[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20210422162518.GC10297@suse.de>
Date: Thu, 22 Apr 2021 18:25:19 +0200
From: Marcus Meissner <meissner@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: Malicious commits to Linux kernel as part of
university study
Hi,
to follow the "give complete content" requirement, here their statement on their website:
https://cse.umn.edu/cs/statement-cse-linux-kernel-research-april-21-2021
"
Statement from CS&E on Linux Kernel research - April 21, 2021
Leadership in the University of Minnesota Department of Computer Science & Engineering learned today about the details of research being conducted by one of its faculty members and graduate students into the security of the Linux Kernel. The research method used raised serious concerns in the Linux Kernel community and, as of today, this has resulted in the University being banned from contributing to the Linux Kernel.
We take this situation extremely seriously. We have immediately suspended this line of research. We will investigate the research method and the process by which this research method was approved, determine appropriate remedial action, and safeguard against future issues, if needed. We will report our findings back to the community as soon as practical.
Sincerely,
Mats Heimdahl, Department Head
Loren Terveen, Associate Department Head
"
Ciao, Marcus
On Thu, Apr 22, 2021 at 05:11:42PM +0200, Marcus Meissner wrote:
> Hi,
>
> https://twitter.com/UMNComputerSci/status/1384948683821694976
>
> Ciao, Marcus
>
>
> On Thu, Apr 22, 2021 at 02:55:03PM +0000, David H wrote:
> > Has anyone reported this to https://research.umn.edu/ethics-compliance/reporting-research-misconduct ?
> >
> >
> > On 4/22/21, 3:00 AM, "Peter Bex" <peter@...e-magic.net> wrote:
> >
> > Hi all,
> >
> > Probably a lot of you know this already but I consider it serious enough
> > to point out to the OSS security community at large.
> >
> > The university of Minnesota has been banned from making any commits to
> > the Linux kernel after it was found out they'd been submitting bogus
> > patches to the LKML to knowingly introduce security issues:
> > https://lore.kernel.org/linux-nfs/YH%2FfM%2FTsbmcZzwnX@kroah.com/
> >
> > They also published a paper:
> > https://raw.githubusercontent.com/QiushiWu/qiushiwu.github.io/main/papers/OpenSourceInsecurity.pdf
> >
> > I don't know the scope of this research, but it could involve other OSS
> > projects, now or in the future, as well. Hence this e-mail. If you feel
> > it's spam or needless drama, feel free to ignore.
> >
> > Cheers,
> > Peter
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
