The University of Minnesota’s Computer Science and Engineering Department security researchers are facing intense scrutiny from the Linux community for intentionally trying to insert bugs into Linux patches. The buggy patches were a part of the research paper On the Feasibility of Stealthily Introducing Vulnerabilities in Open Source Software via Hypocrite Commits.
The paper stated: “As proof of concept, we take the Linux kernel as target OSS and safely demonstrate that it is practical for a malicious committer to introduce use-after-free bugs. Furthermore, we systematically measure and characterize the capabilities and opportunities of a malicious committee. At last, to improve the security of OSS, we propose mitigations against hypocrite commits, such as updating the code of conduct for OSS and developing tools for patch testing and verification.”
However, the experiment did not go over as planned and was not well received from the community. Linux kernel maintainer Greg Kroah-Hartman tweeted that: “Linux kernel developers do not like being experimented on, we have enough real work to do.”
Jered Floyd, a member of Red Hat’s technical staff, agreed tweeting: “This is worse than just being experimented upon; this is like saying you’re a “safety researcher” by going to a grocery store and cutting the brake lines on all the cars to see how many people crash when they leave. Enormously unethical.”
As a result, Kroah-Hartman decided to ban the university from contributing to the Linux kernel going forward. “Our community does not appreciate being experimented on, and being
“tested” by submitting known patches that either do nothing on purpose, or introduce bugs on purpose. If you wish to do work like this, I suggest you find a different community to run your experiments on, you are not welcome here,” he wrote. “I will now have to ban all future contributions from your University and rip out your previous contributions, as they were obviously submitted in bad-faith with the intent to cause problems.”
The UMN department of computer science and engineering published an open letter to the Linux community apologizing for its mistakes. “We sincerely apologize for any harm our research group did to the Linux kernel community. Our goal was to identify issues with the patching process and ways to address them, and we are very sorry that the method used in the “hypocrite commits” paper was inappropriate. As many observers have pointed out to us, we made a mistake by not finding a way to consult with the community and obtain permission before running this study; we did that because we knew we could not ask the maintainers of Linux for permission, or they would be on the lookout for the hypocrite patches. While our goal was to improve the security of Linux, we now understand that it was hurtful to the community to make it a subject of our research, and to waste its effort reviewing these patches without its knowledge or permission,” the letter stated.
In another letter obtained by ZDNet, Linux Foundation’s senior vice president and general manager of projects Mike Dolan asked the researchers to “identify all proposals of known-vulnerable code from any U of MN experiment. The information should include the name of each targeted software, the commit information, purported name of the proposer, email address, date/time, subject, and/or code, so that all software developers can quickly identify such proposals and potentially take remedial action for such experiments.”
