Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

For Linux kernel vulnerabilities, there is no heads-up to distributions

openwall.com

Post reply on HN
Print view View original

471–480 of 578 posts

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#471

Post by i_think_so »

walletdrainer wrote: post #437
i_think_so wrote: post #417

Earlier quoted context omitted.

> This vulnerability is, for some threat models, a really big deal. This vulnerability is, for other threat models, a death sentence. > A security group found the vulnerability. They disclosed it. It was patched. It was patched only after some people who should have been notified well in advance happened to notice something was up. That is NOT HOW IT'S SUPPOSED TO WORK. For as long as the unpatched window remains ope…

> This vuln is a digital magic wand that is trivially usable to cast Avada Kedavra and somebody neglected to tell 99.99% of the Good Guys about it. A Linux LPE is a nothingburger unless you’re relying on the Linux kernel to enforce internal security boundaries, which would simply be foolish.

The PoC exploit code in python (3.10+) fits comfortably in 1k bytes. An unminified version that works for even older versions of python is just a hair under a 1500 byte packet payload, modulo headers for your preferred method of delivery. I can only guess how much it could be shrunk down to only the shellcode.

Now, y'all tell me, since I'm not a web guy. How hard is it going to be to tweak this lovely little pathogen into some kind of browser exploit? It just needs to be combined with a sandbox escape to work on current versions, right? Difficult but quite worth investing the time and effort to develop if that's your line of business. If that happens, every at-risk Tails user is going to have to stay offline for a while, unless they want to play the drone lottery.

Or how about chaining it with any of the as-yet unpatched bugs in gawd-only-knows how many web services out there that have poor input sanitization code? That bug now graduates from a DoS crash causer to a root grab. Good luck stopping it with your fancy AI Behavioral Analysis security tools. They better be fast. The sploit is going to do its work in two packets, maybe three. Fun times.

Lucky for us systems monkeys, it's not like anybody is spending billions of dollars to develop vuln finding AI tools right at this very second. So there shouldn't be many unpatched web services holes.

Oh, wait.

Of course, as the grey hats can already tell you, the really delicious part of this thing is how it's going to become the LPE tool of first resort for any APT that's already inside ur base killin ur doodz.

Nothingburger? This nothingburger is going to root a million OS instances before we know what hit us.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#472

Post by akerl_ »

OvervCW wrote: post #460
kasey_junk wrote: post #452

Earlier quoted context omitted.

They didn’t release anything into the wild. It existed. The irresponsible thing would be letting it keep existing without telling anyone.

You cannot deny that telling the entire world about this vulnerability before it is patched won't cause a lot of abuse that would not have happened otherwise.

Why not?

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#473

Post by komali2 »

Brian_K_White wrote: post #450
komali2 wrote: post #448

Earlier quoted context omitted.

I don't feel like I'm complaining, I feel like I'm asking how else someone would frame it without leaning on the concepts mentioned. What changes about the dynamic then?

But what does that mean? "owe" is just shorthand for the concept of obligation. For someone to do something, they need a reason to do it. It doesn't have to be a transaction but there does need to be some reason. If no one is doing a task you want done because they aren't obligated to, then you seek some other reason besides obligation. Ok, what then? Do you imagine say a dating website where people compete to look a…

> For someone to do something, they need a reason to do it. It doesn't have to be a transaction but there does need to be some reason.

Exactly! That's what I'm interested in exploring.

> If no one is doing a task you want done because they aren't obligated to, then you seek some other reason besides obligation. Ok, what then?

That's what I love exploring. Action with no obligation. Have you any examples of that in your life? Nobody obligates me to do the long walks I enjoy where I stick a 360 camera on my head and then upload the footage to Mapillary and other open platforms, I just like to do it, and I want to find other things that I'm motivated to do without obligation, and I'm fascinated by things people do for "no reason." Understanding human motivation is really important to me for some reason.

As to "what then," yes what then? If I run a cashless commune, how do we make sure the toilets get cleaned? That's the whole question, and I love exploring it. If you'd like to experience it yourself, you could always try attending a regional Burn for a bit of a micro version of it, people doing things just for the sake of it.

I'm sorry, I don't quite understand what you mean by the dating app thing.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#474

Post by akerl_ »

i_think_so wrote: post #471
walletdrainer wrote: post #437

Earlier quoted context omitted.

> This vuln is a digital magic wand that is trivially usable to cast Avada Kedavra and somebody neglected to tell 99.99% of the Good Guys about it. A Linux LPE is a nothingburger unless you’re relying on the Linux kernel to enforce internal security boundaries, which would simply be foolish.

