@joshbressers @wdormann @deftpunk @Viss What do you mean, they told us, we fixed it, it got in some stable kernels, and so our work on the security team was done. The CVE team assigned a CVE after a while, and even gave it a CVSS score.

The fact that no distro popped up that used older kernel versions to do the real work to backport to older kernels seems to be everyone's major problem here. That is outside of the kernel security team's work entirely. So take it up with the distros that people are paying support for to do this for them?

And yes, Debian was vulnerable, that is not good, and once it was noticed people worked hard and quickly to fix that. Not bad for a community-based distro that no one pays for in my opinion.

@joshbressers @deftpunk @wdormann @Viss Loads of them.

@wdormann @joshbressers @deftpunk @Viss Not ALL of the distros are on linux-distros. So that is one thing. The other being that I don't care what happens on linux-distros, for many public reasons I refuse to deal with them anymore, and strongly encourage no one else to do so either.

@joshbressers @deftpunk @wdormann @Viss Honestly, there was nothing "obvious" about this one being a "big one" compared to all of the bugs we get, and fix, on a daily/weekly basis in the kernel.

The ONLY thing different here from those bugfixes, was that someone made a web site, a simple reproducer, and announced it to the world. For 99.9% of the bugs we fix, that are reproducible like this, no one ever does that. That we know of...

In other words, this was just another Tuesday for us.

@deftpunk @joshbressers @wdormann @Viss no one did contact the kernel security team before they announced this. It was nice enough that they sent us a bug report and we got it fixed and pushed out to the latest stable kernel releases. That's all I can ever hope for.

A lot of people are apparently happily running a script clearly marked as a root exploit from some random website using curl | bash

Some do inspect the script, but then still run it using curl | bash anyway.

Incidentally, this very relevant blogpost about detecting curl | bash and serving different scripts based on that is almost exactly a decade old:
https://web.archive.org/web/20230318063325/https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-bash-server-side/

#CopyFail #InfoSec

@wdormann @joshbressers @Viss I love it how people think that "coordination of vulnerabilities" is actually something that can be done these days. Think of just who uses the software in question, and who should, and should not, be on such a list to get a "early disclosure notification".

As I have said for quite some time now, all early-disclosure lists are leaks, otherwise why would your government allow them to be in existence?

Software, and specifically open source software, runs the world. So should the whole world be on that notification list? :)

@claudex @icing @joshbressers @vathpela @haliphax That's what we do in the kernel today, it's a pretty straight mapping between the two.

@warthog9 @argv_minus_one There should be fixes out for "everyone", that is what I got working yesterday morning.

And yes, this is on the reporter, there's nothing the kernel security team, or kernel CNA can do differently here, sorry.

@argv_minus_one @jeroen @warthog9 How is this "too low", did the CVSS attributes get written wrong here? If so, please let us know and we will be glad to fix and update the record.

@joshbressers @vathpela @haliphax Sure, why not, CVEs for everyone!!!

@warthog9 @argv_minus_one Heck, this was even one of the very few CVE entries that we actually scored, giving it a 7.8 on the CVSS scale. We rarely score these things, but when we do, perhaps people should actually pay attention?

Makes me wonder why we even do this sometimes...

{sigh}

@warthog9 @argv_minus_one

I’d argue this not having a broader security push before the public release happened, is a pretty serious failure on someone’s part.

And who is that “someone”? We fix bugs like this in the kernel on a daily basis. If people have not learned to constantly upgrade to stay ahead of this, then why even assign these 10 CVEs a day in the first place? :)

@jeroen Don't trust the Mhz numbers, when the system is overloaded like that, it's hard to report what is actually happening. The load average is over 2000 so it's amazing anything is being reported properly.

Once again, my professional recommendation in response to the latest Linux kernel vulnerability in the news is that you should gather up all your electronic devices, cast them into the sea, and retreat to the woods.

Each night, gather your children and tell them tales of the Before Times when the hubris of humanity grew so large that we made idols of sand and spoke to them as equals. Remind them that the sand, of course, did not speak or think, but we imagined it could, and let it guide us to folly.

Should a stranger ever come to your village with a glowing rectangle, encourage the youth to beat them with sticks.

#infosec

My build system right now, as it's one of "those" mornings....

I was explaining how we built #bluefin with buildstream and bootc to a coworker and he goes.

"So you made Gentoo but cloud native."

And now I am never going to shut about it lol.

@qualcuno I don't remember, sorry. We got it as a gift many years ago.

@nklsdev As stated above, all of them!

@darakian All of them!