The Technical Advisory Board of the Linux Foundation has published a summary report analyzing the incident involving researchers from the University of Minnesota, related to their attempt to promote patches containing hidden flaws that lead to vulnerabilities in the kernel. Kernel developers confirmed previously published information that out of the 5 patches prepared during the 'Hypocrite Commits' study, 4 vulnerability-laden patches were immediately rejected due to the maintainers' initiative and did not make it into the kernel repository. One patch was accepted as it effectively addressed an issue and contained no errors.
Additionally, 435 commits were analyzed, which included fixes sent by developers from the University of Minnesota that were not related to the experiments on promoting hidden vulnerabilities. Since 2018, the group of researchers from the University of Minnesota has been actively involved in bug fixing. A re-review did not reveal any malicious activity in these commits but uncovered some unintentional errors and shortcomings.
349 commits were deemed valid and were left unchanged. Issues requiring fixes were found in 39 commits — these commits have been revoked and will be replaced with more accurate fixes before the release of kernel 5.13. Errors in 25 commits were corrected in subsequent changes. 12 commits became obsolete as they involved outdated systems that have already been removed from the kernel. One valid commit was revoked at the author's request. 9 valid commits were sent from @umn.edu addresses long before the formation of the group of researchers in question.
To restore trust in the team from the University of Minnesota and return the possibility of participating in kernel development, the Linux Foundation set forth a number of requirements, most of which have already been fulfilled. For example, the researchers have retracted the publication of 'Hypocrite Commits' and canceled their presentation at the IEEE Symposium, as well as publicly disclosed the entire timeline of events and provided detailed information about the changes submitted during the study.
Source: opennet.ru
