4 ms·
From their perspective, on their project, with the constraints they operate under, bugs are just bugs. You're free to operationalize some other taxonomy of bugs
by tptacek 11mo ago
From their perspective, on their project, with the constraints they operate under, bugs are just bugs. You're free to operationalize some other taxonomy of bugs in your organization; I certainly wouldn't run with "bugs are just bugs" in mine (security bugs are distinctive in that they're paired implicitly with adversaries).
To complicate matters further, it's not as if you could rely on any more "sophisticated" taxonomy from the Linux kernel team, because they're not the originators of most Linux kernel security findings, and not all the actual originators are benevolent.
- rwmj 11mo agoFor sure, but you don't need to file CVEs for every regular bug.
- Skunkleton 11mo agoIn the context of the kernel, it’s hard to say when that’s true. It’s very easy to fix some bug that resulted in a kernel crash without considering that it could possibly be part of some complex exploit chain. Basically any bug could be considered a security bug.
- SSLy 11mo agoplainly, crash = DoS = security issue = CVE. QED.
- deleted 11mo ago[deleted]
- michaelt 11mo agoBRB, raising a CVE complaining the OOM killer exists.
- pamcake 11mo agoMemory leaks are usually (accurately) treated as DoS. OoM killer is a mitigation to contain them and not DoS the entire OS.
- worthless-trash 11mo agoI could be wrong. But operation by design isn't considered a bug.
- samus 11mo agoIt is if some other condition is violated that is more important. Then the design might have to be reconsidered.
- suspended_state 11mo agoIf it is faulty, then it's not a bug, it's a flaw.
- lfllfkddl 11mo agoIt is possible to design a security vulnerability.
- worthless-trash 10mo agoOh, now that is an exciting area.
- SSLy 11mo agoyou either get OOMed or next malloc fails and that's also going to wreck havoc
- JCattheATM 11mo ago> From their perspective, on their project, with the constraints they operate under, bugs are just bugs. That's a pretty poor justification. Their perspective is wrong, and their constraints don't prevent them from treating security bugs differently as they should.
- ada0000 11mo ago> almost any bugfix at the level of an operating system kernel can be a “security issue” given the issues involved (memory leaks, denial of service, information leaks, etc.) On the level of the Linux kernel, this does seem convincing. There is no shared user space on Linux where you know how each component will react/recover in the face of unexpected kernel behaviour, and no SKUs targeting specific use cases in which e.g. a denial of service might be a worse issue than on desktop. I guess CVEs provide some of this classification, but they seem to cause drama amongst kernel people.
- samus 11mo agoYou have a pretty strongly worded stance, but you don't provide an argument for it. May I suggest you detail why exactly you think their perspective is wrong, apart from "a lot of problems in the past could have been avoided"?
- JCattheATM 11mo agoMy view here isn't uncommon, even if it's a minority view. I've noticed a lot of people tend to just defend and adopt the stances of projects they like or use without necessarily thinking things through, and I assume that's at least partly the case here. There's been a lot of criticism written on the kernel devs stance over the last, what, 20 years? One obvious problem is that without giving security bugs, i.e. vulnerabilities priority, systems stay vulnerable until the bug gets patched at whatever place in the queue it happens to be at.