[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] Malicious commits to Linux kernel as part of university study
From:       Peter Bex <peter () more-magic ! net>
Date:       2021-04-22 6:59:59
Message-ID: 20210422065959.GI13079 () scully ! more-magic ! net
[Download RAW message or body]


Hi all,

Probably a lot of you know this already but I consider it serious enough
to point out to the OSS security community at large.

The university of Minnesota has been banned from making any commits to
the Linux kernel after it was found out they'd been submitting bogus
patches to the LKML to knowingly introduce security issues:
https://lore.kernel.org/linux-nfs/YH%2FfM%2FTsbmcZzwnX@kroah.com/

They also published a paper:
https://raw.githubusercontent.com/QiushiWu/qiushiwu.github.io/main/papers/OpenSourceInsecurity.pdf

I don't know the scope of this research, but it could involve other OSS
projects, now or in the future, as well.  Hence this e-mail.  If you feel
it's spam or needless drama, feel free to ignore.

Cheers,
Peter

["signature.asc" (application/pgp-signature)]

[prev in list] [next in list] [prev in thread] [next in thread]