Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

For Linux kernel vulnerabilities, there is no heads-up to distributions

openwall.com

Post reply on HN
Print view View original

271–280 of 578 posts

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#271

Post by dweinus »

Legend2440 wrote: post #139
skywhopper wrote: post #13

Earlier quoted context omitted.

The reporter made a website explicitly calling out Ubuntu, RedHat, Amazon, and SUSE but didn’t notify them, and you think that’s reasonable? That they might not have known those distributions are downstream from the kernel team?

If you notify the kernel and they ship a fix, it seems reasonable to expect that they will communicate the fix to the distros. I see this as an organizational failure of the Linux ecosystem. There should be better communication between distro and kernel development.

The reporter clearly knows the distro fixes have not been shipped, read their report. They chose to disclose anyway.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#272

Post by da_chicken »

throw0101a wrote: post #267
da_chicken wrote: post #234

Earlier quoted context omitted.

No. The problem is that vendors and developers have repeatedly shown that if you give them an inch, they take a mile. Look at exactly what happened with BlueHammer this month. The security researcher went full disclosure because Microsoft didn't listen to their reports. Disclosure is vital. It's essential . Because the truth is, if a security researcher has found it, it's extremely likely that it's already been found…

> The problem is that vendors and developers have repeatedly shown that if you give them an inch, they take a mile. [citation needed] Is there any evidence that Linux distros (specifically) act in this way? Or a particular distro ?

Really?

Because I would call a situation where the development team fails to appreciate the severity of a security vulnerability and has an established procedure that requires the researcher and not the kernel team to communicate with downstream users is already a major failure of process. Security is not just patching the vulnerability, and it seems that the Linux kernel developers or the Linux kernel security team does not understand that.

This is the result of that failure.

If this were any other software, we'd be here with pitchforks and torches. The researcher gave the developers timed disclosure, and even waited until after the developers had patched the issue. And... it's still a problem.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#273

Post by fresh_broccoli »

john_strinlai wrote: post #157
xeeeeeeeeeeenu wrote: post #2

For context, the author of the linked post, Sam James, is a Gentoo developer. Anyway, this is a disaster. It was extremely irresponsible to share the exploit with the world before the distributions shipped the fix. Who knows how many shared hosting providers were hacked with this. It's also worrying that it seems there's no communication between the kernel security team and distribution maintainers. One would hope th…

i have no problem with disclosing a vulnerability 30 days after its patched in the thing you reported to. (in fact, for those unaware, this is the same policy that google's project zero uses: "90+30" https://projectzero.google/vulnerability-disclosure-policy.h... ) the real problem is: > It's also worrying that it seems there's no communication between the kernel security team and distribution maintainers. the report…

>the reporter should not be the one responsible for reporting separately to every single downstream of the thing they found a vuln in.

Not "separately to every single downstream", there is the "linux-distros" mailing list for disclosures: https://oss-security.openwall.org/wiki/mailing-lists/distros

This random blogpost from 2022 serves as a proof that disclosing kernel vulnerabilities to the distros list is a well-known practice: https://sam4k.com/a-dummys-guide-to-disclosing-linux-kernel-...

I agree it's a shame that the process isn't more streamlined and the kernel developers aren't forwarding the reports to the distros list.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#274

Post by VladVladikoff »

tptacek wrote: post #192
VladVladikoff wrote: post #161

Hey Xint Code / tylerni7 https://news.ycombinator.com/threads?id=tylerni7 >, maybe you should improve your disclosure process as well? Maybe make it mandatory for users of your tool?

The security research community would run you out on a rail if you tried to take a successful research product and attach mandatory disclosure norms to it.

Couldn't the product itself disclose to the vendors?

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#275

Post by tptacek »

fresh_broccoli wrote: post #273
john_strinlai wrote: post #157

Earlier quoted context omitted.

i have no problem with disclosing a vulnerability 30 days after its patched in the thing you reported to. (in fact, for those unaware, this is the same policy that google's project zero uses: "90+30" https://projectzero.google/vulnerability-disclosure-policy.h... ) the real problem is: > It's also worrying that it seems there's no communication between the kernel security team and distribution maintainers. the report…

> the reporter should not be the one responsible for reporting separately to every single downstream of the thing they found a vuln in. Not "separately to every single downstream", there is the "linux-distros" mailing list for disclosures: https://oss-security.openwall.org/wiki/mailing-lists/distros This random blogpost from 2022 serves as a proof that disclosing kernel vulnerabilities to the distros list is a well-k…

It is literally not the vulnerability researcher's problem to solve or address this.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#276

Post by tptacek »

da_chicken wrote: post #265
Denvercoder9 wrote: post #253

Earlier quoted context omitted.

