Home page logo

oss-sec logo oss-sec mailing list archives

Re: CVE request: multiple kernel stack memory disclosures
From: "Steven M. Christey" <coley () linus mitre org>
Date: Wed, 6 Oct 2010 14:10:55 -0400 (EDT)

When dealing with findings of this scale, sometimes the best we can do (within a reasonable amount of time) is to combine things.

Let's consider the general guidelines of "split by vuln type" and "split by affected version." Although the severity of each bug may vary, they all appear to be related to "not initializing re-used memory."

The remaining question is how to determine "affected version." Ideally one might like to know the minimum set of affected versions for each bug (both in 2.6 and 2.4), but this might not be readily available. We could then just decide to split things based on which bugs got fixed in which 2.6.x.y release. If Dan, Eugene, or someone else has that kind of information (which is painful for me to research as a kernel "outsider"), then we can group bugs that are fixed in the same 2.6.x.y release, then assign a single CVE to each group.

We effectively exclude those one-off issues that are already assigned CVEs.

- Steve

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]