Re: CVE request - Linux kernel: VFAT slab-based buffer overflow

[Greg KH <greg () kroah com>]

On Wed, Feb 27, 2013 at 07:26:39PM +0100, Petr Matousek wrote:
> On Wed, Feb 27, 2013 at 10:05:20AM -0800, Greg KH wrote:
> > On Wed, Feb 27, 2013 at 05:13:06PM +0100, Petr Matousek wrote:
> > > On Wed, Feb 27, 2013 at 06:48:34AM -0800, Greg KH wrote:
> > > > On Wed, Feb 27, 2013 at 07:31:30AM +0100, Petr Matousek wrote:
> > > > > For starters, security () kernel org submissions should be posted to
> > > > > oss-security or any other security related public mailing list when
> > > > > the
> > > > > patch is being committed.
> > > >
> > > > That's not going to happen, and you know that, to do so would be
> > > > totally
> > > > irresponsible of us and directly harm your users.  That's what
> > > > vendor-sec (or whatever it is called now) is for.
> > >
> > > linux-distros [1] is vendor-sec replacement for Linux related issues.
> > >
> > >   [1] http://oss-security.openwall.org/wiki/mailing-lists/distros
>
> Greg, FYI. The linux-distros mailing list has strict rules about the
> maximum embargo period. It is ~14 days. I hope that ~14 days are
> acceptable as a grace period for you when the commit goes public. At the
> end of the embargo period the info is always sent to oss-sec with CVE id
> assigned. 

That's fine with me.

thanks,

greg k-h