Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

For Linux kernel vulnerabilities, there is no heads-up to distributions

openwall.com

Post reply on HN
Print view View original

451–460 of 578 posts

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#451

Post by ExoticPearTree »

xeeeeeeeeeeenu wrote: post #2

For context, the author of the linked post, Sam James, is a Gentoo developer. Anyway, this is a disaster. It was extremely irresponsible to share the exploit with the world before the distributions shipped the fix. Who knows how many shared hosting providers were hacked with this. It's also worrying that it seems there's no communication between the kernel security team and distribution maintainers. One would hope th…

> It was extremely irresponsible to share the exploit with the world before the distributions shipped the fix.

I disagree. Exploits should pe published as soon as they are written and found vulnerabilities to have as much details as possible, because if the researchers cannot write an exploit, someone else could.

- this has the advantage of forcing upgrades as soon as possible. No more “we need to see and schedule patching”

- publishing it as soon as possible makes everyne aware of the threat

- it is a learning experience for everyone

- “responsible disclosure” was invented by lazy companies that have zero interest in fixing a problem quickly

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#452

Post by kasey_junk »

nextlevelwizard wrote: post #449
tptacek wrote: post #275

Earlier quoted context omitted.

It is literally not the vulnerability researcher's problem to solve or address this.

That is just being pedantic. Why did they absolutely need to release this into the wild now? Why couldn’t they have waited? “30 days should be enough time” why? Why is 30 days a magic number? Especially in open source. Yeah it isn’t the researchers problem to tell every distributor of the kernel about the fix or verify that everyone has the fix, but fuck maybe wait until at least someone has the fix and maybe don’t d…

They didn’t release anything into the wild. It existed. The irresponsible thing would be letting it keep existing without telling anyone.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#453

Post by Dylan16807 »

nextlevelwizard wrote: post #449
tptacek wrote: post #275

Earlier quoted context omitted.

It is literally not the vulnerability researcher's problem to solve or address this.

That is just being pedantic. Why did they absolutely need to release this into the wild now? Why couldn’t they have waited? “30 days should be enough time” why? Why is 30 days a magic number? Especially in open source. Yeah it isn’t the researchers problem to tell every distributor of the kernel about the fix or verify that everyone has the fix, but fuck maybe wait until at least someone has the fix and maybe don’t d…

What number of days do you want? If nobody tells the distros it could be months or years, and while it would be nice for the researchers to monitor/notify distros it's really not their job. They might not have thought of it.

And they dropped it on a Wednesday.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#455

Post by paulnpace »

john_strinlai wrote: post #157
xeeeeeeeeeeenu wrote: post #2

For context, the author of the linked post, Sam James, is a Gentoo developer. Anyway, this is a disaster. It was extremely irresponsible to share the exploit with the world before the distributions shipped the fix. Who knows how many shared hosting providers were hacked with this. It's also worrying that it seems there's no communication between the kernel security team and distribution maintainers. One would hope th…

i have no problem with disclosing a vulnerability 30 days after its patched in the thing you reported to. (in fact, for those unaware, this is the same policy that google's project zero uses: "90+30" https://projectzero.google/vulnerability-disclosure-policy.h... ) the real problem is: > It's also worrying that it seems there's no communication between the kernel security team and distribution maintainers. the report…

> the reporter should not be the one responsible for reporting separately to every single downstream of the thing they found a vuln in.

It's 2026. We're more than 30 years into the Linux ecosystem. I don't believe this bullshit for a moment.

Given how trivially users can implement mitigation, distributions could have done _something_ to protect their users prior to publication date. A handful of messages is all that was required, not "every single downstream" - that is a straw man.

The publication of a bug that trivially gains root on an incredible number of Linux installs that was discovered using an A.I. tool prior to any of the "downstreams" implementing a fix is intentional. I speculate the motivation is free promotion of the A.I. tool.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#456

Post by DarkUranium »

mort96 wrote: post #377
steve1977 wrote: post #374

Earlier quoted context omitted.

