Re: CVE request - Linux kernel: VFAT slab-based buffer overflow

["Jason A. Donenfeld" <Jason () zx2c4 com>]

On Wed, Feb 27, 2013 at 10:44 PM, Greg KH <greg () kroah com> wrote:
> That's the whole problem here, who is going to do such a classification,
> and after that, the notification?  The first part is the toughest to do,
> as discussed elsewhere in this thread.

May I just bluntly call out shenanigans here? Yes, some bugs are
esoteric and it's not immediately obvious that they are security
related. But there are so many bugs that are _clearly_
security-related. Kernel developers are super smart -- some of the
brightest guys out there. When you're committing a fix for a
use-after-free, or an array indexing error, or something clearly
security-related, the claim, "well I'm not really a big security bug
classifier sort of guy..." just doesn't ring honest. You all are super
smart; it takes your brain less than a single cycle to realize this or
that memory corruption can lead to priv escalation. I admit there are
some bugs where it's not so obvious, but for so many cases, the
classification step can be done by many diverse kernel devs.