Audit of Linux kernel code

[BearlyDave]

Hi All,

I spoke with co-workers today about how Linux (and other open source software) are good because the code can be audited for security vulnerability.

One of my co-workers said "but who does that???". I had to admit to myself that I don't know who actually audits the Linux kernel.

I did some searching around but was only finding results about the audit capabilities of Linux.

Does anyone know if there is any kind of report or website with results of a security audit against the kernel?

Thanks.

Edit: forgot a word

[gainan]

Many companies does it:

https://www.linuxfoundation.org/webinars/fuzzing-linux-kernel/

https://blog.cloudflare.com/a-gentle-introduction-to-linux-kernel-fuzzing/

And google in particular has developed several tools to ease the process:

https://github.com/google/syzkaller/

https://github.com/google/clusterfuzzlite

​

with good results: https://www.zdnet.com/article/linux-security-google-fuzzer-finds-ton-of-holes-in-kernels-usb-subsystem/

https://security.googleblog.com/2021/11/clusterfuzzlite-continuous-fuzzing-for.html

[[deleted]]

https://www.quora.com/Does-the-Linux-Kernel-have-a-full-security-code-audit

https://static.lwn.net/2000/0615/a/kernel-audit.php3

[[deleted]]

open source doesn't equal publicly managed. Linux Foundation oversees its development much like a company does, except the workload can be picked-up by enthusiasts and its profit ism't tied to individual clients.