Re: Why send bugs embargoed to distros?

[Marc Deslauriers <marc.deslauriers () canonical com>]

Hi,

On 2017-09-23 07:44 AM, Hanno Böck wrote:
> Hi,
>
> A few days have passed since the optionsbleed disclosure. Some
> interesting things have surfaced, e.g. the fact that it was apparently
> discovered already in 2014, but nobody noticed it was a security bug.
>
>
> But I'd like to discuss something else:
> I had informed the distros mailing list one week earlier about the
> upcoming disclosure with a bug description and links to the already
> available patch.
> My understanding is that the purpose of the distros list is that
> updates can be prepared so after a disclosure the time between "vuln is
> known" and "patch is available" is short.
> However from all I can see this largely didn't happen.
>
> Debian+Ubuntu took more than a day after disclosure to fix. According
> to the Debian bug tracker the bug got only opened after the public
> disclosure[2]. I see no sign that any work on a fix began before the
> disclosure.

Having access to the embargoed information allowed us (Ubuntu) to evaluate the
impact of the issue, look at the fix, and start locally testing the fix to
determine if there were any issues. It also allows us to properly assign
resources to working on the update.

It would have probably taken us more than a day to publish this update if we
didn't have access to the information in advance.

> If I can trust Red Hat's CVE tracker [3] there still are no fixed
> packages available. Also I haven't found any info about updated
> opensuse packages.
>
> The only distro I'm aware of that prepared packages and pushed them
> right after disclosure is Gentoo.

For issues that aren't critical, we tend to wait until the upstream project
commits the fix before we release updates, to make sure a last-minute adjustment
or additional fix didn't get added.

> All of this makes me wonder if the distros list serves its purpose.
>
> I'd be curious to hear:
>
> a) if any people felt that pre-disclosure of optionsbleed was helpful
> to them and in which way (after all - even if it only helps minor
> distros and major distros ignore it it may still be a good thing).

Yes, I believe the pre-disclosure was helpful to us. Thanks for doing it.

> b) if people think that they'd usually prepare a fixed package, however
> they didn't consider optionsbleed important enough. (Naturally I
> probably have a bias seeing my findings as more important as other
> people, but I could live with that.)
>
> c) other things?

Thanks,

Marc.


-- 
Marc Deslauriers
Ubuntu Security Engineer     | http://www.ubuntu.com/
Canonical Ltd.               | http://www.canonical.com/