5 ms·

OSS-SEC: 432 Linux kernel CVEs (in less than 32 hours)

23 points by refp 2mo ago

refp 2mo ago
I remember when you were actually able to keep up with CVEs and you could (at least somewhat) prioritize patches while disregarding those which felt irrelevant. But now.. are we simply supposed to use our f̶a̶v̶o̶r̶i̶t̶e̶ package manager and batch update our systems in a loop? while true; do apt-get update && apt-get upgrade -y; sleep 1d; done wait. erhm... and probably an automatic reboot/kernel reload every 48h; THAT WILL DO IT! </sarcasm>
- goodmythical 2mo ago
  Wire the script to a pressure sensor in your seat, save-all/update/reboot every time you get out of your chair. Bonus points for relaunching programs open during initial execution of script.
  - refp 2mo ago
    perhaps we better add a job to automatically order new IoT devices from amazon too; once a month is probably good enough not to suffer. I think we just invented Upgrades-As-A-Service.. only $50/month for freshly not-yet-known-to-be-b0rked firmware! are you gonna spot the LLM bill or should I?
  - meltyness 2mo ago
    ... or that the kernel can't be hot reloaded is itself a vulnerability?
- smallerize 2mo ago
  There are pro/enterprise features that can upgrade the linux kernel without downtime, like livepatch or kpatch. (The non-proprietary klp-build is still missing tooling for most distros I think.)
  - marysol5 2mo ago
    I still don't trust that sort of thing. And I don't think I ever will.
- romaniitedomum 2mo ago
  Especially in environments where manglement mandate something like Qualys, leading to demands that systems must be patched to address the critical vulnerabilities that it's reported despite said vulnerabilities being unexploitable. One that I trot out periodically as an example of this is a CVE that would only be exploitable if running on an IBM s390 with EBCDIC codepages. Our security team nevertheless wanted it patched, because Qualys said it was a vulnerability.
  - marysol5 2mo ago
    Had that in /old job/ years ago, every security report would list off a load of packages that needed updating. Problem was, not only were they not actual vulnerabilities but they were all for some legacy software that was in the process of being removed. Was always fun to purge a load of systems from old shit, and watch the counter drop.
- Caligatio 2mo ago
  This is a confusing comment because Debian/Ubuntu/etc (you referenced apt) have separate security repositories that exist for this purpose. They have only security fixes and don't try to unnecessarily fix "other" stuff. I have not heard of the security repos pushing out a breaking update before. `unattended-upgrade` uses only a subset of repos (ie security) and does this for you. If you actually wanted to schedule reboots, it can do that too.
  - refp 2mo ago
    The comment in question is a joke; it was never intended to be read as actual advice.
  - deleted 2mo ago
    [deleted]
- _bernd 2mo ago
  Debian based systems can be queried if they need a reboot because of dpkg. But this was the same then 20 years ago....
- marysol5 2mo ago
  "Shit why is everything dead"
- fluidcruft 2mo ago
  Is anyone at Debian paid to keep up with this spigot of CVEs?
deleted 2mo ago
[deleted]
Avicebron 2mo ago
Theoretically they should slow down. I suspect people will be much pickier about which apps to use in production. Which, ironically, will be directly at odds with more and more products being pumped out..
snvzz 2mo ago
LLMs gave that one last push: Linux is not sustainable. We need to start looking at seL4 as the base, instead.
- mDyJzDPmBdG 2mo ago
  Isn't biggest attack surface in drivers? I expect distros to split less popular kernel modules into many separate opt-in packages at cost of default hardware support, and kernel developers to purge everything without active development team. The good old "lets leave it in tree, someone might find it useful" was nice idea but that is the part that is definitely not sustainable.
  - guenthert 2mo ago
    > Isn't biggest attack surface in drivers? That would be my guess too, the current batch however is all over the place: Bluetooth, file systems, etc. (the network layer ones are probably the most interesting ones). And the severity is mixed as well, some are 'just' vulnerabilities to potential DOS attacks. > I expect distros to split less popular kernel modules into many separate opt-in packages In the past questionable modules were blacklisted rather than removed.
  - snvzz 2mo ago
    Drivers run in supervisor mode as part of Linux, unfortunately.
- naishoya 2mo ago
  GenodeOS :: SculptOS might get more attention for just this reason.
- deleted 2mo ago
  [deleted]
marysol5 2mo ago
>Alternatively, you might shrug and wait to see which of these will get a logo and catchy name in the next few weeks and then try to focus on those. hehehe >Another approach might be to sit back, have a nice cup of zen, and just always pull all updates and then update your entire fleet of systems on a weekly basis, which, yes, I sure would like to be able to do, but reality keeps getting in my way. Am I the only one that gets concerned about the laissez-faire approach to security that a LOT of people take. I get that some exploits are not like the others, but some of the shit I've seen in places....
valentynkit 2mo ago
[flagged]
ChrisArchitect 2mo ago
Earlier: https://news.ycombinator.com/item?id=48992669 https://news.ycombinator.com/item?id=48992669

