linux-kernel - Re: [PATCH] SUNRPC: Add a check for gss_release

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 21 Apr 2021 11:58:08 +0000
From:   "Shelat, Abhi" <a.shelat@...theastern.edu>
To:     Greg KH <gregkh@...uxfoundation.org>
CC:     Sudip Mukherjee <sudipm.mukherjee@...il.com>,
        Leon Romanovsky <leon@...nel.org>,
        "J. Bruce Fields" <bfields@...ldses.org>,
        Aditya Pakki <pakki001@....edu>,
        Chuck Lever <chuck.lever@...cle.com>,
        Trond Myklebust <trond.myklebust@...merspace.com>,
        Anna Schumaker <anna.schumaker@...app.com>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Dave Wysochanski <dwysocha@...hat.com>,
        "linux-nfs@...r.kernel.org" <linux-nfs@...r.kernel.org>,
        netdev <netdev@...r.kernel.org>,
        linux-kernel <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] SUNRPC: Add a check for gss_release_msg

>> 
>>>> They introduce kernel bugs on purpose. Yesterday, I took a look on 4
>>>> accepted patches from Aditya and 3 of them added various severity security
>>>> "holes".
>>> 
>>> All contributions by this group of people need to be reverted, if they
>>> have not been done so already, as what they are doing is intentional
>>> malicious behavior and is not acceptable and totally unethical.  I'll
>>> look at it after lunch unless someone else wants to do it…
>> 

<snip>

Academic research should NOT waste the time of a community.

If you believe this behavior deserves an escalation, you can contact the Institutional Review Board (irb@....edu) at UMN to investigate whether this behavior was harmful; in particular, whether the research activity had an appropriate IRB review, and what safeguards prevent repeats in other communities.

All researchers at UMN must comply with their Human Research Protection Program Plan [1], and the UMN worksheet [2] to determine if a research activity needs IRB approval includes this question:

====
Will the investigator use, study, or analyze information or biospecimens obtained through either of the following mechanisms,? Specify
which mechanism(s) apply, if yes:
…
Communication or interpersonal contact with the individuals. ("interaction”).
===

which I believe is true based on this thread.

[1] Human Research Protection Program Plan
https://drive.google.com/file/d/0B7644h9N2vLcV3FyMzJKYnJGeDA/view
[2] Human Research Determination
https://drive.google.com/file/d/0Bw4LRE9kGb69Mm5TbldxSVkwTms/view