Home page logo

oss-sec logo oss-sec mailing list archives

Re: CVE request -- kernel: execshield: predictable ascii armour base address
From: Kurt Seifried <kseifried () redhat com>
Date: Tue, 20 Mar 2012 10:30:08 -0600

On 03/20/2012 10:01 AM, Nick Kralevich wrote:
Can someone explain to me why this is worthy of a CVE? I can see this as a
bug of course.  But a "vulnerability"?

This bug, by itself, does not cause a vulnerability. It just makes
vulnerabilities easier to exploit. I'm not sure this is worthy of a CVE
unless we're willing to assign CVEs to all fixed address allocations.

-- Nick

To quote Steven on a previous issue:


In this case, the product's security feature is not living up to its
advertised capability (by generating shorter passwords than expected)
so, even if it's not that severe an issue, it's probably still of some
importance to some people.

in this case replace "shorter passwords" with "random addresses that are
not random".

Kurt Seifried Red Hat Security Response Team (SRT)

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]