oss-sec mailing list archives
Re: CVE Request: More perf security fixes
From: Kurt Seifried <kseifried () redhat com>
Date: Wed, 05 Jun 2013 13:21:02 -0600
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 06/04/2013 09:53 AM, Marcus Meissner wrote:
Hi, The perf kernel folks seem to have fixed some more perf issues which have not yet got CVEs. Our partner Intel thinks that these 3 are security relevant, so we think they also need seperate CVEs. I only glanced what the issue is, please correct if my classification is wrong.. 1. Info leak (?) via PERF_SAMPLE_BRANCH_KERNEL https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7cc23cd6c0c7d7f4bee057607e7ce01568925717
This
one is a right proper mess. I'm going to suggest in future we send one email per Linux Kernel vuln so in case discussions takes off the other vulns included don't get caught up in the mess.
2. Denial of service (system crash) https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f1923820c447e986a9da0fc6bf60c1dccdf0408e
This
one seems clear, please use CVE-2013-2146 for this issue.
3. Information leak (??) via perf LBR filter https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6e15eb3ba6c0249c9e8c783517d131b47db995ca
This
one is a right proper mess. I'm going to suggest in future we send one email per Linux Kernel vuln so in case discussions takes off the other vulns included don't get caught up in the mess. - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (GNU/Linux) iQIcBAEBAgAGBQJRr4+eAAoJEBYNRVNeJnmT23AP/0V/QI3Ad/8oVXc/aXZVXuSf iefMVriDJAdmGIgX0lLqtGy7ovq1ckz8AwqdfA+6IuX3re7PgcX7qLBIMycyCJne VnKzuCAvUqS+8rjKvXgBJE5BYicYqTSXpDHzjt4C+rDFDhwGK+lswfcblXgVVTKZ 3FBDbxQ4TrwCGI5YBILYw8p3lkArlBkALwU89Kj8z8nSKU/BRmWfmd5ACvwOgHhu 1OLIvicOBMI7/UB/NhNNE8MZ7+fORtkIQdKKWAfiIrLhsR8sMPlu9WD7FSaFiZQl 68LOQRMzrJGcFe2+oCOx2OQbl+0hcVBdLoQ50DtJ8dpFmo+YiQgJHG4192VFtvwk aA30jQKwsTEWTSrROtzvDBTTR5jHsp9oficT1MISnS1D3JtuzX5I4h+vqWtclzRo SLVSvysKHhIpkUXN4tieEfcWwlsR2IG2XPc+qXtxY7ZrFhGfdXq+78wHJQ4fuD/c bmlhwK+pNe0Il6eQHPld6uRvGpqGpZL/CBCQAOvs7KyqXcPq05sEwg3MVjX6HmAr QTYIlksdBeffeZ1ZX6Qpn7s5DjXvw2NsNkwhPNweWUdX8OFL2Fbc3oMVbxXlqi7o kjBa/+oZGBv0CIyKcwucBQOxhdYYrBjEYAs+qAq52NHfw8O2MbsBxCT6KKb4eFEl dPfQoKn2D0Tvu4R8p3Od =Xpu8 -----END PGP SIGNATURE-----
Current thread:
- Re: CVE Request: More perf security fixes, (continued)
- Re: CVE Request: More perf security fixes Petr Matousek (Jun 05)
- Re: CVE Request: More perf security fixes Peter Zijlstra (Jun 05)
- Re: CVE Request: More perf security fixes Petr Matousek (Jun 05)
- Re: CVE Request: More perf security fixes Stephane Eranian (Jun 05)
- Re: CVE Request: More perf security fixes Petr Matousek (Jun 05)
- Re: CVE Request: More perf security fixes Stephane Eranian (Jun 06)
- Re: CVE Request: More perf security fixes Petr Matousek (Jun 06)
- Re: CVE Request: More perf security fixes Stephane Eranian (Jun 06)
- Re: CVE Request: More perf security fixes Stephane Eranian (Jun 05)
- Re: CVE Request: More perf security fixes Petr Matousek (Jun 05)