<story><title>The Dirty Pipe Vulnerability</title><url>https://dirtypipe.cm4all.com/</url></story><parent_chain><item><author>staticassertion</author><text>Another example of a vulnerability that is purposefully obfuscated in the commit log. It is an insane practice that needs to die. The Linux kernel maintainers have been doing this for decades and it&amp;#x27;s now a standard practice for upstream.&lt;p&gt;This gives attackers an advantage (they are incentivized to read commits and can easily see the vuln) and defenders a huge disadvantage. Now I have to rush to patch whereas attackers have had this entire time to build their POCs and exploit systems.&lt;p&gt;End this ridiculous practice.</text></item></parent_chain><comment><author>gregkh</author><text>I&amp;#x27;ve described how we (the kernel security team) handles this type of things many times, and even summarized it in the past here:
  &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;www.kroah.com&amp;#x2F;log&amp;#x2F;blog&amp;#x2F;2018&amp;#x2F;02&amp;#x2F;05&amp;#x2F;linux-kernel-release-model&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;www.kroah.com&amp;#x2F;log&amp;#x2F;blog&amp;#x2F;2018&amp;#x2F;02&amp;#x2F;05&amp;#x2F;linux-kernel-releas...&lt;/a&gt;
Scroll down to the section entitled &amp;quot;Security&amp;quot; for the details.&lt;p&gt;If you wish to disagree with how we handle all of this, wonderful, we will be glad to discuss it on the mailing lists.  Just don&amp;#x27;t try to rehash all the same old arguments again, as that&amp;#x27;s not going to work at all.&lt;p&gt;Also, this was fixed in a public kernel last week, what prevented you from updating your kernel already?  Did you need more time to test the last release?&lt;p&gt;Edit: It was fixed in a public release 12 days ago.</text></comment>
<story><title>The Dirty Pipe Vulnerability</title><url>https://dirtypipe.cm4all.com/</url></story><parent_chain><item><author>staticassertion</author><text>Another example of a vulnerability that is purposefully obfuscated in the commit log. It is an insane practice that needs to die. The Linux kernel maintainers have been doing this for decades and it&amp;#x27;s now a standard practice for upstream.&lt;p&gt;This gives attackers an advantage (they are incentivized to read commits and can easily see the vuln) and defenders a huge disadvantage. Now I have to rush to patch whereas attackers have had this entire time to build their POCs and exploit systems.&lt;p&gt;End this ridiculous practice.</text></item></parent_chain><comment><author>amluto</author><text>Do you have actual evidence of that in a case like this?&lt;p&gt;(This is not a rhetorical question. I can possibly influence this policy, but unsubstantiated objections won’t help.)</text></comment>