Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

For Linux kernel vulnerabilities, there is no heads-up to distributions

openwall.com

Post reply on HN
Print view View original

131–140 of 578 posts

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#131

Post by Lammy »

ryan_n wrote: post #125
Lammy wrote: post #116

Earlier quoted context omitted.

Yep, I'd be fine with that. My bank has insurance, and my money would be returned.

You're missing the point (not sure if you're just being dense on purpose...). If you're bank would just return the money then its not a good analogy. If someone gains root access to your machine, presumably they can do damage that can't be undone. In other words, to continue the bank analogy, they would take all your money and you would have no way of getting it back. Presumably, you would not be ok with this. And ev…

[flagged]

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#132

Post by KingMachiavelli »

`nosuid` and probably `nodev` should IMO be the default filesystem mount options. `/dev` is already a special devtmpfs and the initrd minimal /dev can just explicitly mount the initrd tmpfs rootfs with `dev` and `suid` if necessary.

Letting SUID binaries just "exist" anywhere is a stupendous security issue. What if you mount some external storage medium, how are you to verify that none of the SUID binaries on that block device are malicious.

Additionally, this exploit appears to only work if the user executing the SUID binary can also read the SUID binary. There's no reason for non-root users to have read on a SUID binary.

NixOS does this correctly. No SUID in the normal package installation directory `/nix/store` and no package leakage outside of that no `nosuid` can safety be used on all other mountpoints. The exception is just a single-purpose `/run/wrappers.$hash` directory that safety contains executable ONLY SUID wrappers.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#133

Post by tptacek »

0x0 wrote: post #121
tptacek wrote: post #100

Earlier quoted context omitted.

They're literally just restating the argument for full disclosure security. This is one of the oldest debates in information security.

The disclosure doesn't appear very "full". Looks like this was slipped into mainline linux among dozens of other mostly-irrelevant "CVEs" with nobody highlighting the fact that it is in fact dirty-cow-on-steroids. https://x.com/spendergrsec/status/2049566830771970483 https://lore.kernel.org/linux-cve-announce/2026042214-CVE-20... Or is everyone expected to upgrade and reboot every 48 hours for all eternity and just d…

Um, yes, everyone is expected to upgrade and reboot on a moment's notice. No policy or norm you come up with will change that.

(This bug does not technically require a reboot to mitigate).

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#134

Post by stonogo »

ryan_n wrote: post #125
Lammy wrote: post #116

Earlier quoted context omitted.

Yep, I'd be fine with that. My bank has insurance, and my money would be returned.

You're missing the point (not sure if you're just being dense on purpose...). If you're bank would just return the money then its not a good analogy. If someone gains root access to your machine, presumably they can do damage that can't be undone. In other words, to continue the bank analogy, they would take all your money and you would have no way of getting it back. Presumably, you would not be ok with this. And ev…

Respectfully, I don't think they're missing the point. Banking, as an institution, has its flaws, but deposit insurance isn't one of them. These vulnerabilities exist whether or not they follow specific disclosure rituals, and systems should be deployed with defense-in-depth so that one privilege-escalation flaw is a recoverable event. Inventing tortured counterfactual analogies doesn't change the basic thrust of the poster's point: the account is insured, so getting drained by an attacker is not a fatal problem. Of course people should still take steps to prevent that from happening, but that doesn't mean prevention is (or should be) the only cure.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#135

Post by stonogo »

aduwah wrote: post #71
semiquaver wrote: post #7

> Note that for Linux kernel vulnerabilities, unless the reporter chooses to bring it to the linux-distros ML, there is no heads-up to distributions. Why would they imply it is incumbent on the reporter to liaise with distributions? That seems to assume a high level of familiarity with the linux project. Vulnerability reporters shouldn’t be responsible for directly working with every downstream consumer of the linux…

