6 ms·
Expecting people to do the right thing is a fundamental issue here. Why would you ever expect for all of vulnerabilities to be disclosed privately? There's very
by shimman 6mo ago
Expecting people to do the right thing is a fundamental issue here. Why would you ever expect for all of vulnerabilities to be disclosed privately? There's very little actual incentive to do this.
I'm honestly unaware of what systems could be put in place to prevent this but expecting people to always do the right thing is fantasy level thinking. I mean I bet the disclosers thought they were doing the right thing, hence why it's a bad thing to rely on.
edit: spelling/grammer.
- baggy_trough 6mo agoWhy wouldn't the linux security team notify the main linux distributions?
- deleted 6mo ago[deleted]
- bonzini 6mo agoPartly they already have enough on their plate. It's up to the reporter to pick how to handle the disclosure, and unless a specific maintainer chooses to handle it, the Linux security team clearly says they won't. Partly they have a strong belief that all kernel bugs are vulnerabilities and all vulnerabilities are just bugs; sometimes taken to the extreme in both ways (on one hand this case where the vulnerability is almost ignored; on the other hand, I saw cases where a VM panic that could be triggered only by a misbehaving host—which could just choose to stop executing the VM—was given a CVE).
- baggy_trough 6mo agoSeems a little crazy. Somebody should evaluate blast radius and do appropriate distro notifications in a case like this (I presume the impact was part of the disclosure, so not much extra work).
- seanhunter 6mo agoYou know the linux kernel is a free software project right? If you think “somebody should” do a thing but you aren’t prepared to do it yourself then you should maybe ask for a full refund.
- baggy_trough 6mo agoThank you very much, seanhunter. You hit the nail on the head there.
- bonzini 6mo agoNot really, because they made Linux a CNA specifically to own the process and distort it the way they want it to be.
- staticassertion 6mo agoThis couldn't be more backwards. This has literally nothing to do with bandwidth. The kernel is a CNA, they are explicitly the ones to do this. The reason they don't is because Linus and Greg have repeatedly, publicly stated that they don't want to because they don't believe that vulnerabilities conceptually make sense for the linux kernel and they refuse to engage in the process.
- bonzini 6mo ago> they don't believe that vulnerabilities conceptually make sense That's exactly what I wrote: "they have a strong belief that all kernel bugs are vulnerabilities and all vulnerabilities are just bugs; sometimes taken to the extreme in both ways". But there is also a question of bandwidth. If a maintainer asks to bring a specific vulnerability to distros-list, the kernel security people will be reasonable. I did it last March.
- nickitolas 6mo agoHow does that square with this comment from greg from today? https://www.openwall.com/lists/oss-security/2026/05/01/3 https://www.openwall.com/lists/oss-security/2026/05/01/3 (About heads up to distros) > Nope, sorry, we are NOT allowed to notify anyone about anything "ahead of time" otherwise we will have to tell everyone about everything. That's the only policy by which all the legal/governmental agencies have agreed to allow us to operate in, so we are stuck with it.
- staticassertion 6mo agoHe's full of shit lol
- bonzini 6mo agoI don't know, this is the one that I mentioned: https://www.openwall.com/lists/oss-security/2026/03/30/5 https://www.openwall.com/lists/oss-security/2026/03/30/5 You can see my name under "Timeline", I asked kindly for both distros-list and a longer embargo than usual and got them. I guess Greg is not allowed to notify distros-list, but someone else is?
- bluepuma77 6mo agoWell, how do you define main Linux distros? Isn’t the next smaller one not receiving the info always complaining?
- baggy_trough 6mo agoIsn't there already a distro security list for this purpose?
- staticassertion 6mo agoYes.
- throw0101a 6mo ago> Well, how do you define main Linux distros? Isn’t the next smaller one not receiving the info always complaining? For a first approximation: Ubuntu, Debian, RHEL(-derived) to begin with, and SuSE which is in EU/server space (AIUI): * https://commandlinux.com/statistics/most-popular-linux-distributions-market-share/ https://commandlinux.com/statistics/most-popular-linux-distr... * https://commandlinux.com/statistics/linux-server-market-share/ https://commandlinux.com/statistics/linux-server-market-shar... Seems like Gentoo, Arch, Mint, and Slackware could also be as well: * https://distrowatch.com/dwres.php?resource=major https://distrowatch.com/dwres.php?resource=major U/Deb/RHEL are 'upstream' of a lot of other projects, and fixes would trickle down to Rocky, Alma, etc. Perhaps VM OS in cloud (AWS, Azure) could be a usage gauge as well.
- shimman 6mo agoBecause one of them might have an incentive to not do so. In this case it's because they want to advertise their own company.
- staticassertion 6mo agoGreg and Linus do not believe in the entire concept of "vulnerabilities" in the Linux kernel and do not believe in the methods that distros use like cherry picking, therefor they typically are against issuing CVEs, scoring CVEs, describing vulnerabilities at all (if you use the word "vulnerability", your patch will be rejected), etc. It's fundamentally their position to not work the way that you describe.
- baggy_trough 6mo agoThat doesn't really seem to map onto the situation since Greg himself released a 6.12 with the patch earlier today.
