Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

For Linux kernel vulnerabilities, there is no heads-up to distributions

openwall.com

Post reply on HN
Print view View original

431–440 of 578 posts

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#431

Post by ramon156 »

zamalek wrote: post #31
xeeeeeeeeeeenu wrote: post #2

For context, the author of the linked post, Sam James, is a Gentoo developer. Anyway, this is a disaster. It was extremely irresponsible to share the exploit with the world before the distributions shipped the fix. Who knows how many shared hosting providers were hacked with this. It's also worrying that it seems there's no communication between the kernel security team and distribution maintainers. One would hope th…

The disclosure was more about marketing than security. From the disclosure page: > Is your software AI-era safe? > Copy Fail was surfaced by Xint Code about an hour of scan time against the Linux crypto/ subsystem. [...] > [Try Xint Code] More chaos makes their product seem even more attractive.

I created an account for xint code, wtf is this UX?

I get put into a read-only dashboard with ZERO info. is this live? is this static? how do I use it? the API button just leads me to a swagger doc.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#432

Post by Brian_K_White »

komali2 wrote: post #339
akerl_ wrote: post #332

Earlier quoted context omitted.

To be more blunt: if you’re paying for a product, the vendor owes you whatever things they committed to. If you’re a Redhat customer and your agreed SLA with Redhat for this kind of security fix was passed by, go be mad at Redhat. (I don’t think Redhat is bad here, they’re just the vendor most known for a commercial offering from the lists here. I would say the same thing about Ubuntu Pro) Otherwise, it’s on the end…

Just as a purely intellectual exercise, what changes about this if we leave aside ideas of "owe," "deserve ," and "earn?" There's not really an enforcement mechanism in FOSS like there is in capitalism world, it just comes down to what we want our part of the world to look like. So I think we'd think more clearly if we leave aside the ideas like "who owes who what." I think it's fun to imagine what sort of motivation…

"leave aside ideas of "owe," "deserve ," and "earn?""

Nonsensical string of words with no meaning.

If you want something that someone else isn't giving you, you have the option to try to do it yourself, or try to compel someone else to give you what you want somehow. Feel free to idk pay someone to track the kernel list and 4000 others and send you heads-ups? Try to pass a law to make people do what you want since you don't care about words like "owe"?

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#433

Post by dwattttt »

fweimer wrote: post #424
tptacek wrote: post #275

Earlier quoted context omitted.

It is literally not the vulnerability researcher's problem to solve or address this.

If you just want to get a bug fixed that annoys you, it's of course out of scope. If researchers want to showcase their ability (either individually or as an organization) to identify and address security vulnerabilities in complex multi-stakeholder environments, I very much expect them to figure this out. After all, it doesn't make much sense if a company, after commissioning a security review, needs to hire a diffe…

> a company, after commissioning a security review, needs to hire a different firm to handle the vendor interactions

These vendor interactions you're referring to are the company's customers, correct? Are you proposing the company hire another company to manage getting updates to their customers?

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#434

Post by 2OEH8eoCRo0 »

kro wrote: post #372
2OEH8eoCRo0 wrote: post #306

Seems silly. How many distros need to be notified? There are hundreds.

That is true, but if at least the widely used ones would get notified before that would be beneficial. If they have a responsible security contact point. - Debian - Ubuntu - Arch - Amazon/Azure - Fedora/RHEL

Then those that aren't notified will complain. I think it's on the distros to follow kernel developments since they are consumers of the kernel, not the other way around. Kernel devs can't possibly know all of the stakeholders that they need to notify.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#435

Post by leni536 »

SCHiM wrote: post #408
robocat wrote: post #399

Earlier quoted context omitted.

> terms of our responsible disclosure policy I couldn't find a public copy of that. The best starting point I found for reporting vulnerabilities was: https://github.com/microsoft/MSRC-Security-Research/security... You can email without agreeing to anything. But for a serious issue Microsoft would obviously try and track down who you are and what jurisdiction you are in.

https://www.microsoft.com/en-us/msrc/bounty-guidelines > MICROSOFT BOUNTY TERMS & CONDITIONS > Last updated: July 23, 2025 > The Microsoft Bug Bounty Programs Terms and Conditions ("Terms") cover your participation in the Microsoft Bug Bounty Program (the "Program"). These Terms are between you and Microsoft Corporation ("Microsoft," "us" or "we"). By submitting any vulnerabilities to Microsoft or otherwise participa…

This seems to be sloppy wording, with the intent of "we only offer the bounty under these terms". Maybe my interpretation is too charitable.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#436

Post by ramon156 »

Unrelated but also a CVE that popped up for ProFTPd: https://www.openwall.com/lists/oss-security/2026/05/01/4

What's interesting is that their website is also down right now. These seem like special-timed DDos attacks so maintainers cannot communicate the issue well.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#437

Post by walletdrainer »

i_think_so wrote: post #417
akerl_ wrote: post #335

Earlier quoted context omitted.

I disagree that it sucks. It leverages a ton of people putting in their time and resources, and relies on system operators being active participants. This vulnerability is, for some threat models, a really big deal. A security group found the vulnerability. They disclosed it. It was patched. Folks here have gotten all kinds of bent out of shape that the groups involved didnt do things in the way each internet comment…

> This vulnerability is, for some threat models, a really big deal. This vulnerability is, for other threat models, a death sentence. > A security group found the vulnerability. They disclosed it. It was patched. It was patched only after some people who should have been notified well in advance happened to notice something was up. That is NOT HOW IT'S SUPPOSED TO WORK. For as long as the unpatched window remains ope…

> This vuln is a digital magic wand that is trivially usable to cast Avada Kedavra and somebody neglected to tell 99.99% of the Good Guys about it.

A Linux LPE is a nothingburger unless you’re relying on the Linux kernel to enforce internal security boundaries, which would simply be foolish.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#438

Post by staticassertion »

baggy_trough wrote: post #247
staticassertion wrote: post #213

Earlier quoted context omitted.

I don't know what you mean at all. I'm just repeating known kernel policy here. What does 6.12 have to do with anything?

What is your interpretation of why Greg KH released a version of 6.12 with this fix in it today, other than to help distributions avoid this vulnerability?

Why would he ever... not release a new version? I don't get what you're trying to say - I'm stating Greg's explicit policy on the topic. If he did something outside of that policy, that wouldn't change anything.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#439

Post by staticassertion »

Hendrikto wrote: post #423
staticassertion wrote: post #200

Earlier quoted context omitted.

Greg and Linus do not believe in the entire concept of "vulnerabilities" in the Linux kernel and do not believe in the methods that distros use like cherry picking, therefor they typically are against issuing CVEs, scoring CVEs, describing vulnerabilities at all (if you use the word "vulnerability", your patch will be rejected), etc. It's fundamentally their position to not work the way that you describe.

I would like to read more about this. Do you have a source?

http://www.kroah.com/log/blog/2026/02/16/linux-cve-assignmen...

I'd start with Greg's own words. You can probably find more on it from Spender/grsecurity's blog.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#440

Post by walletdrainer »

ramon156 wrote: post #436

Unrelated but also a CVE that popped up for ProFTPd: https://www.openwall.com/lists/oss-security/2026/05/01/4 What's interesting is that their website is also down right now. These seem like special-timed DDos attacks so maintainers cannot communicate the issue well.

I suspect there are very few real setups affected by that proftpd bug.

Nobody is ddosing anything to cover it up.

Post reply on HN