Recently, according to foreign media ZDNet, a Huawei L20 chief security expert published a Linux kernel hardening patch called HKSP on GitHub. Interestingly, the patch was quickly found by the development team grsecurity to have an “easily exploitable” vulnerability, immediately sparking heated discussion.
Later, the original author also felt wronged and stepped forward to clarify the story:
This is demo code I wrote, a PoC to quickly verify whether these vulnerability mitigations are effective. I didn’t add security parameter checks, and grsecurity hyped it up because they don’t want anyone inserting themselves into vulnerability-mitigation research.
Huawei also said: this is the employee’s personal behavior and doesn’t represent the company.
Here’s what happened:
On May 10, this Huawei employee submitted to the official Linux kernel project via the mailing list. The patch was reportedly named HKSP (Huawei Kernel Self-Protection) and introduced a series of security-hardening options to the Linux kernel, saying the change was to limit malicious code’s ability to create distributed denial-of-service attacks and to limit the ability to send spoofed packets (TCP/IP packets with forged source IP addresses).
As everyone knows, large tech companies usually submit patches to the Linux kernel. For example, Google, Microsoft, Amazon, and others have contributed code, so the HKSP-submitted files quickly sparked the Linux community’s interest, because it might indicate Huawei wants to contribute to the official kernel as much as possible, and the patch was subjected to strict scrutiny.
Linux is an open-source computer operating system kernel. It is a Unix-like operating system written in C and conforming to the POSIX standard.
It was first developed by Finland’s Linus Torvalds trying to provide a free Unix-like operating system on the Intel x86 architecture. The project started in 1991, with some Minix hackers helping in its early days, and today countless programmers worldwide are helping the project for free.
Then the development team Grsecurity said they found that the HKSP patch introduced a trivially exploitable “vulnerability in the kernel code.”
The Grsecurity development team pointed out in its post that the patch itself had vulnerabilities and weaknesses and lacked the usual threat model. Although the patch’s publisher on GitHub is marked as from Huawei, the Grsecurity team said in its post it’s still unclear whether the published patch set is Huawei’s official version, or whether the code has been released on any Huawei device.
As soon as this was said, it immediately sparked widespread discussion, with many accusing Huawei of trying to secretly introduce a vulnerability into the Linux kernel.
Later, Huawei also stepped forward to state its position: Huawei has not officially participated in the HKSP project, even though the project uses Huawei’s name in its title and was developed by a senior security engineer at the company.
And it said the project was created and submitted to the Linux kernel project by the engineer, without official support, and the HKSP code was never actually used in any official Huawei product.
“This is just demo code used by an individual for technical discussion with the open-source community Openwall.”
On May 11, the patch’s author also updated the note: this project is research I do in my spare time; the name HKSP is one I gave myself and is unrelated to Huawei; no Huawei product uses this code. This patch code was proposed by me; because one person doesn’t have enough energy to cover everything, it lacks quality assurance such as review and testing. And this patch is just demo code.
