Linux has been bitten by its most high-severity vulnerability in years

arstechnica.com

43 points·alphabettsy··10 comments

Wasn't the polkit vuln a few weeks ago? And isn't this a post-compromise exploit? Title is a bit hyperbolic.

Polkit was also local privilege escalation. And this one is easier to exploit.

This is Linux as in the kernel. Polkit is not the kernel.

https://news.ycombinator.com/item?id=30586740

A uninitialized variable. In the Linux Kernel. In 2020.

This should not have happened, and quite frankly before you can gurantuee that it won't why would you even continue to work on the kernel?

IIRC variables are left uninitialized to shave off cycles in the kernel. Compiler was issuing warnings that were not relevant so devs got used to ignore them.

I am unfamiliar with the Linux Kernel development policy and the details of C compilers, but if this is the issue then they have a severe tooling issue. This kind of stuff should be tested against. And especially in something as crucial as the Linux kernel i'd expect more guarantees than "a bunch of experts thought it was ok"

Ignoring warnings is always bad. If an individual warning is bogus, you add a an exception and an explanation. But if you ignore them in mass, then you're ignoring bugs.

At least they've added a regression test to make sure this bug does not occur again.

I'm kidding of course, this is the Linux kernel we are talking about.

> before you can gurantuee that it won't why would you even continue to work on the kernel?

What's the alternative? Go back to typewriters and stop using computers? Maybe OpenBSD lacks any similar issues, but it wouldn't be at all surprising if there's similar issues on all other mainstream OS kernels.

Reply on news.ycombinator.com