Report picks holes in the Linux kernel release signing process

guest · Jun 25, 2021

Report picks holes in the Linux kernel release signing process
Security procedures need documenting, improving, and mandating
June 24, 2021
https://www.theregister.com/2021/06/24/report_picks_holes_in_the/

A report looking into the security of the Linux kernel's release signing process has highlighted a range of areas for improvement, from failing to mandate the use of hardware security keys for authentication to use of static keys for SSH access.

Earlier this year cybersecurity research and consulting firm Trail of Bits was commissioned by the Open Source Technology Improvement Fund (OSTIF) to analyse the process for vulnerabilities - and analyse it did, finding several key areas where improvement is recommended.
Click to expand...

One of several low-severity issues noted in the findings, the report warns that a lack of "centralised, authoritative documentation laying out policies and procedures for key revocation, generation, or rotation or other key management tasks" means that "users and administrators are more likely to make serious errors."

The most severe issue noted, though only rated as a medium on a scale from informational at the bottom to high at the top, was that developers who are able to commit code directly to the Linux kernel repositories were not mandated to use hardware security keys - making any breach of their personal systems, as in the 2011 attack, considerably more serious.
Click to expand...

Full details of the report's findings are available on the OSTIF website.
Click to expand...

Log in or Sign up

Report picks holes in the Linux kernel release signing process

guest Guest

Log in or Sign up

Report picks holes in the Linux kernel release signing process

guest Guest

Useful Searches