3 ms·
Shame but understandable. io_uring (like netlink) is essentially a completely new interface to kernel-land things so until security boundary stuff is sorted out
by jpgvm 3y ago
Shame but understandable. io_uring (like netlink) is essentially a completely new interface to kernel-land things so until security boundary stuff is sorted out this is probably the best move.
- hedora 3y agoNo. It was completely new a few years ago, and they’re running kernels from three years ago that are missing security patches from two years ago.
- sirdarckcat 3y ago[citation needed] * ChromeOS, COS and Android are opensource, and they are all up to date. Mind elaborating?
- bewaretheirs 3y agoWith respect to Android, I was under the impression that (in part because key members of the Linux community are allergic to the notion of a stable device driver ABI) the specific release of linux used on a particular model of phone was typically frozen at some point before the time the phone shipped, and subsequently only patched as needed. The mere fact that the source is available doesn't mean that someone will take the (potentially unbounded) time to port it to a future release and test it sufficiently.
- viraptor 3y agoI'd like to see a source for this. Even if they do run older kennels, it doesn't mean they're missing patches. Google has significant involvement in security and enough engineers to roll their own systems. I don't expect they'd be missing any relevant patches, much less for years. (I know this was an older patch in this case, but they did mention other mitigations, so it may have been a considered choice not to backport) Given how large they are as a target, we'd also hear about them being exploited all the time if that was true.
- greesil 3y agoLinus?
- jsiepkes 3y agoThere is a steady stream of security issues with io_uring since its inception. You can find security issues less then 3 months old for it [1]. [1] https://seclists.org/oss-sec/2023/q2/135 https://seclists.org/oss-sec/2023/q2/135
- compiler-guy 3y agoGoogle actively patches all its kernels and keeps them pretty up to date. The problem isn't the vulnerabilities Google or the public knows about, its the ones it doesn't know about, and the rate of discovery is too high for io_uring to be used in certain situations. "As such, io_uring continues to be actively developed, but it is still affected by severe vulnerabilities and also provides strong exploitation primitives."
- summerlight 3y agoAt least for my workstation, it doesn't seem so? The kernel is only 2 month ago, and I tend to postpone my OS update to the very last moment unless it's forced. I'm pretty sure that the production even got much more frequent updates.
- ajross 3y ago> [Google is] running kernels from three years ago that are missing security patches from two years ago. This is ridiculous. No, they aren't. No one is. Kernels on production Linux devices[1] are cut from an LTS branch and get prompt and expertly audited security backports of everything anyone knows about. Now, sure, that process does break down occasionally; but this is an area being shepherded by some of the best engineering effort in the world. In fact I'd go so far as to say a regularly updated LTS kernel is probably the software product that is most responsive to security issues. [1] All the ones I know about anyway. Surely there are some gadgets being less prudent, but Android and ChromeOS are absolutely not on the list.