oss-sec mailing list archives
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow
From: Solar Designer <solar () openwall com>
Date: Wed, 27 Feb 2013 19:08:58 +0400
On Wed, Feb 27, 2013 at 06:48:34AM -0800, Greg KH wrote:
On Wed, Feb 27, 2013 at 07:31:30AM +0100, Petr Matousek wrote:For starters, security () kernel org submissions should be posted to oss-security or any other security related public mailing list when the patch is being committed.That's not going to happen, and you know that, to do so would be totally irresponsible of us and directly harm your users.
Huh?! Maybe you misread what Petr wrote? Note: "when the patch is being committed". At this point, the security issue is public, and it just needs to be properly communicated to all those interested (including distros, sysadmins, etc.), such as via oss-security. Not doing this favors those few who spend time to review commits on their own; some of them do it for purposes other than informing the public. We have a similar policy for the distros and linux-distros private lists. When an issue initially brought up there is finally made public, it must be brought up on oss-security. I must admit there were a few cases where we failed to do that, but they were just that - failures. I'd appreciate help of other distros/linux-distros list members to ensure that each and every issue is brought to oss-security when it is being made public (even if only via commits of the fixes). Formally, this is responsibility of the original reporter: http://oss-security.openwall.org/wiki/mailing-lists/distros "When the security issue is finally to be made public, it is your (the original reporter's) responsibility to post about it to oss-security (indeed, you and others may also post to any other mailing lists, etc.)" but in practice the original reporter sometimes fails to do that, in which case the list members should remind the reporter and/or take care of bringing the issue to oss-security themselves. I think security () kernel org should adopt a similar policy, and someone on that list should be enforcing it. Alexander
Current thread:
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow, (continued)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Henri Salo (Feb 26)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Kurt Seifried (Feb 26)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Yves-Alexis Perez (Feb 26)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Kurt Seifried (Feb 26)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Yves-Alexis Perez (Feb 26)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Jason A. Donenfeld (Feb 26)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Michael Gilbert (Feb 26)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Greg KH (Feb 26)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Petr Matousek (Feb 26)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Greg KH (Feb 27)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Solar Designer (Feb 27)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Greg KH (Feb 27)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Petr Matousek (Feb 27)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Benji (Feb 27)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Greg KH (Feb 27)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Benji (Feb 27)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Benji (Feb 27)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Jason A. Donenfeld (Feb 27)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Greg KH (Feb 27)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Jason A. Donenfeld (Feb 27)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Greg KH (Feb 27)