# Linux Action News 276

URL: /show/linux-action-news/276/
> A high-profile Linux kernel network flaw, we put JFS on a death watch, and break down the controversial Firefox update this week.

- Show: [Linux Action News](/show/linux-action-news/)
- Episode: 276
- Date: 2023-01-19
- Hosts: chris, wes
- Duration: 00:16:44
- Audio: https://aphid.fireside.fm/d/1437767933/dec90738-e640-45e5-b375-4573052f4bf4/b0fdfcdd-3ec2-4c0e-93c0-7bbd81219973.mp3



Sponsors:
- [Linode](/sponsors/linode.com-lan/index.md): Sign up using the link on this page and receive a $100 60-day credit towards your new account.
- [Kolide](/sponsors/kolide.co-lan/index.md): Kolide can help you nail third-party audits and internal compliance goals with endpoint security for your entire fleet.




### Episode Links

  * [A new privilege escalation vulnerability in the Linux kernel](https://seclists.org/oss-sec/2023/q1/20 "A new privilege escalation vulnerability in the Linux kernel") — The vulnerability consists of a stack buffer overflow due to an integer underflow vulnerability inside the nft_payload_copy_vlan function, which is invoked with nft_payload expressions as long as a VLAN tag is present in the current skb.
  * [netfilter: nft_payload: add C-VLAN support · torvalds/linux@f6ae9f1](https://github.com/torvalds/linux/commit/f6ae9f1 "netfilter: nft_payload: add C-VLAN support · torvalds/linux@f6ae9f1")
  * [CVE-2023-0179](https://security-tracker.debian.org/tracker/CVE-2023-0179 "CVE-2023-0179")
  * [CVE-2023-0179- Red Hat Customer Portal](https://access.redhat.com/security/cve/cve-2023-0179 "CVE-2023-0179- Red Hat Customer Portal")
  * [[net,3/3] netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits - Patchwork](https://patchwork.ozlabs.org/project/netfilter-devel/patch/20230111212251.193032-4-pablo@netfilter.org/ "\[net,3/3\] netfilter: nft_payload: incorrect arithmetics when fetching VLAN header bits - Patchwork")
  * [oss-sec: Re: CVE-2023-0179: Linux kernel stack buffer overflow in nftables: PoC and writeup](https://seclists.org/oss-sec/2023/q1/22 "oss-sec: Re: CVE-2023-0179: Linux kernel stack buffer overflow in nftables: PoC and writeup")
  * [libvirt 9.0 Released For Latest Linux Virtualization API](https://www.phoronix.com/news/libvirt-9.0 "libvirt 9.0 Released For Latest Linux Virtualization API") — Libvirt 9.0 adds support for external snapshot deletion with QEMU using its existing API, libvirt 9.0 with QEMU now supports PASST as "Plug A Simple Socket Transport" for connecting an emulated network device to the host's network, QEMU external back-end support for SWTPM as a software Trusted Platform Module (TPM), support for passing file descriptors rather than passing files for the QEMU disk, and other additions. 
  * [JFS Filesystem’s Days are Numbered](https://www.phoronix.com/news/Linux-Possible-Orphan-JFS "JFS Filesystem’s Days are Numbered") — IBM developed the JFS file-system originally in the 90's for AIX and the second-generation implementation then ported to Linux after it was made open-source. 
  * [Firefox 109.0 Ships Manifest Version 3](https://www.mozilla.org/en-US/firefox/109.0/releasenotes/ "Firefox 109.0 Ships Manifest Version 3") — Manifest Version 3 (MV3) extension support is now enabled by default (MV2 remains enabled/supported). This major update also ushers an exciting user interface change in the form of the new extensions button.
  * [Here’s what’s going on in the world of extensions](https://blog.mozilla.org/en/products/firefox/extensions-addons/heres-whats-going-on-in-the-world-of-extensions/ "Here’s what’s going on in the world of extensions")
  * [Manage your extensions using the extensions button in the toolbar](https://support.mozilla.org/en-US/kb/unified-extensions "Manage your extensions using the extensions button in the toolbar")
  * [Manifest v3 signing available November 21 on Firefox Nightly](https://blog.mozilla.org/addons/2022/11/17/manifest-v3-signing-available-november-21-on-firefox-nightly/ "Manifest v3 signing available November 21 on Firefox Nightly")
  * [Google delays start of Manifest V2 Chrome extension deprecation](https://9to5google.com/2022/12/12/manifest-v2-chrome-extension/ "Google delays start of Manifest V2 Chrome extension deprecation") — The original plan called for Chrome Beta, Dev, and Canary builds to start experiments that turned off Manifest V2 extension support. Additionally, Manifest V3 would be required to get the “Featured” badge in the Chrome Web Store. 
  * [Firefox 109 Adds New Extensions Button, Manifest V3 Support](https://www.omgubuntu.co.uk/2023/01/firefox-109-released "Firefox 109 Adds New Extensions Button, Manifest V3 Support") — The biggest new feature is the new Unified Extensions button in the toolbar. 
  * [Chrome’s “Manifest V3” plan to limit ad-blocking extensions is delayed](https://arstechnica.com/gadgets/2022/12/chrome-delays-plan-to-limit-ad-blockers-new-timeline-coming-in-march "Chrome’s “Manifest V3” plan to limit ad-blocking extensions is delayed")
  * [ Chrome Users Beware: Manifest V3 is Deceitful and Threatening](https://www.eff.org/deeplinks/2021/12/chrome-users-beware-manifest-v3-deceitful-and-threatening " Chrome Users Beware: Manifest V3 is Deceitful and Threatening") — Manifest V3, or Mv3 for short, is outright harmful to privacy efforts. It will restrict the capabilities of web extensions