Reporting Kernel Security Issues

Omniscientist writes "A recent post on KernelTrap details the lkml post by Chris Wright talking about a centralized place to report security issues pertaining to the Linux Kernel and the discussion that was generated by it, including Chris's followup. It would appear that they now have created a security team to privately handle the bugs, who act as the alternative to reporting the flaw to the public immediately."

Comments

Good idea?

[lachlan76]

To be honest, I'd rather see any security problems in LKML, than keep them private...a private bug may not be fixed, but when there is a lot of public pressure to get a patch out, if it's not done *FAST* by the developers, someone in the community will do it. This is not the case if it is kept private.

Re:Good idea?

[Anonymous Coward]

Did you actually read the fine thread? All Chris is doing is creating a single point of contact for security related bugs. The current situation is that bugs are reported randomly to lkml, distros or whereever so some may fall through the net.

A single point of contact is a good thing in my book.

Re:Good idea?

[tibike77]

Well, it's a tradeoff issue... do you prefer that:

a) all bugs get published "public"
- each and every person can snoop around and either help fix it
- or instead try to exploit it (even moreso, keep on exploiting it on "unpatched" systems long time after)

OR

b) all serious bugs get published "privately"
- only "core contributors" get to see it and try to fix it
- the rest of the population might not even know the bug exists until a patch is released (moreso, you might not even know what the bug was)

Well, I guess (some) people prefer "version B" ;)

Re:Good idea?

[lachlan76]

Well the headline made it seem like it was just a private list so that only the dev guys know about the problems. Now that I've gotten further through the thread it seems that Linus is uhh...strongly opposed to that idea.

But if it's a security problem in the kernel and it gets reported to the vendor currently instead of lkml, what makes you think a single point of contact will be used properly?

Re:Good idea?

[pe1rxq]

but systems are less vunerable

Nobody knowing about the bug doesn't make is less vulnerable.... It might make it less likely that somebody will abuse it, but the hole is still there.

Keeping it silent only works if you are the only one capable of finding it. It has been shown time after time that that isn't true.

Jeroen

This is to stop commercial third party patches

[Jack Taylor]

Most of the comments I've read so far seem to be missing the point. The idea of this security team is to make sure that there aren't any publicly known exploits in the kernel without a patch being available; at the moment this is inevitable if a bug is reported directly to the kernel guys, due to the policy of immediate disclosure.

This move is primarily to stop companies running linux from going to commercial vendors to patch their kernel for them, and thus keeping linux security centralised.