> a notification should have gone out from the kernel team to a curated list of distro security folk Who would curate that list though? You don't need permission from the kernel team to spin up a new distro. I can go and create fork of Debian or Arch or whatever today and the kernel team would never know (and neither should they). This is completely in the responsibility of the distros. If you don't like this model,…

Sounds like a job for the Linux Foundation maybe? You don't need anyone's permission to make a distro, that's true, but if you notify Debian, Canonical, Fedora, Red Hat and Arch you're covering a very large fraction of users; way more than today's 0%. In cases like this, perfect is the enemy of the good.

The Linux Foundation hasn't been about Linux (except marginally) in a long while, if ever.

The name is a misnomer.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#457

Post by nchmy »

akerl_ wrote: post #389
nchmy wrote: post #375

Earlier quoted context omitted.

Fwiw, I'm completely with you on this. The folks you're communicating with seem utterly miserable, and don't seem to be communicating in good faith. Not sure what the solution could/should be, but surely there could be a better, easier mechanism for kernel to advise all distro maintainers who care, and for those distro maintainers to subscribe in some way. Whether any distro maintainers do so (let alone do something…

It seems odd to call me utterly miserable and then suggest I’m not communicating in good faith. We don’t have to agree, but the site rules are pretty clear that swipes like that aren’t ok. That kind of distro maintainers and kernel devs communication path already exists: the linux-distros@ mailing list. But since anybody can read it, posting “hey everybody, this is a security patch” has basically the same effect as t…

The person I was defending NEVER suggested that extra burden should be put on anyone. Just that there ought to be some system (even if imperfect)to make it easy for everyone (or, if not everyone, at least a select group - eg the main distros). But you and others kept saying that they were trying to put burden on various parties. That's the poor faith.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#458

Post by spookie »

tptacek wrote: post #275
fresh_broccoli wrote: post #273

Earlier quoted context omitted.

> the reporter should not be the one responsible for reporting separately to every single downstream of the thing they found a vuln in. Not "separately to every single downstream", there is the "linux-distros" mailing list for disclosures: https://oss-security.openwall.org/wiki/mailing-lists/distros This random blogpost from 2022 serves as a proof that disclosing kernel vulnerabilities to the distros list is a well-k…

It is literally not the vulnerability researcher's problem to solve or address this.

Brother, it is a simple email to a mailing list.

They are professional security researchers, they must know this is the way it is done in the ecosystem.

Kicking the can around leads nowhere.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#459

Post by [deleted] »

zamalek wrote: post #384
tptacek wrote: post #343

Earlier quoted context omitted.

There is no such thing as "the responsible disclosure protocol". There's really no such thing as "responsible disclosure" at all, but "the responsible disclosure protocol" is a term I have literally never heard before. (I've been a vulnerability researcher since the mid-1990s, for what it's worth.)

https://en.wikipedia.org/wiki/Coordinated_vulnerability_disc... > In computer security, coordinated vulnerability disclosure (CVD, sometimes known as responsible disclosure) I guess you can learn something new after 36 years. If you are referring to what you quoted, your pedantry and sharpshooting would result in an incomplete English sentence: "that's why we have the responsible disclosure" is missing a noun. Now th…

[deleted]

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#460

Post by OvervCW »

kasey_junk wrote: post #452
nextlevelwizard wrote: post #449

Earlier quoted context omitted.

That is just being pedantic. Why did they absolutely need to release this into the wild now? Why couldn’t they have waited? “30 days should be enough time” why? Why is 30 days a magic number? Especially in open source. Yeah it isn’t the researchers problem to tell every distributor of the kernel about the fix or verify that everyone has the fix, but fuck maybe wait until at least someone has the fix and maybe don’t d…

They didn’t release anything into the wild. It existed. The irresponsible thing would be letting it keep existing without telling anyone.

You cannot deny that telling the entire world about this vulnerability before it is patched won't cause a lot of abuse that would not have happened otherwise.
Post reply on HN