Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

For Linux kernel vulnerabilities, there is no heads-up to distributions

openwall.com

Post reply on HN
Print view View original

521–530 of 578 posts

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#521

Post by tptacek »

paulnpace wrote: post #511
john_strinlai wrote: post #500

Earlier quoted context omitted.

> distributions could have done _something_ to protect their users prior to publication date. yeah, distributions could be following the kernel updates more closely and they would have been patched prior to publication. mainline was patched 30 days before publication. it is not the reporter's responsibility to babysit the linux distributions.

And here, with this comment, we see how the overall system functions: nobody actually cares what is going on with anything outside of themselves. It is a large group of individualized nihilists with total disregard to everyone, and you will provide lengthy justifications to maintain this system, as is.

It is a large group of people with their own incentives, and you're surprised they aren't self-organizing (or accepting outside pressure) to align with your own incentives.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#522

Post by bragr »

tremon wrote: post #294
bragr wrote: post #210

Earlier quoted context omitted.

The problem is that if you make too big of a deal about a particular patch, then someone just reverse engineers the vuln from the fix and your responsible disclosure period doesn't exist anymore. Gentoo has to take some blame too for not keeping all the kernels they maintain patched in a timely way.

> Gentoo has to take some blame too for not keeping all the kernels they maintain patched in a timely way. How do you figure that? From what I could tell from the earlier post, the fix has only been backported to 6.18 and later, and as TFA indicates the distro's were not informed of the security implications of this fix. All distro's shipping a major kernel version from more than a year ago -- and that includes all L…

>All distro's shipping a major kernel version from more than a year ago -- and that includes all LTS kernels -- are vulnerable, regardless of how "timely" their patch schedules follow upstream

To be fair, I question the wisdom of managing kernels like that across all distros.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#523

Post by akerl_ »

paulnpace wrote: post #511
john_strinlai wrote: post #500

Earlier quoted context omitted.

> distributions could have done _something_ to protect their users prior to publication date. yeah, distributions could be following the kernel updates more closely and they would have been patched prior to publication. mainline was patched 30 days before publication. it is not the reporter's responsibility to babysit the linux distributions.

And here, with this comment, we see how the overall system functions: nobody actually cares what is going on with anything outside of themselves. It is a large group of individualized nihilists with total disregard to everyone, and you will provide lengthy justifications to maintain this system, as is.

Ah yes, all those nihilists spending their spare time volunteering as developers and maintainers of open source projects.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#524

Post by Lammy »

danparsonson wrote: post #515
Lammy wrote: post #326

Earlier quoted context omitted.

You can't bully me into agreeing with you. Why are you struggling with that?

That was my first comment in the thread. I'm not bullying you; if you don't want people to challenge your statements then you came to the wrong place ;-)

You are engaging in bad faith when you act like I only have the belief I have because I don't understand yours yet. Don't comment if you can't respect somebody disagreeing with you.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#525

Post by akerl_ »

Ukv wrote: post #428
__bjoernd wrote: post #410

Earlier quoted context omitted.

If they get enough time to build a website with a fancy logo instead, one might however question where their priorities are.

I'd imagine it's not that they lacked the time to email linux-distros, but that they were unaware they were supposed to do so. Feels like the more sensible process would be for kernel maintainers to announce when a version contains a fix for a high-impact security vulnerability and for distro maintainers to pay attention to that. Could be done without revealing what the vulnerability actually is in most cases, trusti…

> Could be done without revealing what the vulnerability actually is in most cases

No it can’t. The bad actors that should actually worry most people are actively combing through commits on mainstream codebases, using a combination of automation/AI and manual review to pluck vulns out by their remediations.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#526

Post by john_strinlai »

zamalek wrote: post #509
akerl_ wrote: post #505

Earlier quoted context omitted.

