mailing list archives
Re: CVE request - Linux kernel: VFAT slab-based buffer overflow
From: Solar Designer <solar () openwall com>
Date: Wed, 27 Feb 2013 19:08:58 +0400
On Wed, Feb 27, 2013 at 06:48:34AM -0800, Greg KH wrote:
On Wed, Feb 27, 2013 at 07:31:30AM +0100, Petr Matousek wrote:
For starters, security () kernel org submissions should be posted to
oss-security or any other security related public mailing list when the
patch is being committed.
That's not going to happen, and you know that, to do so would be totally
irresponsible of us and directly harm your users.
Huh?! Maybe you misread what Petr wrote? Note: "when the patch is
being committed". At this point, the security issue is public, and it
just needs to be properly communicated to all those interested
(including distros, sysadmins, etc.), such as via oss-security. Not
doing this favors those few who spend time to review commits on their
own; some of them do it for purposes other than informing the public.
We have a similar policy for the distros and linux-distros private
lists. When an issue initially brought up there is finally made public,
it must be brought up on oss-security. I must admit there were a few
cases where we failed to do that, but they were just that - failures.
I'd appreciate help of other distros/linux-distros list members to
ensure that each and every issue is brought to oss-security when it is
being made public (even if only via commits of the fixes). Formally,
this is responsibility of the original reporter:
"When the security issue is finally to be made public, it is your (the
original reporter's) responsibility to post about it to oss-security
(indeed, you and others may also post to any other mailing lists, etc.)"
but in practice the original reporter sometimes fails to do that, in
which case the list members should remind the reporter and/or take care
of bringing the issue to oss-security themselves.
I think security () kernel org should adopt a similar policy, and someone
on that list should be enforcing it.