oss-sec mailing list archives
Re: Linux kernel CVEs not mentioned on oss-security
From: Solar Designer <solar () openwall com>
Date: Wed, 27 Sep 2017 14:51:49 +0200
On Wed, Sep 27, 2017 at 10:14:04AM +0100, Muhammed Mustapha Abiola wrote:
Isn't this exactly what Vendor-Sec tried to solve?
No. Not even similar. vendor-sec was / linux-distros is solely about the subset of issues that are initially embargoed, but OTOH not limited to the Linux kernel. So there wasn't / isn't meant to be more than a slight overlap between issues handled on those lists vs. all Linux kernel security issues/fixes. Besides, Greg focuses on the problem that some ignore the stable kernels or the "curated and tested stream of fixes" that could be seen in there, whereas another concern mentioned earlier in the thread is that the stream is also incomplete because some security fixes are not marked as such and not CC'ed to stable. So that's two problems mentioned in the thread, but vendor-sec was not / linux-distros is not related to either. Alexander
On Tue, Sep 26, 2017 at 4:04 PM, Greg KH <greg () kroah com> wrote:The rule for the kernel is, "if a distro/company/user is not following the stable kernel updates, they are on their own". I recommend either using the stable kernels, or paying for a company that knows what they are doing in this area and provides support (Red Hat, SuSE, etc.) And if you try to argue "just tell us what needs to be fixed", well, we are, am, we are providing about 10-12 patches a day that people should be incorporating into their kernels. Why they ignore that curated and tested stream of fixes is beyond me...
Current thread:
- Re: Linux kernel CVEs not mentioned on oss-security, (continued)
- Re: Linux kernel CVEs not mentioned on oss-security Kurt Seifried (Sep 25)
- Re: Linux kernel CVEs not mentioned on oss-security Priedhorsky, Reid (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Simon McVittie (Sep 25)
- Re: Linux kernel CVEs not mentioned on oss-security Moritz Muehlenhoff (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Agostino Sarubbo (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Greg KH (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Nicholas Luedtke (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Agostino Sarubbo (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Greg KH (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Muhammed Mustapha Abiola (Sep 27)
- Re: Linux kernel CVEs not mentioned on oss-security Solar Designer (Sep 27)
- Re: Linux kernel CVEs not mentioned on oss-security Greg KH (Sep 27)
- Re: Linux kernel CVEs not mentioned on oss-security Solar Designer (Sep 27)
- Re: Linux kernel CVEs not mentioned on oss-security Greg KH (Sep 28)
- Re: Linux kernel CVEs not mentioned on oss-security Salvatore Bonaccorso (Sep 28)
- Re: Linux kernel CVEs not mentioned on oss-security Greg KH (Sep 28)
- Re: Linux kernel CVEs not mentioned on oss-security Brad Spengler (Sep 28)
- Re: Linux kernel CVEs not mentioned on oss-security Greg KH (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Kurt Seifried (Sep 25)
- Re: Linux kernel CVEs not mentioned on oss-security Kurt Seifried (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Agostino Sarubbo (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Kurt Seifried (Sep 26)