The PoC exploit code in python (3.10+) fits comfortably in 1k bytes. An unminified version that works for even older versions of python is just a hair under a 1500 byte packet payload, modulo headers for your preferred method of delivery. I can only guess how much it could be shrunk down to only the shellcode. Now, y'all tell me, since I'm not a web guy. How hard is it going to be to tweak this lovely little pathogen…

I think you’re reading a ton into this vulnerability that is not there.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#475

Post by akerl_ »

nchmy wrote: post #457
akerl_ wrote: post #389

Earlier quoted context omitted.

It seems odd to call me utterly miserable and then suggest I’m not communicating in good faith. We don’t have to agree, but the site rules are pretty clear that swipes like that aren’t ok. That kind of distro maintainers and kernel devs communication path already exists: the linux-distros@ mailing list. But since anybody can read it, posting “hey everybody, this is a security patch” has basically the same effect as t…

The person I was defending NEVER suggested that extra burden should be put on anyone. Just that there ought to be some system (even if imperfect)to make it easy for everyone (or, if not everyone, at least a select group - eg the main distros). But you and others kept saying that they were trying to put burden on various parties. That's the poor faith.

How do you get a system without somebody (or multiple somebodies) being responsible for it?

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#476

Post by JeremyNT »

john_strinlai wrote: post #287
dweinus wrote: post #271

Earlier quoted context omitted.

The reporter clearly knows the distro fixes have not been shipped, read their report. They chose to disclose anyway.

> They chose to disclose anyway. yes, because 30 days had passed from the time the patch landed in the kernel, as per industry standard. approximately every security researcher, including the likes of google and other big names you may know, does a 90+30 disclosure, which is what happened here. they do this for good reason, which has been figured out over decades of experience in reporting thousands and thousands of…

What do you think went differently in this case versus other high profile vulnerabilities that had binaries already available for major distros? I feel like it often (usually?) works out that major distros have kernel packages incorporating the fixes already available.

Is this just down to luck, a quirk in the timing about when Linus merged the fix versus when the release gets cut?

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#477

Post by tptacek »

i_think_so wrote: post #471
walletdrainer wrote: post #437

Earlier quoted context omitted.

> This vuln is a digital magic wand that is trivially usable to cast Avada Kedavra and somebody neglected to tell 99.99% of the Good Guys about it. A Linux LPE is a nothingburger unless you’re relying on the Linux kernel to enforce internal security boundaries, which would simply be foolish.

The PoC exploit code in python (3.10+) fits comfortably in 1k bytes. An unminified version that works for even older versions of python is just a hair under a 1500 byte packet payload, modulo headers for your preferred method of delivery. I can only guess how much it could be shrunk down to only the shellcode. Now, y'all tell me, since I'm not a web guy. How hard is it going to be to tweak this lovely little pathogen…

You're freaking out about the exploit being written in Python and occupying only a small number of bytes. Are you the LLM that wrote Xint's terrible landing page? If so, I have questions.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#478

Post by tptacek »

fweimer wrote: post #424
tptacek wrote: post #275

Earlier quoted context omitted.

It is literally not the vulnerability researcher's problem to solve or address this.

If you just want to get a bug fixed that annoys you, it's of course out of scope. If researchers want to showcase their ability (either individually or as an organization) to identify and address security vulnerabilities in complex multi-stakeholder environments, I very much expect them to figure this out. After all, it doesn't make much sense if a company, after commissioning a security review, needs to hire a diffe…

I think they want to showcase their ability to unearth zero-day vulnerabilities. The multi-stakeholder stuff not so much.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#479

Post by kjs3 »

sirl1on wrote: post #367
PearlRiver wrote: post #341

Earlier quoted context omitted.

The real advantage of Microsoft is that there is someone you can sue! Linux like every open source project is just a bunch of people who are YOLOing it. Not something you use for your fortune 500 critical mission infrastructure.

I thought this is why red has exists?

Only if you are paying them. If you don't have a service contract for RHEL, you have no grounds to sue.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#480

Post by tptacek »

eschaton wrote: post #400
tptacek wrote: post #255

Earlier quoted context omitted.

Again: I made the actual distinction between bad guys and good guys clear. Good guys don't become bad guys simply because kernel security is an inconvenience to you.

There are more than just good guys and bad guys; in particular, there are also opportunists. Opportunists are the ones who will sell a 0day to bad guys. Or who will drop a 0day publicly to promote their services. And they’ll fight tooth and nail against any actual legal obligation to engage in responsible and coordinated disclosure, because they make more money without that.

Seems like a classification you just made up to navigate a message board debate: the category that equates commercial vulnerability research for security products and people who sell zero-day vulnerabilities to bad guys.
Post reply on HN