I'm not advocating for delaying the disclosure at all; my point is, if you see your initial disclosure to the kernel didn't go anywhere, to be responsible is to put in a little extra effort to ensure the fix is picked up before you disclose.

"Didn't go anywhere"? The kernel devs patched it! They patched it weeks ago! The kernel security team needs to communicate security problems in their own releases, because that is where the distros are already looking. Requiring the security researcher to do it is insane. Should a security researcher that identifies a vulnerability in electron.js need to identify every possible project using electron.js to communicat…

In the airless void of a message board thread, of course they should. What does it cost a commenter to demand that?

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#277

Post by throw0101a »

bluepuma77 wrote: post #137
baggy_trough wrote: post #5

Earlier quoted context omitted.

Why wouldn't the linux security team notify the main linux distributions?

Well, how do you define main Linux distros? Isn’t the next smaller one not receiving the info always complaining?

> Well, how do you define main Linux distros? Isn’t the next smaller one not receiving the info always complaining?

For a first approximation: Ubuntu, Debian, RHEL(-derived) to begin with, and SuSE which is in EU/server space (AIUI):

* https://commandlinux.com/statistics/most-popular-linux-distr...

* https://commandlinux.com/statistics/linux-server-market-shar...

Seems like Gentoo, Arch, Mint, and Slackware could also be as well:

* https://distrowatch.com/dwres.php?resource=major

U/Deb/RHEL are 'upstream' of a lot of other projects, and fixes would trickle down to Rocky, Alma, etc. Perhaps VM OS in cloud (AWS, Azure) could be a usage gauge as well.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#278

Post by throw0101a »

stonogo wrote: post #135
aduwah wrote: post #71

Earlier quoted context omitted.

Especially since the reporter is explicitly asked not to notify the distro teams first. https://docs.kernel.org/process/security-bugs.html ```As such, the kernel security team strongly recommends that as a reporter of a potential security issue you DO NOT contact the “linux-distros” mailing list UNTIL a fix is accepted by the affected code’s maintainers and you have read the distros wiki page above and you fully unde…

The kernel team has been at odds with the CVE process and the oss-security community about this stuff for many, many years now. It's a big part of why the kernel team established a CNA and started flooding CVE notifications; they don't believe that security problems are different than non-security problems, and refuse to establish norms or policies based on the idea that they are.

> […] they don't believe that security problems are different than non-security problems, and refuse to establish norms or policies based on the idea that they are.

They believe there is no difference being able to get root and not being able to get root? It seems to me that to-be(-root) and not-to-be(-root) are quite different.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#279

Post by tptacek »

VladVladikoff wrote: post #274
tptacek wrote: post #192

Earlier quoted context omitted.

The security research community would run you out on a rail if you tried to take a successful research product and attach mandatory disclosure norms to it.

Couldn't the product itself disclose to the vendors?

No firm in the world would use a vulnerability research product that automatically disclosed to vendors.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#280

Post by tptacek »

Denvercoder9 wrote: post #237
da_chicken wrote: post #234

Earlier quoted context omitted.

No. The problem is that vendors and developers have repeatedly shown that if you give them an inch, they take a mile. Look at exactly what happened with BlueHammer this month. The security researcher went full disclosure because Microsoft didn't listen to their reports. Disclosure is vital. It's essential . Because the truth is, if a security researcher has found it, it's extremely likely that it's already been found…

The situation with e.g. BlueHammer is fundamentally different: there, the only party that could act on it (Microsoft) ignored them. In this case, the parties that could act on it weren't notified at all. I'm also not proposing delaying the disclosure to the general public at all. They already waited 30 days with that, that's fine. Just look a bit further than your checklist of only contacting upstream, and send a mai…

Downstream vulnerability disclosure is a negotiation between the downstreams and the upstreams. It is not the job of a vulnerability researcher to map this out perfectly (or at all).
Post reply on HN