A Linux Foundation technical advisory group published a summary report analyzing the incident involving researchers from the University of Minnesota related to attempts to promote patches that contained hidden bugs leading to vulnerabilities. Kernel developers confirmed the previously published information that out of 5 patches prepared during the 'Hypocrite Commits' study, 4 vulnerability patches were immediately rejected at the initiative of the maintainers and did not enter the kernel repository. One patch was accepted, but it correctly fixed the issue and contained no bugs.
A total of 435 commits were also analyzed, including fixes sent by developers from the University of Minnesota that were not related to the experiment of promoting hidden vulnerabilities. Since 2018, the group of researchers from the University of Minnesota has been actively involved in bug fixing. The re-review did not reveal any malicious activity in these commits but uncovered some unintentional mistakes and oversights.
349 commits were deemed correct and left unchanged. 39 commits were found to have issues requiring fixes — these commits have been reverted and will be replaced with more accurate corrections before the release of kernel 5.13. Errors in 25 commits have been corrected in subsequent changes. 12 commits became irrelevant as they pertained to deprecated systems that had already been removed from the kernel. One of the correct commits was reverted at the author's request. 9 correct commits were sent from @umn.edu addresses long before the investigated group of researchers was formed.
To restore trust in the team from the University of Minnesota and return the possibility of participating in the kernel development, the Linux Foundation laid out a series of requirements, most of which have already been fulfilled. For example, the researchers have revoked the publication 'Hypocrite Commits' and canceled their presentation at the IEEE Symposium, as well as publicly disclosed the entire timeline of events and provided detailed information about the changes submitted during the study.
Forrás: opennet.ru
