Why Linux developers do not fix reported issues or ignore bug reports completely

Re:Why Linux developers do not fix reported issues or ignore... by Animats on Friday May 31, 2024 @05:03PM (#40540213)

The last time I filed a Linux kernel bug report, it was to report that you could plug in a Firewire cable and directly read or write memory, which is a security bug. But only the first 4GB of memory, because the bug that allowed this was from the 32-bit days. There's are registers which set the upper and lower limits of the accessible area, and they were set for a range of 0..0xffffffff.

Loud complaints from someone who had a debugger which used that exploit. Wasn't fixed.

[ Parent | on HN ]

Re:Why Linux developers do not fix reported issues or ignore... by maybeben on Friday May 31, 2024 @07:53PM (#40541477)

I use this facility on FreeBSD (dcons) to do debugging. Works great. There's a knob to explicitly turn on DMA, though. It looks like Linux has something similar. Is that not sufficient?

[ Parent | on HN ]

Re:Why Linux developers do not fix reported issues or ignore... by Deebster on Friday May 31, 2024 @08:03PM (#40541544)

That user might be the one from that old XKCD: https://xkcd.com/1172/

[ Parent | on HN ]

Re:Why Linux developers do not fix reported issues or ignore... by mushufasa on Friday May 31, 2024 @05:32PM (#40540501)

my understanding is there are so many vulnerabilities when someone has physical device access that the security community essentially suggests you assume any device is compromised if you lost physical access

[ Parent | on HN ]

Re:Why Linux developers do not fix reported issues or ignore... by wslh on Friday May 31, 2024 @07:56PM (#40541498)

My understanding is that these bugs should not exist in 2024. Less if they are published.

Do you lose physical access if someone connects a thunderbolt/usb/whatever to your computer? No, this is not losing physical access.

[ Parent | on HN ]

Re:Why Linux developers do not fix reported issues or ignore... by KerrAvon on Friday May 31, 2024 @07:46PM (#40541431)

That used to be the advice. But it doesn't fly anymore when your OS is running on an easily-stolen device like a phone.

[ Parent | on HN ]

Re:Why Linux developers do not fix reported issues or ignore... by Seattle3503 on Friday May 31, 2024 @08:07PM (#40541573)

Or a use wants to plug into someone else's charging port. (Don't tell them not to do it, they are going to anyways)

[ Parent | on HN ]

Re:Why Linux developers do not fix reported issues or ignore... by arp242 on Friday May 31, 2024 @09:26PM (#40542070)

Phones don't have Firewire, and no one is charging their device through Firewire.

[ Parent | on HN ]

Re:Why Linux developers do not fix reported issues or ignore... by saagarjha on Friday May 31, 2024 @08:30PM (#40541714)

This has not been true for years for consumer electronics.

[ Parent | on HN ]

Re:Why Linux developers do not fix reported issues or ignore... by Bjartr on Friday May 31, 2024 @10:55PM (#40542514)

How so?

[ Parent | on HN ]

Re:Why Linux developers do not fix reported issues or ignore... by saagarjha on Saturday June 01, 2024 @03:50AM (#40543739)

The threat model for a modern smartphone includes people with physical access to the device.

[ Parent | on HN ]

Re:Why Linux developers do not fix reported issues or ignore... by inopinatus on Saturday June 01, 2024 @02:51AM (#40543489)

This is begging the question, because the cavalier attitude described in the anecdote above illustrates how that advice arises.

[ Parent | on HN ]

Re:Why Linux developers do not fix reported issues or ignore... by cwillu on Friday May 31, 2024 @05:41PM (#40540607)

Did this bug have anything to do with firewire providing direct memory access to peripherals, bypassing the cpu?

[ Parent | on HN ]

Re:Why Linux developers do not fix reported issues or ignore... by KerrAvon on Friday May 31, 2024 @07:48PM (#40541438)

Yes. There was at one point a software hack for Macs where you could plug a FireWire cable between two of them and write directly from one of them to the video output of the other.

[ Parent | on HN ]

Re:Why Linux developers do not fix reported issues or ignore... by ykonstant on Friday May 31, 2024 @05:28PM (#40540459)

That sounds insane; can you share details or link to a report?

[ Parent | on HN ]

Re:Why Linux developers do not fix reported issues or ignore... by tjoff on Friday May 31, 2024 @05:38PM (#40540573)

Windows and OS X had the same/similar problems. On consuner hardware at that time you probably couldn't make firewire secure.

[ Parent | on HN ]

Re:Why Linux developers do not fix reported issues or ignore... by talldayo on Saturday June 01, 2024 @12:19AM (#40542839)

Yep, same problem exists over Thunderbolt connections afaik. By emulating PCIe devices you can basically coerce the host into giving you whatever you want from memory, as long as it's configured to conveniently do-so by default: https://thunderspy.io/

[ Parent | on HN ]