3 ms·

I can accept (and welcome) disclosure before there are patches. But publishing a working exploit together with the disclosure before patches are available is r

I can accept (and welcome) disclosure before there are patches. But publishing a working exploit together with the disclosure before patches are available is really really irresponsible, maybe even criminal. And no, the proposed mitigations don't help with half of the distributions out there...

semiquaver 6mo ago
Patches were available for nearly a month.
- ori_b 6mo ago
  Basic care would involve making sure the patches had made it into the wild before ending the embargo, and nagging the relevant parties if not. Edit: As of this writing, most distros including Redhat, Fedora, Debian Stable, do not have patches available in the package repos, though they're being actively worked on.
  - semiquaver 6mo ago
    “Made it into the wild?” Patches landed a month ago. Should they also wait until my linksys router from 2018 has a patch ready?
    - ori_b 6mo ago
      Patches are still in the process of landing in most major distros as of the time of this writing. Most users are not able to get an update through their distro's packaging mechanisms.
    - SoftTalker 6mo ago
      It's a local vulnerability at least. How many people do you let log in to your router? With the way linux is used these days, I'd guess the number of systems with untrusted local users is pretty limited. Even with shared hosting, you generally have root in your VM or container anyway. Unless this enables an escape from that? Still the risk that people who run "curl | bash" without care could get bitten, but usually its "curl | sudo bash" anyway...
      - sgbeal 6mo ago
        > Even with shared hosting, you generally have root in your VM or container Lots of shared hosters don't use VMs or containers. It's some arbitrary number of people logging in to a shared system, each one with a home directory under /home/THE_USER_NAME. i've had several such hosters over the years (thankfully not right now, though).
      - michaelmrose 6mo ago
        Local root is part of the path to escaping
      - dist-epoch 6mo ago
        With this exploit it's trivial to jump from one container to another neighbor container. I've tried it and succeeded. So containers don't protect you, only a VM.
        SoftTalker 6mo ago
        So anyone pulling a malicious dockerfile jeopardizes the host? That would be bad...
        ori_b 6mo ago
        ...no shit? Why do you think people care about this issue?
        ranger_danger 6mo ago
        > I've tried it and succeeded. How so?
      - sjpb 6mo ago
        > With the way linux is used these days, I'd guess the number of systems with untrusted local users is pretty limited Things like HPC clusters are multiuser & don't entirely trust their users. If they did we wouldn't need users/groups/permissions etc in the first place.
  - sgjohnson 6mo ago
    Not true, if there’s any evidence of the exploit being used in the wild, it’s much more responsible to release immediately. Considering that the patches have been available for a while, someone surely reversed what they were for and was actually exploiting this in the wild. In the age of AI, I’d argue that “responsible disclosure” is dead. Arguably even in closed source projects. Just ask Claude to do a diff between the previous version and to see whether anything fixed in there could have had security implications. We’re not there yet, but very soon the only way to responsibly disclose a vulnerability will be immediately.
    - ori_b 6mo ago
      But they didn't release immediately -- they waited a month, but forgot to tell the distros, and forgot to check if waiting a month had actually lead to distros picking up the patches and shipping them.
      - sgjohnson 6mo ago
        Which just reinforces my point. The patch was available, therefore, where the exploit lies was also available. Linux kernel is one of the most audited open-source projects ever. I guarantee you that someone did reverse the patch. > but forgot to tell the distros Probably an oversight, but irrelevant. The bug was in the linux kernel. It's insane to suggest that they should have notified everyone shipping the linux kernel.
  - GrayShade 6mo ago
    Fedora is patched.
  - staticassertion 6mo ago
    That's mostly on Greg, a bit on the author.
- deleted 6mo ago
  [deleted]
- em-bee 6mo ago
  only for versions 6.19.12 & 6.18.22. older versions (which are used in distributions) are not ready yet.
wang_li 6mo ago
There is an alternative mitigation you can use which blacklists the function calls when the affected code is not built as a kernel module.
- vaylian 6mo ago
  > alternative mitigation you can use That's besides the point. If people use the official mitigation on https://copy.fail/#mitigation https://copy.fail/#mitigation they will not sufficiently protect themselves on mainstream distros like Ubuntu and Debian. The page also states > Most major distributions are shipping the fix now. This text was probably prepared in advance, but this was simply not true at the time of publication.
SoftTalker 6mo ago
AIUI the exploit was fairly low-effort once you knew the vulnerability. So publishing one probably didn't change the landscape much.
akerl_ 6mo ago
> maybe even criminal What’s your theory here? What crime?
- michaelmrose 6mo ago
  If it's not a crime I see no reason not to work with partner nations to build responsible disclosure into a legal framework everywhere because it pretty obviously should be.
  - akerl_ 6mo ago
    If you wanted to somehow make coordinated disclosure into a legal framework, that would be an interesting and complex project. But it’s not the law anywhere I’m aware of today, and I’d not support it becoming a law.
    - debugnik 6mo ago
      This is kind of a thing already in the EU. Under NIS 2, vulnerabilities should be notified to a CSIRT as well as upstream, and the CSIRT shall identify downstream vendors and negotiate a disclosure timeline. I don't know whether they're any good at it or not, though.
  - jodrellblank 6mo ago
    You know companies are allowed to pay people to find vulns, and pay people bug bounties? Instead of that, you’d rather make the law compel free individuals to limit their speech, or to hand over their work to big companies privately, so big companies can save money? That doesn’t sound like a nice future, if it’s even enforceable at all.
- holowoodman 6mo ago
  Exploits are sold and used as weapons, sometimes even weapons of war. Which in many places is criminal, except under very restrictive circumstances. Also, all kinds of aiding and abetting.
staticassertion 6mo ago
The patch was available. Upstream just doesn't communicate vulnerabilities because they have a personal dispute with distros about how to handle patching.
- deleted 6mo ago
  [deleted]

semiquaver 6mo ago

Patches were available for nearly a month.

