Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Dear Linux Kernel CNA, what have you done?

amanitasecurity.com

Post reply on HN
Print view View original

41–50 of 116 posts

Re: Dear Linux Kernel CNA, what have you done?

#41

Post by Avamander »

eqvinox wrote: post #40
Avamander wrote: post #37

Earlier quoted context omitted.

> Linux kernel developers are entirely capable of assessing this. They're just refusing to do it for someone else's definition of a "security bug". Then instead of this, don't? It's utterly childish. > How would they get burnt by this? Social pressure from other kernel developers (or even outside) isn't going to have that effect. Fewer organisations willing to cooperate with them, for one? Social pressure comes in ma…

> They're going to be paying someone else […] And that's perfectly fine, it's open source software . Either way someone gets paid to look at the patches, which is my point . If you want to do it in a cost-effective manner, you'll find other people with the same requirements, since the work result is "shareable". > […] instead of the organization that deliberately hinders these efforts. There is no such organization,…

I think you got a bit confused.

> There is no such organization

There is such an organization, the Linux Foundation is the CNA being the hindrance to these efforts. And yes, they won't perform the role, someone else will and they will be paid for it.

For some that's fine, I find it a significant amount of wasted effort, confusion and potential issues.

Re: Dear Linux Kernel CNA, what have you done?

#42

Post by eqvinox »

Avamander wrote: post #41
eqvinox wrote: post #40

Earlier quoted context omitted.

> They're going to be paying someone else […] And that's perfectly fine, it's open source software . Either way someone gets paid to look at the patches, which is my point . If you want to do it in a cost-effective manner, you'll find other people with the same requirements, since the work result is "shareable". > […] instead of the organization that deliberately hinders these efforts. There is no such organization,…

I think you got a bit confused. > There is no such organization There is such an organization, the Linux Foundation is the CNA being the hindrance to these efforts. And yes, they won't perform the role, someone else will and they will be paid for it. For some that's fine, I find it a significant amount of wasted effort, confusion and potential issues.

>> They're going to be paying someone else to provide a clean feed instead of the organization that deliberately hinders these efforts.

You were implying the Linux Foundation is attempting to get paid for providing said "clean feed".

Anyway, this has devolved far enough.

[Ed.: the Linux Foundation isn't even the CNA, shame on me for accepting that without verifying. The actual CNA is kernel.org. https://www.cve.org/Media/News/item/news/2024/02/13/kernel-o... ]

Re: Dear Linux Kernel CNA, what have you done?

#44

Post by kuschku »

Avamander wrote: post #38
kuschku wrote: post #34

Earlier quoted context omitted.

It's not elsewhere, it's bad CVEs everywhere . Curl is just a particularly good example because they document it so well.

There are many more good and useful CVEs. I'd also kindly request you to suggest a better system.

Filing a CVE used to be a dialog between the researcher, developers, and third-party domain experts. Accepting every random LLM-generated report and granting it a 9.8 score is not useful in any way.

I have to patch hundreds of CVEs in a month, and only a handful are actually valid. The vast majority is "CVSS 9.8: regex complexity explosion in $library" which my project only uses during build. But I've got to patch it, because it's definitely absolutely critical.

While the standard library bug that causes SSL connections to fall back to TLS1.1 instead of TLS1.3 by default is considered WONTFIX and gets REJECTED for a CVE.

Re: Dear Linux Kernel CNA, what have you done?

#45

Post by gertop »

michaelt wrote: post #18

> Typically, security researchers are held to higher standards when disclosing vulnerabilities. The expectation is that CVEs are assigned for ‘meaningful’ security vulnerabilities, and not for any software fixes that ‘might’ be a security vulnerability. Maybe that's the aspiration, but it's clearly not the case in practice. I reported a firefox bug 12 years ago where a malicious SVG could cause a hang - basically a 2…

12 years ago, Firefox wasn't multi process. So your bug would likely freeze the entire browser, including the UI. Considering that, back then, Firefox reloaded all tabs back when you reopened it, it would keep freezing even if you force closed it. Fun times.

Re: Dear Linux Kernel CNA, what have you done?

#47

Post by tptacek »

The purpose of CVEs is to ensure that people discussing vulnerabilities are talking about the same thing. CVEs aren't a checklist, they aren't a perfect enumeration, and it shouldn't matter if a CVE is issued for a nonissue.

People who are burdened by requirements to ship (or produce rolling updates) to address every Linux kernel CVE are living in a state of sin. It doesn't make sense for the kernel CNA to alter its behavior to accommodate them.

Re: Dear Linux Kernel CNA, what have you done?

#48

Post by Arch-TK »

michaelt wrote: post #18

> Typically, security researchers are held to higher standards when disclosing vulnerabilities. The expectation is that CVEs are assigned for ‘meaningful’ security vulnerabilities, and not for any software fixes that ‘might’ be a security vulnerability. Maybe that's the aspiration, but it's clearly not the case in practice. I reported a firefox bug 12 years ago where a malicious SVG could cause a hang - basically a 2…

CVSS 3.1 score is 4.3 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). (You can somewhat argue UI:N but I don't think it applies in this case.)

Lots of corps would spend a non-trivial amount of effort to remediate something with such a score.

Re: Dear Linux Kernel CNA, what have you done?

#49

Post by Arch-TK »

raesene9 wrote: post #11

For another opinion on this topic https://jericho.blog/2024/02/26/the-linux-cna-red-flags-sinc... Having a large number of new, unscored, CVEs in the Linux kernel is going to make things... interesting. From their lists https://lore.kernel.org/linux-cve-announce/ these just have a CVE and not really enough detail for anyone to assign a score without a lot of additional analysis, which reduces their usefulness. To an…

It's possible to take a somewhat unopinionated approach to CVSS, the issue is that such CVSS scores exist in a vacuum, and vulnerabilities exist in environments. It's not possible to really apply a CVSS score to a vulnerability in a specific environment without understanding the vulnerability and more or less ignoring the CVSS score.

In summary, CVSS scores can be very objective, but in those cases they're also worthless.

Re: Dear Linux Kernel CNA, what have you done?

#50

Post by toast0 »

gertop wrote: post #45
michaelt wrote: post #18

> Typically, security researchers are held to higher standards when disclosing vulnerabilities. The expectation is that CVEs are assigned for ‘meaningful’ security vulnerabilities, and not for any software fixes that ‘might’ be a security vulnerability. Maybe that's the aspiration, but it's clearly not the case in practice. I reported a firefox bug 12 years ago where a malicious SVG could cause a hang - basically a 2…

12 years ago, Firefox wasn't multi process. So your bug would likely freeze the entire browser, including the UI. Considering that, back then, Firefox reloaded all tabs back when you reopened it, it would keep freezing even if you force closed it. Fun times.

> Considering that, back then, Firefox reloaded all tabs back when you reopened it, it would keep freezing even if you force closed it.

That was always an option, as I recall. I think a non-default option, too. Not sure when they started adding the question about if you wanted to restore when you started up after a crash/unsafe shutdown.

Post reply on HN