Re: CVE request: kernel: multiple issues in ROSE

["Steven M. Christey" <coley () rcf-smtp mitre org>]

Given the complexity/number of patches, one could arguably call it "lack 
of length validation" entirely, but I think it's reasonable to give it a 
few CVE's.  Note - we need different CVE's for the issues found by Dan 
Hutchings versus those found by Dan Rosenberg.

Dan, could you confirm that this breakdown makes sense?

1) buffer overflows (not validating length is <= the maximum)

2) use of negative signed integers in memcpy() and other operations where
   conversion creates a large unsigned integer, referred to as
   "underflow"

3) any other types of problems that aren't covered by those two?  (The
   length validation checks don't always have enough context in the source
   code).

We would need separate CVE's for the issues found by Dan versus the issues 
found by Ben Hutchings.

Arguably, #2 could probably be broken down further, but without enough 
source code context in the patches, it's not immediately clear.

- Steve