oss-sec mailing list archives
Re: CVE Request: linux kernel perf out-of-bounds access
From: sd <sd () fucksheep org>
Date: Wed, 15 May 2013 08:08:47 +0200
Frankly, that there was not a CVE for this came as a surprise to me later as I simply hit the release button each time I spot my bug killed when I'm auditing the git commit backlog - usually there is fully armed exploit and advisory already. 2013/5/15 Greg KH <greg () kroah com>
On Wed, May 15, 2013 at 09:26:30AM +0800, Eugene Teo wrote:On Tue, May 14, 2013 at 8:25 PM, Marc Deslauriers < marc.deslauriers () canonical com> wrote:Hello, Is there a CVE for this? If not, could one be assigned, please? https://patchwork.kernel.org/patch/2441281/ 8176cced706b5e5d15887584150764894e94e02f (BTW, there is currently an exploit for this going around...)Nowhere did it say it is a security fix. Fix available since April 13. s@kois not aware too. Awesome. Seriously, surely by now we should all know that silent fixes are not the wisest thing to do.I do not think anyone realized it was a "security" fix. It was never mentioned to the security () kernel org alias, and I only picked it up for the stable releases because someone said, "hey, here's another trinity bugfix that userspace can trigger". We fix those all the time, every single stable kernel release. The only thing different this time is someone took the time to develop a simple exploit for others to use. So I don't think this was any more or less "silent" than the normal kernel bug fixes that happen every single week. thanks, greg k-h
Current thread:
- CVE Request: linux kernel perf out-of-bounds access Marc Deslauriers (May 14)
- Re: CVE Request: linux kernel perf out-of-bounds access Raphael Geissert (May 14)
- Re: CVE Request: linux kernel perf out-of-bounds access Petr Matousek (May 14)
- Re: CVE Request: linux kernel perf out-of-bounds access Eugene Teo (May 14)
- Re: CVE Request: linux kernel perf out-of-bounds access Michael Gilbert (May 14)
- Re: CVE Request: linux kernel perf out-of-bounds access Greg KH (May 14)
- Re: CVE Request: linux kernel perf out-of-bounds access sd (May 14)
- Re: CVE Request: linux kernel perf out-of-bounds access Kurt Seifried (May 15)