Home page logo

oss-sec logo oss-sec mailing list archives

Re: CVE request - Linux kernel: VFAT slab-based buffer overflow
From: Petr Matousek <pmatouse () redhat com>
Date: Wed, 27 Feb 2013 19:14:55 +0100

On Wed, Feb 27, 2013 at 10:05:20AM -0800, Greg KH wrote:
On Wed, Feb 27, 2013 at 05:13:06PM +0100, Petr Matousek wrote:
On Wed, Feb 27, 2013 at 06:48:34AM -0800, Greg KH wrote:
On Wed, Feb 27, 2013 at 07:31:30AM +0100, Petr Matousek wrote:
For starters, security () kernel org submissions should be posted to
oss-security or any other security related public mailing list when
patch is being committed.

That's not going to happen, and you know that, to do so would be
irresponsible of us and directly harm your users.  That's what
vendor-sec (or whatever it is called now) is for.

linux-distros [1] is vendor-sec replacement for Linux related issues.

  [1] http://oss-security.openwall.org/wiki/mailing-lists/distros

Yes, sorry, I couldn't remember the name of it at the moment :)

Hasn't that been
happening for a while now, or has no one been notifying that list of
these issues?

Regrettably no. No notifications of Linux kernel security issues
reported to security () kernel org mailing list to linux-distros (former
vendor-sec) are happening on regular basis. I (speaking as Red Hat
Security Response Team member in charge of kernel security issues) would
really appreciate the notifications. Even marking commits that were
committed as a result of security () kernel org submission as sko
originated would be really helpful.

The linux-distros/oss-sec members can make sure that each issue gets CVE
and it's properly publicly communicated at the right time (preferably
when the issue is public -- when it is committed).

Should you consider this approach, is there anything I can help with to
make that happen?

Yes, I need someone to actually do this.  There used to be a Red Hat
security team member that did this, or so I thought.

That was most probably Eugene Teo, he's no longer in Red Hat. I am not
subscribed to security () kernel org 

What happened to
that process?  I'll ask on security () kernel org if someone wants to
volunteer to do this, but if not, are you, or anyone else you know/trust
willing to do so?

Yes, I am definitely willing to do so.

Petr Matousek / Red Hat Security Response Team

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]