23 points by refp 2mo ago

refp 2mo ago

I remember when you were actually able to keep up with CVEs and you could (at least somewhat) prioritize patches while disregarding those which felt irrelevant. But now.. are we simply supposed to use our f̶a̶v̶o̶r̶i̶t̶e̶ package manager and batch update our systems in a loop? while true; do apt-get update && apt-get upgrade -y; sleep 1d; done wait. erhm... and probably an automatic reboot/kernel reload every 48h; THAT WILL DO IT! </sarcasm>

goodmythical 2mo ago
Wire the script to a pressure sensor in your seat, save-all/update/reboot every time you get out of your chair. Bonus points for relaunching programs open during initial execution of script.
- refp 2mo ago
  perhaps we better add a job to automatically order new IoT devices from amazon too; once a month is probably good enough not to suffer. I think we just invented Upgrades-As-A-Service.. only $50/month for freshly not-yet-known-to-be-b0rked firmware! are you gonna spot the LLM bill or should I?
- meltyness 2mo ago
  ... or that the kernel can't be hot reloaded is itself a vulnerability?
smallerize 2mo ago
There are pro/enterprise features that can upgrade the linux kernel without downtime, like livepatch or kpatch. (The non-proprietary klp-build is still missing tooling for most distros I think.)
- marysol5 2mo ago
  I still don't trust that sort of thing. And I don't think I ever will.
romaniitedomum 2mo ago
Especially in environments where manglement mandate something like Qualys, leading to demands that systems must be patched to address the critical vulnerabilities that it's reported despite said vulnerabilities being unexploitable. One that I trot out periodically as an example of this is a CVE that would only be exploitable if running on an IBM s390 with EBCDIC codepages. Our security team nevertheless wanted it patched, because Qualys said it was a vulnerability.
- marysol5 2mo ago
  Had that in /old job/ years ago, every security report would list off a load of packages that needed updating. Problem was, not only were they not actual vulnerabilities but they were all for some legacy software that was in the process of being removed. Was always fun to purge a load of systems from old shit, and watch the counter drop.
Caligatio 2mo ago
This is a confusing comment because Debian/Ubuntu/etc (you referenced apt) have separate security repositories that exist for this purpose. They have only security fixes and don't try to unnecessarily fix "other" stuff. I have not heard of the security repos pushing out a breaking update before. `unattended-upgrade` uses only a subset of repos (ie security) and does this for you. If you actually wanted to schedule reboots, it can do that too.
- refp 2mo ago
  The comment in question is a joke; it was never intended to be read as actual advice.
- deleted 2mo ago
  [deleted]
_bernd 2mo ago
Debian based systems can be queried if they need a reboot because of dpkg. But this was the same then 20 years ago....
marysol5 2mo ago
"Shit why is everything dead"
fluidcruft 2mo ago
Is anyone at Debian paid to keep up with this spigot of CVEs?

deleted 2mo ago

[deleted]

Avicebron 2mo ago

Theoretically they should slow down. I suspect people will be much pickier about which apps to use in production. Which, ironically, will be directly at odds with more and more products being pumped out..

snvzz 2mo ago

LLMs gave that one last push: Linux is not sustainable. We need to start looking at seL4 as the base, instead.

mDyJzDPmBdG 2mo ago
Isn't biggest attack surface in drivers? I expect distros to split less popular kernel modules into many separate opt-in packages at cost of default hardware support, and kernel developers to purge everything without active development team. The good old "lets leave it in tree, someone might find it useful" was nice idea but that is the part that is definitely not sustainable.
- guenthert 2mo ago
  > Isn't biggest attack surface in drivers? That would be my guess too, the current batch however is all over the place: Bluetooth, file systems, etc. (the network layer ones are probably the most interesting ones). And the severity is mixed as well, some are 'just' vulnerabilities to potential DOS attacks. > I expect distros to split less popular kernel modules into many separate opt-in packages In the past questionable modules were blacklisted rather than removed.
- snvzz 2mo ago
  Drivers run in supervisor mode as part of Linux, unfortunately.
naishoya 2mo ago
GenodeOS :: SculptOS might get more attention for just this reason.
deleted 2mo ago
[deleted]

marysol5 2mo ago

>Alternatively, you might shrug and wait to see which of these will get a logo and catchy name in the next few weeks and then try to focus on those. hehehe >Another approach might be to sit back, have a nice cup of zen, and just always pull all updates and then update your entire fleet of systems on a weekly basis, which, yes, I sure would like to be able to do, but reality keeps getting in my way. Am I the only one that gets concerned about the laissez-faire approach to security that a LOT of people take. I get that some exploits are not like the others, but some of the shit I've seen in places....

valentynkit 2mo ago

[flagged]

ChrisArchitect 2mo ago

Earlier: https://news.ycombinator.com/item?id=48992669 https://news.ycombinator.com/item?id=48992669