ori_b 6mo ago
Basic care would involve making sure the patches had made it into the wild before ending the embargo, and nagging the relevant parties if not. Edit: As of this writing, most distros including Redhat, Fedora, Debian Stable, do not have patches available in the package repos, though they're being actively worked on.
- semiquaver 6mo ago
  “Made it into the wild?” Patches landed a month ago. Should they also wait until my linksys router from 2018 has a patch ready?
  - ori_b 6mo ago
    Patches are still in the process of landing in most major distros as of the time of this writing. Most users are not able to get an update through their distro's packaging mechanisms.
  - SoftTalker 6mo ago
    It's a local vulnerability at least. How many people do you let log in to your router? With the way linux is used these days, I'd guess the number of systems with untrusted local users is pretty limited. Even with shared hosting, you generally have root in your VM or container anyway. Unless this enables an escape from that? Still the risk that people who run "curl | bash" without care could get bitten, but usually its "curl | sudo bash" anyway...
    - sgbeal 6mo ago
      > Even with shared hosting, you generally have root in your VM or container Lots of shared hosters don't use VMs or containers. It's some arbitrary number of people logging in to a shared system, each one with a home directory under /home/THE_USER_NAME. i've had several such hosters over the years (thankfully not right now, though).
    - michaelmrose 6mo ago
      Local root is part of the path to escaping
    - dist-epoch 6mo ago
      With this exploit it's trivial to jump from one container to another neighbor container. I've tried it and succeeded. So containers don't protect you, only a VM.
      - SoftTalker 6mo ago
        So anyone pulling a malicious dockerfile jeopardizes the host? That would be bad...
        ori_b 6mo ago
        ...no shit? Why do you think people care about this issue?
      - ranger_danger 6mo ago
        > I've tried it and succeeded. How so?
    - sjpb 6mo ago
      > With the way linux is used these days, I'd guess the number of systems with untrusted local users is pretty limited Things like HPC clusters are multiuser & don't entirely trust their users. If they did we wouldn't need users/groups/permissions etc in the first place.
- sgjohnson 6mo ago
  Not true, if there’s any evidence of the exploit being used in the wild, it’s much more responsible to release immediately. Considering that the patches have been available for a while, someone surely reversed what they were for and was actually exploiting this in the wild. In the age of AI, I’d argue that “responsible disclosure” is dead. Arguably even in closed source projects. Just ask Claude to do a diff between the previous version and to see whether anything fixed in there could have had security implications. We’re not there yet, but very soon the only way to responsibly disclose a vulnerability will be immediately.
  - ori_b 6mo ago
    But they didn't release immediately -- they waited a month, but forgot to tell the distros, and forgot to check if waiting a month had actually lead to distros picking up the patches and shipping them.
    - sgjohnson 6mo ago
      Which just reinforces my point. The patch was available, therefore, where the exploit lies was also available. Linux kernel is one of the most audited open-source projects ever. I guarantee you that someone did reverse the patch. > but forgot to tell the distros Probably an oversight, but irrelevant. The bug was in the linux kernel. It's insane to suggest that they should have notified everyone shipping the linux kernel.
- GrayShade 6mo ago
  Fedora is patched.
- staticassertion 6mo ago
  That's mostly on Greg, a bit on the author.
deleted 6mo ago
[deleted]
em-bee 6mo ago
only for versions 6.19.12 & 6.18.22. older versions (which are used in distributions) are not ready yet.

wang_li 6mo ago

There is an alternative mitigation you can use which blacklists the function calls when the affected code is not built as a kernel module.

vaylian 6mo ago
> alternative mitigation you can use That's besides the point. If people use the official mitigation on https://copy.fail/#mitigation https://copy.fail/#mitigation they will not sufficiently protect themselves on mainstream distros like Ubuntu and Debian. The page also states > Most major distributions are shipping the fix now. This text was probably prepared in advance, but this was simply not true at the time of publication.

SoftTalker 6mo ago

AIUI the exploit was fairly low-effort once you knew the vulnerability. So publishing one probably didn't change the landscape much.

akerl_ 6mo ago

> maybe even criminal What’s your theory here? What crime?

michaelmrose 6mo ago
If it's not a crime I see no reason not to work with partner nations to build responsible disclosure into a legal framework everywhere because it pretty obviously should be.
- akerl_ 6mo ago
  If you wanted to somehow make coordinated disclosure into a legal framework, that would be an interesting and complex project. But it’s not the law anywhere I’m aware of today, and I’d not support it becoming a law.
  - debugnik 6mo ago
    This is kind of a thing already in the EU. Under NIS 2, vulnerabilities should be notified to a CSIRT as well as upstream, and the CSIRT shall identify downstream vendors and negotiate a disclosure timeline. I don't know whether they're any good at it or not, though.
- jodrellblank 6mo ago
  You know companies are allowed to pay people to find vulns, and pay people bug bounties? Instead of that, you’d rather make the law compel free individuals to limit their speech, or to hand over their work to big companies privately, so big companies can save money? That doesn’t sound like a nice future, if it’s even enforceable at all.
holowoodman 6mo ago
Exploits are sold and used as weapons, sometimes even weapons of war. Which in many places is criminal, except under very restrictive circumstances. Also, all kinds of aiding and abetting.

staticassertion 6mo ago

The patch was available. Upstream just doesn't communicate vulnerabilities because they have a personal dispute with distros about how to handle patching.

deleted 6mo ago
[deleted]