4 ms·

The patch delta for security fixes must get larger over time as these packages age further and further away from top of tree. I always wonder how many major vu

The patch delta for security fixes must get larger over time as these packages age further and further away from top of tree. I always wonder how many major vulnerabilities are introduced into these super old distros due to backporting bugs.

jtl999 6y ago
Documented cases don't seem to be common, but what comes to mind is the Debian "weak keys" scandal (2008), and the VLC "libeml" vulnerability (2019)[1] [1]: https://old.reddit.com/r/netsec/comments/ch86o6/vlc_security_issue/ https://old.reddit.com/r/netsec/comments/ch86o6/vlc_security...
- joana035 6y ago
  OpenSSL upstream was almost abandoned during those days. Software are always gonna have bugs, it's written by humans after all. The important thing is to acknowledge and work towards an ideal outcome.
- kasabali 6y ago
  Xweak keys" didn't have anything to do with backporting fixes to older versions. It was introduced into the version in sid at the time.
bonzini 6y ago
It's the opposite. Plenty of subsystems in the RHEL 8.3 kernel are basically on par with upstream 5.5 or so, as almost all the patches are backported. The source code is really the same to a large extent, and therefore security fixes apply straightforwardly.
- CoolGuySteve 6y ago
  That's great but what about all the other packages?
  - bonzini 6y ago
    The upstream for most other packages generally move much more slowly than the kernel. The fast ones (e.g. X11, systemd, QEMU) are typically rebased every other update or so (meaning, roughly once a year). It also helps that Red Hat employs a lot of core developers for those fast moving packages. :)
- Tom4hawk 6y ago
  So, why is RHEL not using the upstream kernel? It would allow them to avoid those issues with rust&go (and probably other software): https://news.ycombinator.com/item?id=25447752 https://news.ycombinator.com/item?id=25447752
  - waheoo 6y ago
    Security audit / certification would be my guess.
  - bonzini 6y ago
    RHEL maintains a stable ABI for drivers. Plus, there are changes (especially around memory management or scheduling) that are fiendishly hard to do regression testing on, so they are backported more selectively.

jtl999 6y ago

Documented cases don't seem to be common, but what comes to mind is the Debian "weak keys" scandal (2008), and the VLC "libeml" vulnerability (2019)[1] [1]: https://old.reddit.com/r/netsec/comments/ch86o6/vlc_security_issue/ https://old.reddit.com/r/netsec/comments/ch86o6/vlc_security...

joana035 6y ago
OpenSSL upstream was almost abandoned during those days. Software are always gonna have bugs, it's written by humans after all. The important thing is to acknowledge and work towards an ideal outcome.
kasabali 6y ago
Xweak keys" didn't have anything to do with backporting fixes to older versions. It was introduced into the version in sid at the time.

bonzini 6y ago

It's the opposite. Plenty of subsystems in the RHEL 8.3 kernel are basically on par with upstream 5.5 or so, as almost all the patches are backported. The source code is really the same to a large extent, and therefore security fixes apply straightforwardly.

CoolGuySteve 6y ago
That's great but what about all the other packages?
- bonzini 6y ago
  The upstream for most other packages generally move much more slowly than the kernel. The fast ones (e.g. X11, systemd, QEMU) are typically rebased every other update or so (meaning, roughly once a year). It also helps that Red Hat employs a lot of core developers for those fast moving packages. :)
Tom4hawk 6y ago
So, why is RHEL not using the upstream kernel? It would allow them to avoid those issues with rust&go (and probably other software): https://news.ycombinator.com/item?id=25447752 https://news.ycombinator.com/item?id=25447752
- waheoo 6y ago
  Security audit / certification would be my guess.
- bonzini 6y ago
  RHEL maintains a stable ABI for drivers. Plus, there are changes (especially around memory management or scheduling) that are fiendishly hard to do regression testing on, so they are backported more selectively.