Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

For Linux kernel vulnerabilities, there is no heads-up to distributions

openwall.com

Post reply on HN
Print view View original

381–390 of 578 posts

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#381

Post by hsbauauvhabzb »

dawnerd wrote: post #74
lifis wrote: post #57

Earlier quoted context omitted.

The Linux kernel is not usable as a security boundary, so anyone who wants to do "shared hosting" and not be hacked needs to use something else, like gVisor or firecracker VMs The only important system that uses it as a security boundary is Android and there is mitigated by the fact that APKs need user approval, plus strict SELinux and seccomp policy plus the GrapheneOS hardening, and in this case the mitigations suc…

A LOT of websites are tenants on WHM/CPanel hosts. Not to mention how many agencies use it for their clients Wordpress sites.

They built it wrong.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#382

Post by hsbauauvhabzb »

egonschiele wrote: post #30
shimman wrote: post #4

Earlier quoted context omitted.

Expecting people to do the right thing is a fundamental issue here. Why would you ever expect for all of vulnerabilities to be disclosed privately? There's very little actual incentive to do this. I'm honestly unaware of what systems could be put in place to prevent this but expecting people to always do the right thing is fantasy level thinking. I mean I bet the disclosers thought they were doing the right thing, he…

Why don't all these distro maintainers add their own back doors, and mine crypto off our machines without our knowledge? Surely, there is some legal fine print they can add that would let them do that. There is very little incentive for them to maintain these systems, given how thankless and underpaid the work is.

Most distros are maintained by commercial companies.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#383

Post by maybewhenthesun »

krzyk wrote: post #361
plg94 wrote: post #321

Earlier quoted context omitted.

> Why isn't it the job of the distros to keep up on upstream security disclosures? They can't, because (responsible) security disclosures are private, _not public_. That's the whole point of the system: notify the developers in private ahead of time (usually 30, 60 or 90 days) so they can write, test and roll-out the fixes before you release the info to the whole world. This is to minimize the time between when bad a…

It would be best if distros kept tap on kernel changes and update as soon as possible when they see a security issue fixed. Sending emails to some big distros would still result with e.g. Gentoo not getting that info because they are not a big distro.

The problem is that the kernel devs (correctly imo) consider all bugfixes security fixes. So the distros need to decide for themselves which ones are important enough to warrant an update. Apparently this one had a quite unclear commit message, so it importance was missed.

Not ideal, but also: shit happens? It's always a balancing act choosing the lesser of multiple evils and most of the time it seems to work ok-ish, which is probably the best we can hope for ;-P

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#384

Post by zamalek »

tptacek wrote: post #343
zamalek wrote: post #327

Earlier quoted context omitted.

Yes, and that's why we have the responsible disclosure protocol. It wasn't correctly followed here.

There is no such thing as "the responsible disclosure protocol". There's really no such thing as "responsible disclosure" at all, but "the responsible disclosure protocol" is a term I have literally never heard before. (I've been a vulnerability researcher since the mid-1990s, for what it's worth.)

https://en.wikipedia.org/wiki/Coordinated_vulnerability_disc...

> In computer security, coordinated vulnerability disclosure (CVD, sometimes known as responsible disclosure)

I guess you can learn something new after 36 years.

If you are referring to what you quoted, your pedantry and sharpshooting would result in an incomplete English sentence: "that's why we have the responsible disclosure" is missing a noun. Now that we are firmly in worthless pedantry:

Protocol (n):

1.a. a system of rules that explain the correct conduct and procedures to be followed in formal situations

1.b. a set of conventions governing the treatment and especially the formatting of data in an electronic communications system

If you don't like what I said or disagree, poke holes in factual inaccuracies. However, in the reality that I am pretty sure we all share, responsible disclosure is a well established protocol that is followed by many security researchers, and was imperfectly followed here.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#385

Post by maybewhenthesun »

dwattttt wrote: post #347
stackghost wrote: post #313

Earlier quoted context omitted.

Microsoft has a long and sordid history of cheerfully doing anything they can to fuck everyone over just to make a few more percentage points of profit. Linux is a free kernel that literally revolutionized the computing landscape.

Yes, this is the sacred cow status being referred to.

It might be a scared cow, but at least deservedly so. There is imho a difference between accidental incompetence (debatable, even) and active malice. Microsoft has done a lot of the latter so gets bashed more, nor surprise there.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#386

Post by stingraycharles »

john_strinlai wrote: post #292
dweinus wrote: post #268

Earlier quoted context omitted.