Is that a rule? Are there rules? These researchers found a vulnerability in the Linux kernel. They could have just written a blog post and put it online, or not told anybody, or sold it. But instead they decided to tell the Linux kernel devs, and give them time to act before publishing. And your beef is that you’ve decided they needed to also inform individual downstream projects that use the Linux kernel? Why? Which…

> Is that a rule? No, it's commonly followed practice: https://en.wikipedia.org/wiki/Coordinated_vulnerability_disc... I'm all for lighting a fire under the developer's ass, but we live in an imperfect world and the biggest problem that we have is end-users. We may have applied the mitigation on day 0, and updated as soon as the kernel landed in our distro - and if some of us didn't then we've even got savvy users in…

>For reference, the standard is 30 for the developer to fix and 90 for it to land on machines

no, the standard is 90 days from notification or 30 days from the patch date, typically whichever is sooner.

e.g.

    > If a vendor patches a security issue 47 days after Project Zero notified 
    > the vendor about the vulnerability, details would be made public on day 77.

    > If a vendor patches a security issue 83 days after Project Zero notified 
    > the vendor about the vulnerability, details would be made public on day 113.
please also note that you are blindly quoting wikipedia articles at people who either currently work in security research, or used to work in security research. while we are not infallible, you should perhaps consider that we at least have real life experience dealing with vulnerability disclosure processes, and arent just learning about them today from wikipedia. when a room full of experienced professionals are telling you that you are misunderstanding something, that is a sign to step back for a second and maybe reconsider your position.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#527

Post by john_strinlai »

paulnpace wrote: post #511
john_strinlai wrote: post #500

Earlier quoted context omitted.

> distributions could have done _something_ to protect their users prior to publication date. yeah, distributions could be following the kernel updates more closely and they would have been patched prior to publication. mainline was patched 30 days before publication. it is not the reporter's responsibility to babysit the linux distributions.

And here, with this comment, we see how the overall system functions: nobody actually cares what is going on with anything outside of themselves. It is a large group of individualized nihilists with total disregard to everyone, and you will provide lengthy justifications to maintain this system, as is.

>nobody actually cares what is going on with anything outside of themselves.

"not caring" would be not disclosing the vulnerability at all, and instead selling it to the highest bidder on one of the private markets

which, given the ridiculous and undeserved lashings the researchers are receiving from people completely outside of the security ecosystem, i would not be surprised if they moved in that direction. they would certainly make more money.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#528

Post by tptacek »

john_strinlai wrote: post #526
zamalek wrote: post #509

Earlier quoted context omitted.

> Is that a rule? No, it's commonly followed practice: https://en.wikipedia.org/wiki/Coordinated_vulnerability_disc... I'm all for lighting a fire under the developer's ass, but we live in an imperfect world and the biggest problem that we have is end-users. We may have applied the mitigation on day 0, and updated as soon as the kernel landed in our distro - and if some of us didn't then we've even got savvy users in…

> For reference, the standard is 30 for the developer to fix and 90 for it to land on machines no, the standard is 90 days from notification or 30 days from the patch date, typically whichever is sooner . e.g. > If a vendor patches a security issue 47 days after Project Zero notified > the vendor about the vulnerability, details would be made public on day 77. > If a vendor patches a security issue 83 days after Proj…

Hey! I still do SOME work in this space. :)

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#529

Post by john_strinlai »

tptacek wrote: post #528
john_strinlai wrote: post #526

Earlier quoted context omitted.

> For reference, the standard is 30 for the developer to fix and 90 for it to land on machines no, the standard is 90 days from notification or 30 days from the patch date, typically whichever is sooner . e.g. > If a vendor patches a security issue 47 days after Project Zero notified > the vendor about the vulnerability, details would be made public on day 77. > If a vendor patches a security issue 83 days after Proj…

Hey! I still do SOME work in this space. :)

haha, for the record, the "used to" was primarily referring to myself, who now teaches the next generation instead of practices! you are probably much more active in the space than i am now adays

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#530

Post by SiempreViernes »

staticassertion wrote: post #439
Hendrikto wrote: post #423

Earlier quoted context omitted.

I would like to read more about this. Do you have a source?

http://www.kroah.com/log/blog/2026/02/16/linux-cve-assignmen... I'd start with Greg's own words. You can probably find more on it from Spender/grsecurity's blog.

The claims you make upthread are very hard to match with the text you link to, did you past the wrong URL?
Post reply on HN