Especially since the reporter is explicitly asked not to notify the distro teams first. https://docs.kernel.org/process/security-bugs.html ```As such, the kernel security team strongly recommends that as a reporter of a potential security issue you DO NOT contact the “linux-distros” mailing list UNTIL a fix is accepted by the affected code’s maintainers and you have read the distros wiki page above and you fully unde…

The kernel team has been at odds with the CVE process and the oss-security community about this stuff for many, many years now. It's a big part of why the kernel team established a CNA and started flooding CVE notifications; they don't believe that security problems are different than non-security problems, and refuse to establish norms or policies based on the idea that they are.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#136

Post by grayhatter »

selectively wrote: post #68
jasonmp85 wrote: post #51

Earlier quoted context omitted.

Does it? Now that I see their name again in this context they're blacklisted for life.

Researchers are under no obligation to engage in coordinated disclosure and are free to sell 0day for profit. Just fyi. Be glad it was disclosed at all. Be glad a patch was available prior to release.

> Researchers are under no obligation to engage in coordinated disclosure and are free to sell 0day for profit.

Uh... no? If you mean legally, some people might, depending on jurisdiction. But also, ethically? yes, researchers are ethically obligated to disclose responsibly.

> Just fyi.

...

> Be glad it was disclosed at all. Be glad a patch was available prior to release.

I am glad that a patch was available. Equally I can be glad that the linux community is strong enough to respond quickly, while also being angry that this person behaves unethically.

Likewise, when people in my industry behave poorly, or unethically; I'm now the person ethically obligated to both point it out, and condemn it. Not to become an apologist demanding I should be happy watching bad things happen, when much of the fallout could have been prevented with a bit less incompetence and ignorance.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#137

Post by bluepuma77 »

baggy_trough wrote: post #5
shimman wrote: post #4

Earlier quoted context omitted.

Expecting people to do the right thing is a fundamental issue here. Why would you ever expect for all of vulnerabilities to be disclosed privately? There's very little actual incentive to do this. I'm honestly unaware of what systems could be put in place to prevent this but expecting people to always do the right thing is fantasy level thinking. I mean I bet the disclosers thought they were doing the right thing, he…

Why wouldn't the linux security team notify the main linux distributions?

Well, how do you define main Linux distros? Isn’t the next smaller one not receiving the info always complaining?

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#138

Post by jojomodding »

selectively wrote: post #68
jasonmp85 wrote: post #51

Earlier quoted context omitted.

Does it? Now that I see their name again in this context they're blacklisted for life.

Researchers are under no obligation to engage in coordinated disclosure and are free to sell 0day for profit. Just fyi. Be glad it was disclosed at all. Be glad a patch was available prior to release.

> are free to sell 0day for profit.

This is not true in many jurisdictions.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#139

Post by Legend2440 »

skywhopper wrote: post #13
semiquaver wrote: post #7

> Note that for Linux kernel vulnerabilities, unless the reporter chooses to bring it to the linux-distros ML, there is no heads-up to distributions. Why would they imply it is incumbent on the reporter to liaise with distributions? That seems to assume a high level of familiarity with the linux project. Vulnerability reporters shouldn’t be responsible for directly working with every downstream consumer of the linux…

The reporter made a website explicitly calling out Ubuntu, RedHat, Amazon, and SUSE but didn’t notify them, and you think that’s reasonable? That they might not have known those distributions are downstream from the kernel team?

If you notify the kernel and they ship a fix, it seems reasonable to expect that they will communicate the fix to the distros.

I see this as an organizational failure of the Linux ecosystem. There should be better communication between distro and kernel development.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#140

Post by baggy_trough »

bluepuma77 wrote: post #137
baggy_trough wrote: post #5

Earlier quoted context omitted.

Why wouldn't the linux security team notify the main linux distributions?

Well, how do you define main Linux distros? Isn’t the next smaller one not receiving the info always complaining?

Isn't there already a distro security list for this purpose?
Post reply on HN