[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 19 Mar 2021 20:20:29 +0000
From: Eddie Chapman <eddie@...k.net>
To: oss-security@...ts.openwall.com
Subject: Re: Re: CVE-2021-20219 Linux kernel: improper
synchronization in flush_to_ldisc() can lead to DoS
On 19/03/2021 17:55, Sasha Levin wrote:
> On Fri, Mar 19, 2021 at 10:43:11AM -0400, Brad Spengler wrote:
>> Hi Sasha,
>>
>> I'm sorry, but I can't let this email demonstrating a complete lack of
>> self-awareness go without comment.
>>
>>> I suppose we can't *require* them, but it's a matter of curtesy, right?
>>> They already have that information, and instead of making a bunch of
>>> other people do the same job they could just share the information to
>>> begin with.
>>
>> I'm seriously baffled that you could type those words out with a straight
>> face. As we know happens often, including with the recent iSCSI
>> vulnerabilities, upstream has intentionally omitted CVE information
>> from kernel commit messages -- in other words:
>> "they already have the information, and instead of making a bunch of
>> other people do the same job they could just share the information to
>> begin with."
>
> I'm really not sure how to respond to this. I don't own upstream, my
> name isn't Linus, Greg, nor do I maintain a major subsystem. I don't
> have any control over how upstream commits look like.
>
> This isn't a claim that that process is perfect, this is just me saying
> that you're barking up the wrong tree. I'd happily add that Linus's
> "obfuscated" commit messages are making things more difficult for me,
> but again - I can't control what he does.
>
> Which is why I can type what I typed with a straight face: I'm trying to
> improve the oss-sec process, I'm not in any way claiming the upstream is
> superior or anything. I'm not sure why you're personally attacking me
> here for the upstream process.
>
>> Do none of you understand at all that the problems that exist are
>> entirely
>> of your own creation? Neither you nor Greg ever come to this list with
>> announcements of your own. That you have to endure a tiny fraction of
>> what
>
> I don't usually discover security vulnerabilities these days. I did in
> the past and those were assigned CVE numbers.
>
> Otherwise, I don't do analysis of a security impact of a fix.
>
>> the rest of the world is inflicted with from your intentional actions --
>> sorry, you are not the victims here, and it's completely ridiculous to
>> paint yourselves as one.
>
> Could you specify what actions *I* did to hurt the world?
>
>> Greg started his tirade yesterday with a false assumption that the stable
>> kernels had already fixed the one issue August of last year. That was
>> not
>> true (stable kernels < 5.7 were all missing the fix). Then he claimed
>> SuSE
>> didn't bother to backport the fix. That was not true:
>> https://github.com/SUSE/kernel/commit/b93bddd7ae24aa8ebe48d13dcff4011a34861482
>>
>>
>> If you guys want to complain about bad information, leaving it out of
>> useless
>> snarky replies would be a good start.
>
> Can you please stop complaining about Greg's mails as if I was the one
> who wrote them? I'm not his alter-ego, twin, or so on. If you have a
> concern with what he writes take it up with him.
>
> My concern with the notifications is that some of them don't even
> include a commit id, I never claimed (nor will) claim that stable
> already fixed them all. On the contrary, I want that commit id to make
> sure we did.
>
>>> Exactly, they already must have this information, which is where some of
>>> the frustration around these notifications comes from: it reads as
>>> nothing more than a lip service.
>>
>> You're assuming too much -- it's quite clearly someone new at RH doing
>> these
>> recent advisories.
>
> Great, let's work together on making it better, but it's been following
> the same pattern for quite a while now.
I've been following this discussion with interest this week. This list
probably has lots of security researchers and kernel devs subscribed,
but I'd like to share a point of view as someone who is neither of
these, just a heavy user of open source professionally and personally
the past 20 years.
I've always compiled my own kernels from upstream kernel.org stable
releases for all machines I look after. I know I'm in the minority and
stupid for making life harder for myself, but I prefer it that way. I
follow the upstream stable list as much as I can, read commit messages
of releases. I try to be as aware as I can about security issues so I
can keep my boxes secure, and this list has been an invaluable source of
info to me for many years. Thanks to the moderator who I'm sure has a
very difficult job at times.
It is certainly evident to me that the "quality" of security
announcements made by researchers, organisations, maintainers, in
general varies greatly. For someone in my shoes, when an announcement is
made that includes plenty of specific information, I appreciate it so
much. For most software, lack of info in a vulnerability announcement is
not a big deal and I often go hunting for info on a project's website or
git repo and can relatively easily find it. But the kernel is so
gigantic now that quality, specific info in an announcement, to someone
like me who builds their own kernels, makes all the difference.
This is OSS, there are many volunteers, nobody owes anyone anything,
that's fine, I'm grateful for anyone's efforts whatever they are. I'm
especially mindful of that when reading a security announcement from a
small project with 1 dev working in their spare time. But at the other
end of the scale are the giants who make a lot of money from the kernel
and have a lot of resources. None of them owe me anything, I'm not their
customer or partner. But I certainly look at them a lot differently than
the small project. I notice how they behave in this community, and I am
certainly much less generous when forming an opinion about them.
Red Hat contributes a lot, hires a lot of developers, I respect them and
what they do, Fedora is a great distro. The security write-ups on their
website about vulnerabilities are often excellent. But I'm sorry to say
that in my view, which I know is not worth a cent, the security
announcements they've made on this list this week have been very thin on
detail, and they have appeared completely uninterested in improving
them. I completely understand the frustrations expressed by Greg and
Sasha as a result. A company the size of Red Hat, with their resources,
involved in kernel development as much as they are, I'm sure would agree
themselves that they should be doing a lot better. But to the individual
sending the announcements, please know I don't believe you are at fault
here in any way, my criticism goes to Red Hat as an organisation which I
respect and wish to see do better in this particular aspect of their
involvement in the community.
Right, thanks for listening, back to lurking in the shadows ...
Eddie
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
