linux-kernel - Re: [PATCH] SUNRPC: Add a check for gss_release

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <YIEqt8iAPVq8sG+t@sol.localdomain>
Date:   Thu, 22 Apr 2021 00:50:15 -0700
From:   Eric Biggers <ebiggers@...nel.org>
To:     Theodore Ts'o <tytso@....edu>
Cc:     Weikeng Chen <w.k@...keley.edu>, anna.schumaker@...app.com,
        bfields@...ldses.org, chuck.lever@...cle.com, davem@...emloft.net,
        dwysocha@...hat.com, gregkh@...uxfoundation.org, kuba@...nel.org,
        leon@...nel.org, linux-kernel@...r.kernel.org,
        linux-nfs@...r.kernel.org, netdev@...r.kernel.org,
        pakki001@....edu, trond.myklebust@...merspace.com
Subject: Re: [PATCH] SUNRPC: Add a check for gss_release_msg

On Wed, Apr 21, 2021 at 03:49:51PM -0400, Theodore Ts'o wrote:
> 
> Of course, UMN researchers could just start using fake e-mail
> addresses, or start using personal gmail or yahoo or hotmail
> addresses.  (Hopefully at that point the ethics review boards at UMN
> will be clueful enough to realize that maybe, just maybe, UMN
> researchers have stepped over a line.)
> 

They are actually already doing (or did) that -- see page 9 of their paper
(https://github.com/QiushiWu/QiushiWu.github.io/blob/main/papers/OpenSourceInsecurity.pdf)
where they say they use "a random email account" to send patches.

I think that (two of?) the accounts they used were
James Bond <jameslouisebond@...il.com>
(https://lore.kernel.org/lkml/?q=jameslouisebond%40gmail.com) and
George Acosta <acostag.ubuntu@...il.com>
(https://lore.kernel.org/lkml/?q=acostag.ubuntu%40gmail.com).  Most of their
patches match up very closely with commits they described in their paper:

Figure 9 = https://lore.kernel.org/lkml/20200809221453.10235-1-jameslouisebond@gmail.com/
Figure 10 = https://lore.kernel.org/lkml/20200821034458.22472-1-acostag.ubuntu@gmail.com/
Figure 11 = https://lore.kernel.org/lkml/20200821031209.21279-1-acostag.ubuntu@gmail.com/

Unfortunately they obfuscated the code in their paper for some bizarre reason
and don't provide a proper list, so it's hard to know for sure though.  And
there could be more patches elsewhere.

Note that the "Figure 11" patch was actually accepted and is in mainline.
However it's not actually a bug; apparently they didn't realize that.

- Eric