NVIDIA Root Explot

The following says it all:

   The NVIDIA Binary Graphics Driver for Linux is vulnerable to a
buffer overflow that allows an attacker to run arbitrary code as
root. This bug can be exploited both locally or remotely (via
a remote X client or an X client which visits a malicious web page).
A working proof-of-concept root exploit is included with this
advisory.

Yeah, so apparently we don't need Internet Explorer and Windows anymore to have malicious software silently installed on our computers - we just need NVIDIA's closed-source graphics driver. Update: Fortunately, the bug has been fixed in NVIDIA's 1.0-9625 beta driver. The thing is, you need Xorg 7.1 to run that, so everyone running Ubuntu 6.06/Dapper Drake is still vulnerable.

On that note - are there any analogous driver exploits in Windows like this? I didn't even think something like this was possible in Linux...

(Thanks Hubert...)

Goodbye XGL, Goodbye AIGLX (Hello Xorg 7.1?)

Something awesome happened today.

NVIDIA released a beta of their new 1.0-9625 drivers. I'll just skip to the good part, as NVIDIA's James Jones explained it:

Neither Xgl or AIGLX are required to use compiz with the NVIDIA drivers now that they natively support GLX_EXT_texture_from_pixmap.

Xgl is an X server that renders using OpenGL and runs on top of another X server. It was the first X server available to support GLX_EXT_texture_from_pixmap.

AIGLX stands for Accelerated Indirect GLX. It is not related to compiz or GLX_EXT_texture_from_pixmap at all, except that support for GLX_EXT_texture_from_pixmap in the open source DRI OpenGL drivers required it. NVIDIA has always supported Accelerated Indirect GLX rendering.

NVIDIA supports both Direct AND Indirect rendering with the GLX_EXT_texture_from_pixmap extension. Users should not need to install any additional software to run compiz with new NVIDIA drivers. Please see the just-created sticky thread covering the basic setup steps.

That's right. These drivers feature hardware support for the mystical "GLX_EXT_texture_from_pixmap" extension, which now allows your videocard to accelerate your wobbly windows, among other things.

The catch? They require Xorg 7.1 or later. That means Ubuntu 6.06/Dapper Drake users are out of luck, unless they feel like compiling X from source (not such a good idea.) The good news is that Ubuntu 6.10/Edgy Eft features Xorg 7.1, so NVIDIA users will be able to benefit from this when Edgy is released (or if they're running Edgy already).

If you're using Xorg 7.1 and want to give it a shot, here's the sticky with instructions. (Also, this feedback thread might come in handy.)

Your move, ATI.

Update: A reader has pointed our that AIGLX has been merged into Xorg 7.1, and it's now enabled by default. So while it's not quite "goodbye" forever to AIGLX, you don't actually have to do anything manually to get it (and you shouldn't have to worry about it).

Edgy CDs, NVIDIA preview, Neuros OSD, Linux 2.6.18

Lots of Linux news happening around the web today:

• Apparently Canonical's ShipIt isn't going to offer free CDs for Ubuntu 6.10/Edgy Eft...
• Phoronix.com has a preview of NVIDIA's 1.0-9XXX series drivers, which don't currently have a ETA, but should offer the long saught-after "GLX_EXT_texture_from_pixmap" extension for hardware accelerated XGL/AIGLX.
• Neuros is offering cheap beta hardware of their new "OSD" device to open source hackers. (Think someone can get that thing to run MythTV?)
• The new Linux 2.6.18 kernel was released. It's got a ridiculously huge changelog, and features some new SATA stuff, and some other things that I can't seem to find a list of. (If you're interested, read the changelog.)
• Polishlinux.org has a very good article on running Linux on older computer and gives a summary of the major distributions designed for the task. Neat stuff.