mailing list archives
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow
From: Kurt Seifried <kseifried () redhat com>
Date: Tue, 26 Feb 2013 14:05:35 -0700
-----BEGIN PGP SIGNED MESSAGE-----
On 02/26/2013 01:42 PM, Henri Salo wrote:
On Tue, Feb 26, 2013 at 01:31:59PM -0700, Kurt Seifried wrote:
I suspect part of the problem is scale. Most people don't
understand the scale at which the Linux Kernel and vendors handle
bug fixes and code changes. External people simply see a few
poorly handled security related issues and probably think "well
how hard can it be to properly a few extra security flaws?" but
they don't see that those 5 security issues were buried in 10,000
other code fixes. The resources needed to audit every code change
for a security impact simply aren't available (and even if we had
enough talented people who exactly is going to pay them all?).
Why should they be paid? I'd say problem is that there isn't lots
of people who understand aspects needed to notice a security
vulnerability in Linux kernel and it's even more difficult to fix
it without breaking something else.
Money is not the only thing getting stuff done.
-- Henri Salo
The problem with security is you have to basically do it 100%
correctly 100% of the time, otherwise things fall through the cracks
(like this VFAT thing). That tends to fall outside of what most people
like to do as a hobby. Plus the volume needed, I think you
underestimate how long code reviews take especially with the volume
the Linux Kernel deals with. Hence the need to pay people so when they
spend 40-80 hours a week doing this they can also afford food and whatnot.
I've seen various attempts at crowd sourcing security, it doesn't work
so well for the simple fact that most security people are very busy,
and anyone that shows talent/good work ethic tends to get hired by a
company and get even more busy.
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
-----END PGP SIGNATURE-----