[flagged]
For Linux kernel vulnerabilities, there is no heads-up to distributions
421–430 of 578 posts
Re: For Linux kernel vulnerabilities, there is no heads-up to distributions
#422Earlier quoted context omitted.
A rogue actor may create a new distro, maybe for some niche use case such as accessibility or retro gaming. After acquiring enough false (and even some real) users that the Linux Foundation accepts them as a notifiable distro maintainer, this maintainer could then pwn machines before the exploit is made public.
Rather than the current situation, where they can pwn machines after the exploit is made public?
Yes. After the exploit is made public, the window of opportunity closes quickly.
Re: For Linux kernel vulnerabilities, there is no heads-up to distributions
#423Earlier quoted context omitted.
Why wouldn't the linux security team notify the main linux distributions?
Greg and Linus do not believe in the entire concept of "vulnerabilities" in the Linux kernel and do not believe in the methods that distros use like cherry picking, therefor they typically are against issuing CVEs, scoring CVEs, describing vulnerabilities at all (if you use the word "vulnerability", your patch will be rejected), etc. It's fundamentally their position to not work the way that you describe.
I would like to read more about this. Do you have a source?
Re: For Linux kernel vulnerabilities, there is no heads-up to distributions
#424Earlier quoted context omitted.
> the reporter should not be the one responsible for reporting separately to every single downstream of the thing they found a vuln in. Not "separately to every single downstream", there is the "linux-distros" mailing list for disclosures: https://oss-security.openwall.org/wiki/mailing-lists/distros This random blogpost from 2022 serves as a proof that disclosing kernel vulnerabilities to the distros list is a well-k…
It is literally not the vulnerability researcher's problem to solve or address this.
If you just want to get a bug fixed that annoys you, it's of course out of scope.
If researchers want to showcase their ability (either individually or as an organization) to identify and address security vulnerabilities in complex multi-stakeholder environments, I very much expect them to figure this out. After all, it doesn't make much sense if a company, after commissioning a security review, needs to hire a different firm to handle the vendor interactions, so that identified issues are resolved with minimal impact to the business.
Re: For Linux kernel vulnerabilities, there is no heads-up to distributions
#425Interesting comment by Greg Kroah-Hartman when asked why the kernel team doesn't notify distros directly > Nope, sorry, we are NOT allowed to notify anyone about anything "ahead of time" otherwise we will have to tell everyone about everything. That's the only policy by which all the legal/governmental agencies have agreed to allow us to operate in, so we are stuck with it. I'd be interested in knowing more about tha…
The members of the kernel security team are not allowed to tell their employers anything that happens on the security list. They are there as individual members, not as employees.
And try to define "major distros" in a way that actually means anything viable.
If you just want to count users, then that would only be Android (everything else is a rounding error.) After Android, that would be Yocto, and then Debian. All distros after that are mere fractions of overall users compared to those 3 by number of running systems alone.
If you want to count it as "$ spent on Linux" then that cuts out Android and Yocto and Debian as those distros are free, and would focus purely on the tiny installed base of paid Linux systems, and cut everyone else out.
So what is a fair way to do this other than "we notify no one, and tell everyone to always update their systems to the latest stable releases that we support."
Especially as there is no way for us to determine your use case (i.e. if a specific bug is a vulnerability for you or not.)
Re: For Linux kernel vulnerabilities, there is no heads-up to distributions
#426huh somehow seeing people not using ai to work is like wow moment which i cherish a lot these days
You're likely in an echo chamber! Barely anyone I know uses AI as more than a fallible tool.
I blame X for this. I don't use it, but whenever I open the feed I get bombarded with bullshit that is packaged like a unicorn.
Re: For Linux kernel vulnerabilities, there is no heads-up to distributions
#427Stop blaming the reporter. Start asking kernel to fix their process. Linux kernel is no longer a toy project, it has full time employees employed by various companies. They should have handled notifying distributions. Not some rando.
Linus should take his trademark autistic rage where he calls other peoples code "dogshit" onto his own work for once. He likes the glory of leading the kernel development but not the responsibilitys like this.
Re: For Linux kernel vulnerabilities, there is no heads-up to distributions
#428Earlier quoted context omitted.
It is literally not the vulnerability researcher's problem to solve or address this.
If they get enough time to build a website with a fancy logo instead, one might however question where their priorities are.
I'd imagine it's not that they lacked the time to email linux-distros, but that they were unaware they were supposed to do so.
Feels like the more sensible process would be for kernel maintainers to announce when a version contains a fix for a high-impact security vulnerability and for distro maintainers to pay attention to that. Could be done without revealing what the vulnerability actually is in most cases, trusting the kernel maintainer's judgement. There does seem to be a public linux-cve-announce mailing list.
Re: For Linux kernel vulnerabilities, there is no heads-up to distributions
#429Earlier quoted context omitted.
> a notification should have gone out from the kernel team to a curated list of distro security folk Who would curate that list though? You don't need permission from the kernel team to spin up a new distro. I can go and create fork of Debian or Arch or whatever today and the kernel team would never know (and neither should they). This is completely in the responsibility of the distros. If you don't like this model,…
Uh, there is a list, named "linux-distros", which is for this purpose (and I think it's for more than just Linux, e.g. I believe it was used for the xz vuln). Given this was announced when backports weren't ready (and given the POC was at least opaque if not obfuscated), I'm getting the vibe fixing the vuln wasn't as high as a priority as making a media splash.
From TFA:
> Note that for Linux kernel vulnerabilities, unless the reporter chooses > to bring it to the linux-distros ML, there is no heads-up to > distributions.
so, no, `linux-distros` list don't solve the problem.
Re: For Linux kernel vulnerabilities, there is no heads-up to distributions
#430> Note that for Linux kernel vulnerabilities, unless the reporter chooses to bring it to the linux-distros ML, there is no heads-up to distributions. Why would they imply it is incumbent on the reporter to liaise with distributions? That seems to assume a high level of familiarity with the linux project. Vulnerability reporters shouldn’t be responsible for directly working with every downstream consumer of the linux…
Especially since the reporter is explicitly asked not to notify the distro teams first. https://docs.kernel.org/process/security-bugs.html ```As such, the kernel security team strongly recommends that as a reporter of a potential security issue you DO NOT contact the “linux-distros” mailing list UNTIL a fix is accepted by the affected code’s maintainers and you have read the distros wiki page above and you fully unde…
> and you fully understand the requirements that contacting “linux-distros” will impose on you
Imposing requirements on the reporter? No.