Minnesota University Apologizes for Contributing Malicious Code to the Linux Project

Researchers from the University of Minnesota apologized to the
maintainers of Linux Kernel Project on Saturday for intentionally
including vulnerabilities in the project’s code, which led to the
school being banned from contributing to the open-source project in
the future.

“While our goal was to improve the security of Linux, we now
understand that it was hurtful to the community to make it a
subject of our research, and to waste its effort reviewing these
patches without its knowledge or permission,” assistant professor
Kangjie Lu, along with graduate students Qiushi Wu and Aditya
Pakki, said^[1]
in an email.

“We did that because we knew we could not ask the maintainers of
Linux for permission, or they would be on the lookout for the
hypocrite patches,” they added.

The apology comes over a study into what’s called “hypocrite
commits,” which was published^[2]
earlier this February. The project aimed to deliberately add
use-after-free^[3]
vulnerabilities to the Linux kernel in the name of security
research, apparently in an attempt to highlight how potentially
malicious code could sneak past the approval process, and as a
consequence, suggest ways to improve the security of the patching
process.

A clarification document^[4]
previously shared by the academics on December 15, 2020 stated the
university’s research ethics board reviewed the study and
determined that it was not human research.

While the researchers claimed “we did not introduce or intend to
introduce any bug or vulnerability in OSS,” the fact that evidence to the contrary^[5] emerged — implying the
research was conducted without adequate oversight — and risked the
kernel’s security led to a unilateral ban of code submissions from
anyone using a “umn.edu” email address, in addition to invalidating
all past code submitted by the university researchers.

“Our community does not appreciate being experimented on, and
being ‘tested’ by submitting known patches that are (sic) either do
nothing on purpose or introduce bugs on purpose,” Linux kernel
maintainer Greg Kroah-Hartman^[6]
said^[7]
in one of the exchanges last week.

Following the incident, the university’s Department of Computer
Science and Engineering said^[8]
it was investigating the incident, adding it was looking into the
“research method and the process by which this research method was
approved, determine appropriate remedial action, and safeguard
against future issues.”

“This is worse than just being experimented upon; this is like
saying you’re a ‘safety researcher’ by going to a grocery store and
cutting the brake lines on all the cars to see how many people
crash when they leave. Enormously unethical,” tweeted^[9]
Jered Floyd.

In the meantime, all patches submitted to the codebase by the
university researchers and faculty are expected to be reverted and re-reviewed^[10] to verify if they are
valid fixes.