Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

For Linux kernel vulnerabilities, there is no heads-up to distributions

openwall.com

Post reply on HN
Print view View original

551–560 of 578 posts

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#551

Post by akerl_ »

Ukv wrote: post #548
akerl_ wrote: post #547

Earlier quoted context omitted.

I’m saying it doesn’t matter how innocuous you try to make the patch when there are known bad actors directly evaluating every commit for “so did this close a vuln”, using both AI and human expertise. This is true no matter what, but the comment I’m replying to was also pitching that maintainers actively call out that the patch includes a high sev security fix: > for kernel maintainers to announce when a version cont…

I'm suggesting that less information about the vulnerability could be circulated than the current process, not more, due to distro maintainers being able to trust just "version X contains a fix for a high-impact security vulnerability" coming from a kernel maintainer - whereas they'll need some information/proof of that claim when coming from an outsider.

The information exposed in the current process was: code changes in the git commits and a commit message that did not mention the vulnerability.

In the current model, attackers are actively looking at all commits as potential vulnerabilities, regardless of what anybody says or doesn’t say about them.

You can’t make the commits not exist, or not be visible, because that’s a core part of how the kernel is developed and released.

So anything you do with notifications to distro maintainers about the vuln, or the existence of a vuln, or a nudge to patch with no context, or whatever, is totally irrelevant and does not change the calculus: the moment the fix is committed, bad actors who were not already aware notice it.

This is, of course, to say nothing of bad actors who had already found the vulnerability on their own.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#552

Post by akerl_ »

i_think_so wrote: post #545
akerl_ wrote: post #485

Earlier quoted context omitted.

How many people do you let have local code execution on your systems? This is a local privilege escalation. They are relatively common. They are a big deal if you run a system that lets multiple untrusted users commingle code on a shared operating system. Otherwise it’s not.

Unless your systems have no network devices this vuln provides a tasty reward for being able to get any kind of RCE into your box. Most of the systems I care about are not air gapped. I don't imagine many others are either. It's an LPE that goes back years . It affects at least 3 generations of Debian servers. >5 years of some rolling distros. And instead of the kernel team telling the distro security guys ahead of t…

In a story that includes an RCE, you basically just assume LPE. The LPE isn’t a reward, it’s just table stakes. It’s the RCE that would be noteworthy.

Your assessment of the impact of this vulnerability is just wrong, and your level of panic about a “feeding frenzy” affecting anybody outside of hosted services where multiple users share a kernel is also wrong.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#553

Post by eschaton »

tptacek wrote: post #480
eschaton wrote: post #400

Earlier quoted context omitted.

There are more than just good guys and bad guys; in particular, there are also opportunists. Opportunists are the ones who will sell a 0day to bad guys. Or who will drop a 0day publicly to promote their services. And they’ll fight tooth and nail against any actual legal obligation to engage in responsible and coordinated disclosure, because they make more money without that.

Seems like a classification you just made up to navigate a message board debate: the category that equates commercial vulnerability research for security products and people who sell zero-day vulnerabilities to bad guys.

People who sell zero-day vulnerabilities currently sell to both good guys and bad guys, they’re a third thing (mercenaries). However, that third thing is also bad, just a different kind of bad than what you’re calling “bad guys.”

The people selling weapons to the Taliban aren’t bad in the same way the Taliban are; one is bad for ideological reasons, the other is bad for enabling bad actors, even if they also sell to the good guys.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#554

Post by bonzini »

nickitolas wrote: post #549
bonzini wrote: post #337

Earlier quoted context omitted.

> they don't believe that vulnerabilities conceptually make sense That's exactly what I wrote: "they have a strong belief that all kernel bugs are vulnerabilities and all vulnerabilities are just bugs; sometimes taken to the extreme in both ways". But there is also a question of bandwidth. If a maintainer asks to bring a specific vulnerability to distros-list, the kernel security people will be reasonable. I did it l…

How does that square with this comment from greg from today? https://www.openwall.com/lists/oss-security/2026/05/01/3 (About heads up to distros) > Nope, sorry, we are NOT allowed to notify anyone about anything "ahead of time" otherwise we will have to tell everyone about everything. That's the only policy by which all the legal/governmental agencies have agreed to allow us to operate in, so we are stuck with it.

I don't know, this is the one that I mentioned:

https://www.openwall.com/lists/oss-security/2026/03/30/5

You can see my name under "Timeline", I asked kindly for both distros-list and a longer embargo than usual and got them.

I guess Greg is not allowed to notify distros-list, but someone else is?

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#555

Post by nextlevelwizard »

kasey_junk wrote: post #452
nextlevelwizard wrote: post #449

Earlier quoted context omitted.

