Conversation

Greg K-H
@gregkh
It's as if people don't believe me when I say "you must upgrade"...
Quote Tweet
Thorsten Leemhuis – the Linux kernel logger (1/5)
@kernellogger
Today from the tales of "always use really fresh #Linux #kernel versions, as they fix security issues not yet disclosed": * use-after-free in io_uring (fixed in 5.10.2) openwall.com/lists/oss-secu * local priv escalation via futexes (fixed in 5.10.12) openwall.com/lists/oss-secu
Image
8
198
Greg K-H
@gregkh
Replying to
@d4nys3k
And what to do with things that you only realize were "security bugs" after the fact? Like, um, 3 years after the fact (one famous bug fix of mine...)? Why wouldn't you upgrade to fix known bugs be they "security" related or not? What is the downside?
3
6
✨saleem✨ ⍼
@saleemrash1d
Replying to
@gregkh
and
@d4nys3k
i mean, one downside is when you have ARM chips that require outdated and heavily modified kernel trees (i.e. literally every Android device) so you can't update and can only backport the security patches you know about :)
2
1
Daniel Micay
@DanielMicay
Replying to
@saleemrash1d
@gregkh
and
@d4nys3k
You can definitely apply all the longterm kernel updates and the main issue to deal with is that they've already applied a subset of the changes and backported further changes from mainline. Generic Kernel Images (GKIs) are supposed to be a solution to this part of the problem.
1
Daniel Micay
@DanielMicay
Replying to
@DanielMicay
@saleemrash1d
and 2 others
Even with GKIs, they still have to actually start shipping the longterm kernel updates reasonably quickly. We used to be promptly applying each longterm release ourselves but it doesn't make much sense for us to be spending our resources on it right now with everything going on.
1
Daniel Micay
@DanielMicay
Replying to
@DanielMicay
@saleemrash1d
and 2 others
I don't understand how something that a single person can do with a couple days dedicated it to every month is beyond the capabilities of companies like Google and SoC vendors. They need to get rid of the unnecessary per-product/carrier branches/tags and do this important work.
1
Daniel Micay
@DanielMicay
Replying to
@DanielMicay
@saleemrash1d
and 2 others
It's unrealistic to expect other vendors to do it if even Google isn't doing it for their hardware. I don't actually understand why they aren't doing it. They're way too conservative with updates within release cycles. AOSP would ideally work a lot more like Chromium does...
1
Daniel Micay
@DanielMicay
Replying to
@DanielMicay
@saleemrash1d
and 2 others
i.e. public beta and dev releases, development in the open and a much quicker time-based release cycles with a far smaller amount of change happening far more frequently. If they did major releases every 6 weeks that had been through 12 weeks of test, I'm sure they'd ship these.
1