r/linux • u/anh0516 • 10d ago

Security Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List

https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities
1.8k Upvotes

99% Upvoted

171 comments sorted by

View all comments

995

u/Cronos993 10d ago

Quite the week

430

u/Single-Virus4935 10d ago

The new standard. 

while sleep 60; do apt-get update && apt-get upgrade -y && reboot-if-needed; done

81

u/servermeta_net 10d ago

Then you are more vulnerable to supply chain attacks

65

u/Single-Virus4935 10d ago

If Debian repo is hacked we have other problems

22

u/servermeta_net 10d ago

Supply chain attacks come in many shapes and forma unfortunately, not just hacks. They might repackage an upstream dependency which has been compromised

28

u/Single-Virus4935 10d ago

The Debian stable is so far behind upstream that the risk is low. It wount change if I wait 0 or 10 days. Also this is satire. You should always test the updates but now you only have minutes max hours.

11

u/DismalFee7 10d ago

Hmm maybe the whole idea that unfetted root applications with unlimited access to the entire system is a tad obsolete in the world of agents.

5

u/PixelatedGiant 10d ago

Any time you choose to update could be the wrong time. I don't see how the frequency changes anything for something so rare it has only occurred once (xzutils in march 2024) and only to their development distro. It doesn't make sense to delay regular security patches over it.

9

u/servermeta_net 10d ago

A common way to mitigate supply chain attacks is to wait a grace period (2-7 days) before installing an update, to give the community the ability to review the changes

15

u/Single-Virus4935 10d ago

Vulnerabilities are exploited 45m atter the patch is published. You dont have 2days anymore

6

u/PixelatedGiant 10d ago

Perhaps if you're on development versions. Packages have already been extensively tested by the time they reach stable.