news.volyx.in

For Linux kernel vulnerabilities, there is no heads-up to distributions (openwall.com)

601 points by ori_b · 122 days ago · 548 comments on HN

Article summary

A Linux kernel vulnerability, known as CopyFail, has been disclosed, allowing for local privilege escalation. The vulnerability was introduced in 2017 and has been fixed in recent kernel versions, but older versions remain affected. The Linux kernel security team does not notify distributions of vulnerabilities ahead of time, leaving it up to the reporter to handle disclosure. This has led to concerns about the potential impact on shared hosting providers and other users of affected systems.

Main themes

  • Linux kernel vulnerabilities
  • Disclosure policies
  • Kernel security team
  • Distribution notification
  • Shared hosting security
  • Container escape

What commenters say

  • The Linux kernel security team's policy of not notifying distributions of vulnerabilities ahead of time is problematic and can lead to widespread exploitation.
  • The disclosure of the vulnerability and exploit before patches were available for all distributions was irresponsible and potentially harmful.
  • The use of containers does not provide sufficient protection against this vulnerability, as it can be used to escape from one container to another.
  • The kernel security team's stance on vulnerabilities is that all kernel bugs are vulnerabilities and all vulnerabilities are just bugs, which can lead to a lack of urgency in addressing security issues.
  • The decision to disclose vulnerabilities publicly without prior notification to distributions can be motivated by a desire to advertise one's own company or products.
  • Patches for the vulnerability have been available for some time, but many distributions have not yet made them available to their users, leaving them vulnerable to exploitation.
  • The vulnerability is not as severe as it could be, since it is a local vulnerability and many users do not allow untrusted users to log in to their systems.
  • The lack of communication between the kernel security team and distribution maintainers can lead to delays in patching vulnerabilities and increased risk to users.