

load more comments (3 replies)
[–] [email protected] 68 points 8 months ago* (last edited 8 months ago) (4 children)

Ehhh that's likely enough, but Microsoft is also just shit at fixing things

load more comments (4 replies)
[–] [email protected] 12 points 8 months ago

CVE-2022-2601 was discovered in 2022, but for unclear reasons, Microsoft patched it only last Tuesday.

[–] [email protected] 43 points 8 months ago* (last edited 8 months ago) (8 children)

So glad I recently removed Windows from my former dual boot system completely. Was sick of getting errors during Linux boot up after running Windows for that one piece of software I couldn't get to work in Wine or Bottles. The culprit I assumed was Windows updates, which I attempted to disable through the registry on several occasions. It would work for a short period and then Microsoft, in all their wisdom, would just reenable updates because clearly they know better than I what I want my system to do. The last time it happened was the final straw for me when I wanted to boot into Windows briefly only to be left waiting half an hour for Windows to apply updates on shutdown. Pissed me off so much I killed the power mid-update, booted up a live partition tool and wiped Windows off my system completely (updating the grub to remove dual boot). That's when I discovered that not properly shutting down Windows would mark my other drives dirty and make them read only. To fix this I ended up having to insert Windows installation media and pretend like I wanted to reinstall Windows 10 again. Once it got to the stage when it was about to write to the drive I cancelled the installation and rebooted back into Linux. Voilà! Could write to my drives again. To hell with Windows. I'd rather live without that one piece of software and have my system do what I want it to do rather than it second guess me and disregard my instructions. This whole automatic update thing really boiled my piss. At least with Linux I can choose to apply updates when it's convenient for me to do so.

load more comments (8 replies)
[–] [email protected] 52 points 8 months ago (1 children)

I just tried installing this patch tonight on my windows drive - not because I use windows, just to… you know… keep it updated and secure I guess.

It literally won’t even install. It just fails out every time. Whatever. Microsoft releases so many bad patches lately. WTH are they even doing over there? Windows used to be king and they’ve been screwing it up since 8 came out.

[–] [email protected] 66 points 8 months ago* (last edited 8 months ago) (2 children)

Microsoft fired its entire QA team 10 years ago, and shifted the responsibility for testing onto developers. They also got rid of their dedicated hardware lab where software would be tested on many different hardware combinations.

I have worked in two companies that made the same move of firing QA, and in both the quality of the released software took a marked dive. (In neither company did senior management admit that what everyone warned them would be a mistake was a mistake. Instead they blamed developers.)

These days Microsoft's testing team is whichever users receive each update first. They rely on users and telemetry to do what should be the job of dedicated testers.

[–] [email protected] 27 points 8 months ago

This is hardly a new thing for MS. One of the first emails I remember getting when I got to college back in 2003 was from campus IT begging people not to install the latest XP update because it reenabled a vulnerability to existing malware.

load more comments (1 replies)
[–] [email protected] 39 points 8 months ago (3 children)

Maybe its finally time to get rid of my dual boot. I haven't used the windows side in like half a year...

[–] [email protected] 11 points 8 months ago (1 children)

And each time you want to use Windows, you have to go through hoops and updates of Windows and then updates of the applications (and possibly games) to just do the work you intended to boot into. I had Windows for a few years in dual mode too and know the problems of a Windows system that is not used often.

If you really need some applications, then consider using a VM (however doesn't solve the updates and usability issue of Windows). Off course some games won't work, but if its not a game then maybe you can finally get rid of your dual boot.

[–] [email protected] 2 points 8 months ago (1 children)

At this point, the only thing keeping me back is I have a bunch of files made in Clip Studio Paint that I can't open in linux, but I think I might be able to run CSP in a VM, if needs be. Not really anything gaming related.

Now just to find time to do it lol

[–] [email protected] 4 points 8 months ago (1 children)

That's actually not bad, if this is the only thing (hold on, after looking into a bit it could be a show stopper still). An idea is, if its not too many files, would be to save them from this application in a more universal usable format and not use it anymore. But that comes with ton compatibility issues on itself, so who knows.

It seems like WINE (the tool that is used as main part of Proton in Steam) can run Clip Studio Paint, but not great (Silver rating): https://appdb.winehq.org/objectManager.php?sClass=application&iId=15102 And then the question is if it will even work well with Wacom devices this way. Also I'm a bit worried if it will work well in a VM too.

load more comments (1 replies)
[–] [email protected] 26 points 8 months ago

I was shocked how little I need Windows. I went dual boot install but just... never booted Windows again. My games work. I'm happy. Why should I boot Windows?

Really I should just remove Windows but I'm lazy.

load more comments (1 replies)
[–] [email protected] 154 points 8 months ago (11 children)

So, no booting into Windows until this is fixed then? Fine by me. Hell, might actually make me uninstall it completely and free some disk space...

[–] [email protected] 64 points 8 months ago (1 children)

Well... It's the opposite... People affected by this issue could not boot Linux...

[–] [email protected] 97 points 8 months ago* (last edited 8 months ago) (1 children)

Right, but you have to boot into Windows first to even get the update in the first place...

load more comments (10 replies)
[–] [email protected] 82 points 8 months ago* (last edited 8 months ago) (4 children)

I'm confused - why is Microsoft trying to - or expected to, by the article authors - patch a vulnerability in GRUB?

[–] [email protected] 11 points 8 months ago (2 children)

It was a Windows vulnerability that allowed an exploit box GRUB

load more comments (2 replies)
[–] [email protected] 101 points 8 months ago

It was supposed to patch Secure Boot, not demolish GRUB.

That's why it's a problem.

load more comments (2 replies)
load more comments
view more: ‹ prev next ›