Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE request - Linux kernel: VFAT slab-based buffer overflow
From: Kurt Seifried <kseifried () redhat com>
Date: Tue, 26 Feb 2013 14:05:35 -0700

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 02/26/2013 01:42 PM, Henri Salo wrote:
On Tue, Feb 26, 2013 at 01:31:59PM -0700, Kurt Seifried wrote:
I suspect part of the problem is scale. Most people don't
understand the scale at which the Linux Kernel and vendors handle
bug fixes and code changes. External people simply see a few
poorly handled security related issues and probably think "well
how hard can it be to properly a few extra security flaws?" but
they don't see that those 5 security issues were buried in 10,000
other code fixes. The resources needed to audit every code change
for a security impact simply aren't available (and even if we had
enough talented people who exactly is going to pay them all?).

Why should they be paid? I'd say problem is that there isn't lots
of people who understand aspects needed to notice a security
vulnerability in Linux kernel and it's even more difficult to fix
it without breaking something else.

Money is not the only thing getting stuff done.

-- Henri Salo

The problem with security is you have to basically do it 100%
correctly 100% of the time, otherwise things fall through the cracks
(like this VFAT thing). That tends to fall outside of what most people
like to do as a hobby. Plus the volume needed, I think you
underestimate how long code reviews take especially with the volume
the Linux Kernel deals with. Hence the need to pay people so when they
spend 40-80 hours a week doing this they can also afford food and whatnot.

I've seen various attempts at crowd sourcing security, it doesn't work
so well for the simple fact that most security people are very busy,
and anyone that shows talent/good work ethic tends to get hired by a
company and get even more busy.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)

iQIcBAEBAgAGBQJRLSOfAAoJEBYNRVNeJnmT/T4QANo1QYxgNvHI+pRvVR0QIkrZ
94BBnDxf28U6ul0mtlY9aXQK/uDMjjRXvhffLRTOOdmQr/ERj09zLTdw48NgA5SG
HO+3Wwdv+mvSmPyS4z2TiXHMl6A+nxSvUgZnhwmQ1iTbZdFxK5Gd19pb3oSVFF7d
Bb14dE/gXcRhia0NXOoF1pP3JQhaHpX5FNXJv61I56UcFqVM+5ONERHReLCMMD0P
IQTZ0uEWX4TZIRi0UuoOD4lZzxcrLW+CJXuncUsxK+Ii9rEqYOrgshgeXAUfFSuw
ox0BMeSbsSFALxlDJ+BGEvOnP47zM1YRGx6mCXzuUkmXYAhyGK4ByD3vRX1hua9h
RYrpxmEi4v1SlZuI64DIM90OAmaeyDqvieKXQAA197tZ+YPOxeRb2ZSQYSvQ4ciU
WimhedarciDKrghU6jRZzrqRIwf1oUpv+ibg6rjE1LhKurc641omNWGjWG0v6Iuw
o+ZNSIoFxkzje3r0RzIM9EWB9Vix7+wf28zU6Mxt4mKFKw5D7o1rxWN95BJtVAG9
9DGWBFfGUB+/OPhbFrTBGzTdPvbr4JupdPqpdfwmkL3sRHM903a9rZBJ+zcP1mhc
a7WxVpvcwXUGHvO3lvNMEhNZEkla2ZwFYnx+xHWizwWYPcWsz/H6VnH9JEs2T4T/
u7t6vfJcGBGK2vgYf7Wk
=PFow
-----END PGP SIGNATURE-----


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
AlienVault