Fedora security response time

A call for faster Fedora updates in response to security vulnerabilities was recently posted to the Fedora devel mailing list; it urgently advocated changes to the process so that updates, in general, and to the kernel and packages based on web browsers, in particular, are handled more expeditiously. While Fedora developers are sympathetic to that, there is only so much the distribution can do as there are logistical and other hurdles between Fedora and its users. It turns out that, to a great extent, Fedora can already move quickly when it needs to.

In mid-April, Demi M. Obenour posted a message with the subject "Getting security updates out to users sooner". There were several aspects of the current situation that she wanted to see addressed, starting with simply providing updates more quickly:

Beyond that, the metadata hashes for the old packages need to be invalidated quickly, throughout the entire update network (i.e. mirrors) "within an hour or less, preferably minutes"; that would mean that the older, vulnerable packages would no longer be installable. In the past, there have been few regressions with security updates, she said, so those should bypass most of the usual QA. For some package types, the kernel and those based on web-browser libraries (e.g. Thunderbird, Chromium, webkit2gtk), all updates should be considered to be security updates, she said, so that they can get to users more quickly.

Adam Williamson, who is part of the Fedora QA team, wondered about the "within hours" timeline. Gerald Henriksen noted that Firefox sometimes says that the problems an update is fixing are already being exploited in the wild.

But in-the-wild Linux-specific web-engine exploits are vanishingly rare, Michael Catanzaro said:

There are other types of browser vulnerabilities that are more dangerous; "I know this happens with Firefox occasionally, but when it does, I don't think a next-day response is so bad". There is definitely a need to get updates out in a timely manner, he said, but he thinks "a couple weeks" is timely enough in most cases. "At least with WebKit, regressions are not uncommon and a few days of testing is important to ensure quality user experience."

Kernel updates are also not good candidates for blanket "security update fast-track" treatment, Michel Alexandre Salim said. Kernel updates often do introduce regressions, so it is important to distinguish those that address a critical vulnerability from others that can get additional needed testing, he said. While it is not mentioned in the thread, the upstream kernel policy that obscures the security nature of patches, as described in this article and elsewhere, may make that harder than it needs to be. On the flipside, though, Fedora regularly updates from the stable kernel stream, which fixes lots of security problems—often before they are even known to be vulnerabilities.

In any case, Fedora kernel team member Justin Forbes said that there is already a process in place to handle the exceptional kernel update that needs to go out quickly. The process is followed two or three times a year, and it can all complete pretty quickly:

Petr Pisar said that even if there were a separate repository where fixes were immediately built, composed, and published, there would still be barriers to getting them into users' hands. The Fedora mirrors use a pull model, so the mirrors poll for updates at some frequency. In order to ensure that users get access immediately, the updates would need to come directly from Fedora servers, which is something that the infrastructure may not be able to handle.

Fedora project leader Matthew Miller pointed out that the subject has come up before. He filed a releng bug six years ago seeking a way to get urgent fixes out to users more quickly. In the years since, it was discussed in the bug and in other forums, put on the wiki, and eventually closed in 2018 because the overall process had gotten much faster in the meantime. Instead of a two-day wait, urgent updates could be ready in two or three hours.

A short vulnerability response time for a distribution is important to try to keep users as secure as possible, but there are obviously limits too. Distributions need to find the right balance and it would seem that Fedora has generally done so. It is also important to review those policies and procedures now and again to ensure that they are still functioning as they should.