No, I will. The distros and the kernel devs should be talking and moving on high sev patches, sure. But real people will have gotten hurt because the reporter didn't want to wait for that to happen. That's on them.

you must be unfamiliar what used to happen before hard deadlines were set on disclosure. it was much worse for the users. here is a good start: https://projectzero.google/vulnerability-disclosure-faq.html... there is ~3 decades of more context if you search for it.

tldr: if security issues don’t get disclosed (or the real threat of disclosure) they won’t get fixed / prioritized.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#387

Post by porridgeraisin »

xeeeeeeeeeeenu wrote: post #2

For context, the author of the linked post, Sam James, is a Gentoo developer. Anyway, this is a disaster. It was extremely irresponsible to share the exploit with the world before the distributions shipped the fix. Who knows how many shared hosting providers were hacked with this. It's also worrying that it seems there's no communication between the kernel security team and distribution maintainers. One would hope th…

Fundamentally.

The disclosure is private. Meaning neither the commit messages nor any public info can leak too much information about the bug. It's usually kept rather discrete.

It is impractical for the kernel to broadcast to all its users privately.

Meaning that either a) distro maintainers should be privy to it, but where does this end?[1] or b) we have the current situation

[1] probably the top 5 distros security teams can just be copied into the private mail. Maybe the kernel security private list can forward the emails to them as well.

Problem is, every other type of communication between distros and kernel is implicit. In commit messages, patches and release notes. So it's an exceptional case.

BTW, with LLMs there's a new issue. It is now cheap to scan the kernel commit log maybe in _next and ask it to identify what could be a patch for a private disclosure. And then immediately RE the patch and exploit it on deployed kernels.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#388

Post by dbdr »

thayne wrote: post #373
akerl_ wrote: post #316

Earlier quoted context omitted.

It looks like the expected thing happened. The kernel devs patched the kernel. The kernel devs have a pretty known, straightforward stance in how they ship fixes for anything, because anything in the kernel can be a security problem. Distro maintainers can see kernel changes. Some distros aggressively track new changes. Others backport what they feel are relevant. Others don’t do either. Users pick what distro they u…

> Others backport what they feel are relevant. But from what I understand they were not given enough information to know if it was relevant or not. The commit message just said it reverted a change from another commit because there was "no benefit". From the patch itself, it is not at all evident that this is a fix for a critical security bug.

> The commit message just said it reverted a change from another commit because there was "no benefit". From the patch itself, it is not at all evident that this is a fix for a critical security bug.

If the commit message says it fixes a security bug, then bad actors immediately know there's a possible exploit there. So maybe it's intentional? (not familiar with the policy for this)

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#389

Post by akerl_ »

nchmy wrote: post #375
SOLAR_FIELDS wrote: post #352

Earlier quoted context omitted.

Is that the only option here? It’s certainly being framed as such.

Fwiw, I'm completely with you on this. The folks you're communicating with seem utterly miserable, and don't seem to be communicating in good faith. Not sure what the solution could/should be, but surely there could be a better, easier mechanism for kernel to advise all distro maintainers who care, and for those distro maintainers to subscribe in some way. Whether any distro maintainers do so (let alone do something…

It seems odd to call me utterly miserable and then suggest I’m not communicating in good faith.

We don’t have to agree, but the site rules are pretty clear that swipes like that aren’t ok.

That kind of distro maintainers and kernel devs communication path already exists: the linux-distros@ mailing list. But since anybody can read it, posting “hey everybody, this is a security patch” has basically the same effect as the security researcher posting, in terms of disclosing the vuln to bad actors.

Given that anybody can make a Linux distro, and Linux distros aren’t generally either capable or interested in background checking their teams or policing their individual security practice, it doesn’t seem possible to have a communication channel that distros can sign up for that lacks this problem.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#390

Post by gpvos »

krzyk wrote: post #361
plg94 wrote: post #321

Earlier quoted context omitted.

> Why isn't it the job of the distros to keep up on upstream security disclosures? They can't, because (responsible) security disclosures are private, _not public_. That's the whole point of the system: notify the developers in private ahead of time (usually 30, 60 or 90 days) so they can write, test and roll-out the fixes before you release the info to the whole world. This is to minimize the time between when bad a…

It would be best if distros kept tap on kernel changes and update as soon as possible when they see a security issue fixed. Sending emails to some big distros would still result with e.g. Gentoo not getting that info because they are not a big distro.

The kernel maintainers don't flag "security fixes" as special, and they have a well-thought-out reason for that, see many other comments in this thread.
Post reply on HN