Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

For Linux kernel vulnerabilities, there is no heads-up to distributions

openwall.com

Post reply on HN
Print view View original

351–360 of 578 posts

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#351

Post by pamcake »

whatevaa wrote: post #167

Stop blaming the reporter. Start asking kernel to fix their process. Linux kernel is no longer a toy project, it has full time employees employed by various companies. They should have handled notifying distributions. Not some rando.

Look, if they namedrop specific distros in their announcement (marketing) blog post as affected, I think a heads-up before publishing that is appropriate and expected.

I don't think they would have gotten as much flame if it weren't for how the RHEL 14 mention and such were put.

This is a security company with a professional(?) communications department banking on pointing fingers at distro maintainers. We are not talking about solo security researchers or academics here.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#352

Post by SOLAR_FIELDS »

tptacek wrote: post #336
SOLAR_FIELDS wrote: post #334

Earlier quoted context omitted.

Right, you’re saying “system is working as designed”, and I’m agreeing, but I’m saying “the system as designed kind of sucks, how can we make it better”?

Start a distro with your preferred upstream tracking policy.

Is that the only option here? It’s certainly being framed as such.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#353

Post by gpm »

SOLAR_FIELDS wrote: post #309
tptacek wrote: post #275

Earlier quoted context omitted.

It is literally not the vulnerability researcher's problem to solve or address this.

Agree, but then where does the accountability lie? Presumably with the kernel maintainers themselves, correct? SOMEONE dropped the ball here. If we can't point the finger correctly, that seems like a problem in of itself.

The accountability fundamentally lies with the distro maintainers. They're the ones shipping a "product". Either they need to get agreements in place for advance notice, or correctly set expectations with their users that they won't get advanced notice.

They dropped the ball when the shipped supposedly secure systems where their method for getting alerted to security updates was "hope people reporting to upstream will also notice a mailing list that will alert them".

(Caveat: Distro's like Ubuntu advertise security updates so this is on them. I'm not sure Gentoo does that, if they don't well then no one dropped the ball because no one represented that Gentoo got prompt security updates).

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#354

Post by Quarrel »

lrvick wrote: post #179
kelnos wrote: post #109

Earlier quoted context omitted.

I'm pretty sure they have a legal obligation in most jurisdictions not to sell 0days for profit. And they absolutely have a moral obligation to do things in a way to minimize damage and impact to other people's systems. (I'm not saying "responsible disclosure" is the correct way to do that, but hoarding vulnerabilities and exploits and selling them to the highest bidder certainly isn't.) This is how society needs to…

Let me make you aware of zerodium. A broker anyone can sell vulns to, that sells to unspecified buyers you do not need to know about.

FWIW, zerodium shut down in 2025.

Or at least went dark ..

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#355

Post by pmontra »

aduwah wrote: post #71
semiquaver wrote: post #7

> Note that for Linux kernel vulnerabilities, unless the reporter chooses to bring it to the linux-distros ML, there is no heads-up to distributions. Why would they imply it is incumbent on the reporter to liaise with distributions? That seems to assume a high level of familiarity with the linux project. Vulnerability reporters shouldn’t be responsible for directly working with every downstream consumer of the linux…

Especially since the reporter is explicitly asked not to notify the distro teams first. https://docs.kernel.org/process/security-bugs.html ```As such, the kernel security team strongly recommends that as a reporter of a potential security issue you DO NOT contact the “linux-distros” mailing list UNTIL a fix is accepted by the affected code’s maintainers and you have read the distros wiki page above and you fully unde…

There are a zillion of distributions. The mailing list at https://oss-security.openwall.org/wiki/mailing-lists/distros includes some I never heard about and misses some famous ones (Mint, POP OS.)

The bug is in the kernel, so it's OK to notify only the kernel team. Then they should notify the distributions they are in contact with.

The first message about Copy Fail that I see in the archive https://www.openwall.com/lists/oss-security/2026/04/ is from April 29. I run apt on my Debian 13 yesterday and got the fixed kernel.

Do I expect that every distribution is already patched? I don't. However each of us choose the distribution to run. Security can be one of the criteria for the choice. I played safe and I'm using Debian. Other people can make a different tradeoff maybe based on their personal threat analysis.

There are people running end of life kernels and distributions in production, or with pinned old kernels especially on ARM SBCs. I know both. Those are other choices made at the user end of the process.

IMHO the disclosure and fix process was run in the proper way from the researcher to the end user.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#356

Post by vaylian »

wang_li wrote: post #22
holowoodman wrote: post #10

Earlier quoted context omitted.

I can accept (and welcome) disclosure before there are patches. But publishing a working exploit together with the disclosure before patches are available is really really irresponsible, maybe even criminal. And no, the proposed mitigations don't help with half of the distributions out there...

There is an alternative mitigation you can use which blacklists the function calls when the affected code is not built as a kernel module.

> alternative mitigation you can use

That's besides the point. If people use the official mitigation on https://copy.fail/#mitigation they will not sufficiently protect themselves on mainstream distros like Ubuntu and Debian.

The page also states

> Most major distributions are shipping the fix now.

This text was probably prepared in advance, but this was simply not true at the time of publication.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#358

Post by cdud3 »

gpm wrote: post #353
SOLAR_FIELDS wrote: post #309

Earlier quoted context omitted.

Agree, but then where does the accountability lie? Presumably with the kernel maintainers themselves, correct? SOMEONE dropped the ball here. If we can't point the finger correctly, that seems like a problem in of itself.

The accountability fundamentally lies with the distro maintainers. They're the ones shipping a "product". Either they need to get agreements in place for advance notice, or correctly set expectations with their users that they won't get advanced notice. They dropped the ball when the shipped supposedly secure systems where their method for getting alerted to security updates was "hope people reporting to upstream wil…

All it takes is to be part of the Kernel security team. I am surprised that many commercial strong distributors just not care enough to join the Kernel security team. Hopefully a valuable lesson was learned and fixes are applied.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#359

Post by debugnik »

akerl_ wrote: post #61
michaelmrose wrote: post #55

Earlier quoted context omitted.

If it's not a crime I see no reason not to work with partner nations to build responsible disclosure into a legal framework everywhere because it pretty obviously should be.

If you wanted to somehow make coordinated disclosure into a legal framework, that would be an interesting and complex project. But it’s not the law anywhere I’m aware of today, and I’d not support it becoming a law.

This is kind of a thing already in the EU. Under NIS 2, vulnerabilities should be notified to a CSIRT as well as upstream, and the CSIRT shall identify downstream vendors and negotiate a disclosure timeline. I don't know whether they're any good at it or not, though.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#360

Post by krzyk »

xeeeeeeeeeeenu wrote: post #2

For context, the author of the linked post, Sam James, is a Gentoo developer. Anyway, this is a disaster. It was extremely irresponsible to share the exploit with the world before the distributions shipped the fix. Who knows how many shared hosting providers were hacked with this. It's also worrying that it seems there's no communication between the kernel security team and distribution maintainers. One would hope th…

There are so many distributions that it is not possible to notify each one, unless there is some single distribution list for all.

And if you disclose to just a handful, why ignore the rest?

Post reply on HN