{"id":99982,"date":"2021-04-21T22:23:44","date_gmt":"2021-04-21T20:23:44","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/universitet-minnesoty-otstranyon-ot-razrabotki-yadra-linux-za-otpravku-somnitelnyh-patchej"},"modified":"2021-04-21T22:23:44","modified_gmt":"2021-04-21T20:23:44","slug":"universitet-minnesoty-otstranyon-ot-razrabotki-yadra-linux-za-otpravku-somnitelnyh-patchej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/universitet-minnesoty-otstranyon-ot-razrabotki-yadra-linux-za-otpravku-somnitelnyh-patchej","title":{"rendered":"The University of Minnesota has been suspended from development of the Linux kernel for sending questionable patches.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Greg Kroah-Hartman, responsible for maintaining the stable branch of the Linux kernel, has decided to ban any changes from the University of Minnesota from being accepted into the Linux kernel, as well as to roll back all previously accepted patches and conduct a re-review of them. The reason for the block was the activities of a research group studying the potential promotion of hidden vulnerabilities in the code of open-source projects. This group submitted patches that included various bugs, observed the community's reaction, and explored ways to deceive the change review process. Greg believes that conducting such experiments to introduce malicious changes is unacceptable and unethical. <\/p>\n
The reason for the blocking was the submission by members of this group of a patch that added a pointer check to prevent possible double calls to the 'free' function. Given the context of pointer usage, the check was meaningless. The goal of submitting the patch was to investigate whether the erroneous change would pass kernel developers' review. In addition to the mentioned patch, other attempts by developers from the University of Minnesota to make questionable changes to the kernel also surfaced, including those related to adding hidden vulnerabilities. <\/p>\n
The participant who submitted the patches attempted to justify himself by claiming he was testing a new static analyzer and that the change was based on the check results from it. However, Greg pointed out that the proposed fixes are not typical of the errors identified by static analyzers, and all the submitted patches do not actually fix anything at all. Taking into account that the mentioned group of researchers has previously attempted to promote fixes with hidden vulnerabilities, it is obvious that they have continued their experiments on the kernel development community. <\/p>\n
Interestingly, in the past, the leader of the experimental group participated in legitimate vulnerability fixes, for example, he discovered information leaks in the USB stack (CVE-2016-4482) and the network subsystem (CVE-2016-4485). In the study of covert vulnerability promotion, the group from the University of Minnesota cites the example of vulnerability CVE-2019-12819, which was caused by a fix accepted into the kernel in 2014. The fix added a call to put_device in the error handling block in mdio_bus, but five years later, it emerged that such manipulation leads to accessing a freed memory block ('use-after-free'). <\/p>\n
At the same time, the authors of the study claim that they summarized data on 138 patches introducing errors that are not related to the participants of the study. Attempts to submit one's own erroneous patches were limited to email correspondence, and such changes did not make it into Git (if after sending a patch via email the maintainer considered the patch acceptable, they were asked not to include the change since there was an error, after which the correct patch was sent). <\/p>\n
Supplement 1: Judging by the activity of the author of the criticized fix, he has been sending patches to various subsystems of the kernel for a long time. For example, recent changes in the radeon and nouveau drivers included a call to pm_runtime_put_autosuspend(dev->dev) in the error block, which may lead to using a buffer after the associated memory has been freed. <\/p>\n
Addendum 2: Greg reverted 190 commits related to addresses '@umn.edu' and initiated their re-review. The problem is that participants with '@umn.edu' addresses not only experimented with promoting questionable patches, but also mitigated real vulnerabilities, and reverting the changes could lead to the return of previously fixed security issues. Some maintainers have already rechecked the reverted changes and found no problems, but one maintainer noted that one of the patches sent to him contained errors. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"