That is just being pedantic. Why did they absolutely need to release this into the wild now? Why couldn’t they have waited? “30 days should be enough time” why? Why is 30 days a magic number? Especially in open source. Yeah it isn’t the researchers problem to tell every distributor of the kernel about the fix or verify that everyone has the fix, but fuck maybe wait until at least someone has the fix and maybe don’t d…

They didn’t release anything into the wild. It existed. The irresponsible thing would be letting it keep existing without telling anyone.

So why not just tell immediately on discovery? After all every flaw exists already so what’s the difference?

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#556

Post by i_think_so »

tptacek wrote: post #518
i_think_so wrote: post #486

Earlier quoted context omitted.

Oh come on, you know what I'm saying. It's small when written in python, which means any skid can spew it into a server he's got a shell on and get root in 2 seconds. He doesn't need to hope there's already a compiler installed, nor does he need to download some big tool. Just: cat | python3 && su , Ctrl-D And I'm sure it can be refined into something much more likable to the spooky types, if they haven't already don…

This is such a 1996 argument. It really was a big deal back then whether you had compilers on your multiuser SunOS boxes, because attackers would then use them to compile exploit.c. The whole thread, really bringing me back to comp.security.unix. I'm not complaining! I miss comp.security.unix.

[flagged]

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#557

Post by robocat »

SCHiM wrote: post #408
robocat wrote: post #399

Earlier quoted context omitted.

> terms of our responsible disclosure policy I couldn't find a public copy of that. The best starting point I found for reporting vulnerabilities was: https://github.com/microsoft/MSRC-Security-Research/security... You can email without agreeing to anything. But for a serious issue Microsoft would obviously try and track down who you are and what jurisdiction you are in.

https://www.microsoft.com/en-us/msrc/bounty-guidelines > MICROSOFT BOUNTY TERMS & CONDITIONS > Last updated: July 23, 2025 > The Microsoft Bug Bounty Programs Terms and Conditions ("Terms") cover your participation in the Microsoft Bug Bounty Program (the "Program"). These Terms are between you and Microsoft Corporation ("Microsoft," "us" or "we"). By submitting any vulnerabilities to Microsoft or otherwise participa…

Sure - that's a bug bounty - which is opt-in.

You said "There is actually no way to give them a friendly heads up, and then do your own thing. The only way not to be bound is by not sending them any notification at all..."

So what you said is wrong, right.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#558

Post by SCHiM »

robocat wrote: post #557
SCHiM wrote: post #408

Earlier quoted context omitted.

https://www.microsoft.com/en-us/msrc/bounty-guidelines > MICROSOFT BOUNTY TERMS & CONDITIONS > Last updated: July 23, 2025 > The Microsoft Bug Bounty Programs Terms and Conditions ("Terms") cover your participation in the Microsoft Bug Bounty Program (the "Program"). These Terms are between you and Microsoft Corporation ("Microsoft," "us" or "we"). By submitting any vulnerabilities to Microsoft or otherwise participa…

Sure - that's a bug bounty - which is opt-in. You said "There is actually no way to give them a friendly heads up, and then do your own thing. The only way not to be bound is by not sending them any notification at all..." So what you said is wrong, right.

Maybe you're right. I just find it confusing. The language is all-encompassing, doesn't read opt-in to me if taken literally: "By submitting any vulnerabilities to Microsoft". And I found no other pages describing "report in such and such way to have these terms apply instead". But I always have problems with this stuff, perhaps taking it too seriously.

Obviously they can write whatever they want in their policy documents. The thing is, sometimes this is about larger sums of money, or someones reputation, which may or may not actually lead to steps. That is in contrast with whatever TOS/EULA in account signups for some service or whatever, this feels more serious. I've seen some people getting harried after publishing something that fell _outside_ the servicing boundaries. Getting tangled up in whatever is already a loss in my book, even if you "win" in the end.

Note that that policy is also where they set out the safe-harbor conditions, which, according to my read, is tied to the bounty policy and not RD/CVD policy. The RD/CVD page itself specifies no such thing, so I relate them.

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#559

Post by kasey_junk »

nextlevelwizard wrote: post #555
kasey_junk wrote: post #452

Earlier quoted context omitted.

They didn’t release anything into the wild. It existed. The irresponsible thing would be letting it keep existing without telling anyone.

So why not just tell immediately on discovery? After all every flaw exists already so what’s the difference?

That would have been fine too?

Re: For Linux kernel vulnerabilities, there is no heads-up to distributions

#560

Post by staticassertion »

SiempreViernes wrote: post #530
staticassertion wrote: post #439

Earlier quoted context omitted.

http://www.kroah.com/log/blog/2026/02/16/linux-cve-assignmen... I'd start with Greg's own words. You can probably find more on it from Spender/grsecurity's blog.

The claims you make upthread are very hard to match with the text you link to, did you past the wrong URL?

No, that's the correct URL.
Post reply on HN