- staticassertion 6mo agoI don't know what you mean at all. I'm just repeating known kernel policy here. What does 6.12 have to do with anything?
- baggy_trough 6mo agoWhat is your interpretation of why Greg KH released a version of 6.12 with this fix in it today, other than to help distributions avoid this vulnerability?
- staticassertion 6mo agoWhy would he ever... not release a new version? I don't get what you're trying to say - I'm stating Greg's explicit policy on the topic. If he did something outside of that policy, that wouldn't change anything.
- baggy_trough 6mo agoIf he doesn't believe in the "concept of vulnerabilities" then it is remarkable that he released a 6.12 targeted on this one fix. Why would he do that otherwise?
- holowoodman 6mo agoI can accept (and welcome) disclosure before there are patches. But publishing a working exploit together with the disclosure before patches are available is really really irresponsible, maybe even criminal. And no, the proposed mitigations don't help with half of the distributions out there...
- semiquaver 6mo agoPatches were available for nearly a month.
- ori_b 6mo agoBasic care would involve making sure the patches had made it into the wild before ending the embargo, and nagging the relevant parties if not. Edit: As of this writing, most distros including Redhat, Fedora, Debian Stable, do not have patches available in the package repos, though they're being actively worked on.
- semiquaver 6mo ago“Made it into the wild?” Patches landed a month ago. Should they also wait until my linksys router from 2018 has a patch ready?
- ori_b 6mo agoPatches are still in the process of landing in most major distros as of the time of this writing. Most users are not able to get an update through their distro's packaging mechanisms.
- SoftTalker 6mo agoIt's a local vulnerability at least. How many people do you let log in to your router? With the way linux is used these days, I'd guess the number of systems with untrusted local users is pretty limited. Even with shared hosting, you generally have root in your VM or container anyway. Unless this enables an escape from that? Still the risk that people who run "curl | bash" without care could get bitten, but usually its "curl | sudo bash" anyway...
- skywhopper 6mo agoI think it’s reasonable to expect folks in the security community who go to the trouble of creating a website detailing security vulnerabilities in specific listed software to pre-notify the security teams of that software. The CopyFail website calls out Ubuntu and Red Hat specifically, but apparently the author of the site did not inform them of the issue? But even if you think making unethical decisions in personal self interest is something no one should be criticized for, surely the Linux kernel team ought to have some process for notifying the top distributions of an upcoming LPE, just out of practicality.
- semiquaver 6mo agoIn what sense do you believe that the reporter did not notify the security team of the relevant software? The vulnerability is in the kernel. Reporter responsibly disclosed using the kernel’s security report mechanism and waited until a patch was ready. Distros are downstream of kernel, that doesn’t entitle them to expect to be contacted directly by every security reporter. That’s not on them. Distros that are big enough should be plugged into the linux security team for notifications. Security researchers cannot be held responsible for broken lines of communication within the org charts of projects that they study. They’re providing a valuable public service already, how much more do you want?
- ragall 6mo ago> that doesn’t entitle them to expect to be contacted directly by the reporter Yes it does. That's how it's always been done and distros can ship a fix well before it ends up in a kernel release.
- michaelmrose 6mo agoIt is suggested that they out of an abundance of caution and 5 or 6 emails. If this is entirely to much to expect we can always help them by mandating that they spend 6 figures annually meeting a much more robust set of requirements that will include notifying all possible affected parties down to Hannah Montana Linux devs if any still exist. Any strategy that assumes that the rest of the world is functional or makes you personally responsible for fixing all of it is equally broken but there is a reasonable middle ground and sending a few more emails lies within it
- dwedge 6mo agoWhen the exploit is an advertisement for an exploit detection company, not doing the right thing is a bad look
- dgellow 6mo agoThe worst thing would be to exploit or sell it for profit. Instead of that, publicizing the exploit is closer to neutral–good in my books, that did trigger a really quick reaction from the different actors to patch their kernels and systems
- ori_b 6mo agoImagine how much quicker the distros would have reacted if they were given a heads up a month ago. But, sure, I guess kudos to this company for not being actively criminal, and merely bumblingly incompetent and overly eager to get their marketing pitch out the door.
- x4132 6mo agoto which distros? how do you ensure fairness? Do you report this to the maintainer of Red Star OS (north korea)? The kernel security team was given the heads up a month ago. At that point it is their decision.
- manquer 6mo agoThere are channels like the distro security mailing list https://oss-security.openwall.org/wiki/mailing-lists/distros https://oss-security.openwall.org/wiki/mailing-lists/distros for this purpose.
- egonschiele 6mo agoWhy don't all these distro maintainers add their own back doors, and mine crypto off our machines without our knowledge? Surely, there is some legal fine print they can add that would let them do that. There is very little incentive for them to maintain these systems, given how thankless and underpaid the work is.
- hsbauauvhabzb 6mo agoMost distros are maintained by commercial companies.
- bossyTeacher 6mo ago> expecting people to always do the right thing is fantasy level thinking. Most people in tech think like the techie in this comic strip. https://xkcd.com/538/ https://xkcd.com/538/