oss-sec mailing list archives
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow
From: Kurt Seifried <kseifried () redhat com>
Date: Tue, 26 Feb 2013 14:05:35 -0700
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 02/26/2013 01:42 PM, Henri Salo wrote:
On Tue, Feb 26, 2013 at 01:31:59PM -0700, Kurt Seifried wrote:I suspect part of the problem is scale. Most people don't understand the scale at which the Linux Kernel and vendors handle bug fixes and code changes. External people simply see a few poorly handled security related issues and probably think "well how hard can it be to properly a few extra security flaws?" but they don't see that those 5 security issues were buried in 10,000 other code fixes. The resources needed to audit every code change for a security impact simply aren't available (and even if we had enough talented people who exactly is going to pay them all?).Why should they be paid? I'd say problem is that there isn't lots of people who understand aspects needed to notice a security vulnerability in Linux kernel and it's even more difficult to fix it without breaking something else. Money is not the only thing getting stuff done. -- Henri Salo
The problem with security is you have to basically do it 100% correctly 100% of the time, otherwise things fall through the cracks (like this VFAT thing). That tends to fall outside of what most people like to do as a hobby. Plus the volume needed, I think you underestimate how long code reviews take especially with the volume the Linux Kernel deals with. Hence the need to pay people so when they spend 40-80 hours a week doing this they can also afford food and whatnot. I've seen various attempts at crowd sourcing security, it doesn't work so well for the simple fact that most security people are very busy, and anyone that shows talent/good work ethic tends to get hired by a company and get even more busy. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iQIcBAEBAgAGBQJRLSOfAAoJEBYNRVNeJnmT/T4QANo1QYxgNvHI+pRvVR0QIkrZ 94BBnDxf28U6ul0mtlY9aXQK/uDMjjRXvhffLRTOOdmQr/ERj09zLTdw48NgA5SG HO+3Wwdv+mvSmPyS4z2TiXHMl6A+nxSvUgZnhwmQ1iTbZdFxK5Gd19pb3oSVFF7d Bb14dE/gXcRhia0NXOoF1pP3JQhaHpX5FNXJv61I56UcFqVM+5ONERHReLCMMD0P IQTZ0uEWX4TZIRi0UuoOD4lZzxcrLW+CJXuncUsxK+Ii9rEqYOrgshgeXAUfFSuw ox0BMeSbsSFALxlDJ+BGEvOnP47zM1YRGx6mCXzuUkmXYAhyGK4ByD3vRX1hua9h RYrpxmEi4v1SlZuI64DIM90OAmaeyDqvieKXQAA197tZ+YPOxeRb2ZSQYSvQ4ciU WimhedarciDKrghU6jRZzrqRIwf1oUpv+ibg6rjE1LhKurc641omNWGjWG0v6Iuw o+ZNSIoFxkzje3r0RzIM9EWB9Vix7+wf28zU6Mxt4mKFKw5D7o1rxWN95BJtVAG9 9DGWBFfGUB+/OPhbFrTBGzTdPvbr4JupdPqpdfwmkL3sRHM903a9rZBJ+zcP1mhc a7WxVpvcwXUGHvO3lvNMEhNZEkla2ZwFYnx+xHWizwWYPcWsz/H6VnH9JEs2T4T/ u7t6vfJcGBGK2vgYf7Wk =PFow -----END PGP SIGNATURE-----
Current thread:
- CVE request - Linux kernel: VFAT slab-based buffer overflow Joshua J. Drake (Feb 26)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Greg KH (Feb 26)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Kurt Seifried (Feb 26)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Henri Salo (Feb 26)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Kurt Seifried (Feb 26)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Yves-Alexis Perez (Feb 26)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Kurt Seifried (Feb 26)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Yves-Alexis Perez (Feb 26)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Kurt Seifried (Feb 26)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Jason A. Donenfeld (Feb 26)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Michael Gilbert (Feb 26)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Greg KH (Feb 26)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Petr Matousek (Feb 26)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Greg KH (Feb 27)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Solar Designer (Feb 27)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Greg KH (Feb 27)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Greg KH (Feb 26)