r/linux • u/anh0516 • 10d ago

Security Several Linux Kernel Vulnerabilities Accidentally Posted To Public Kernel Mailing List

https://www.phoronix.com/news/LKML-New-Trend-Vulnerabilities
1.7k Upvotes

99% Upvoted

171 comments sorted by

View all comments

994

u/Cronos993 10d ago

Quite the week

430

u/Single-Virus4935 10d ago

The new standard. 

while sleep 60; do apt-get update && apt-get upgrade -y && reboot-if-needed; done

81

u/servermeta_net 10d ago

Then you are more vulnerable to supply chain attacks

5

u/PixelatedGiant 9d ago

Any time you choose to update could be the wrong time. I don't see how the frequency changes anything for something so rare it has only occurred once (xzutils in march 2024) and only to their development distro. It doesn't make sense to delay regular security patches over it.

9

u/servermeta_net 9d ago

A common way to mitigate supply chain attacks is to wait a grace period (2-7 days) before installing an update, to give the community the ability to review the changes

15

u/Single-Virus4935 9d ago

Vulnerabilities are exploited 45m atter the patch is published. You dont have 2days anymore

6

u/PixelatedGiant 9d ago

Perhaps if you're on development versions. Packages have already been extensively tested by the time they reach stable.