Re: Qualys Security Advisory - The Stack Clash

[Solar Designer <solar () openwall com>]

On Mon, Jun 19, 2017 at 10:39:33PM +0200, Solar Designer wrote:
> Since we were making this public in pieces like that, I have to say: no,
> there's nothing else left to publish as part of this series of Qualys'
> findings.  Everything Qualys brought to distros so far is now public.

I have to correct the above statement as I totally forgot about the
exploits.  While all issues Qualys brought to distros so far are now
public, Qualys' own exploits for them are not public yet.  IIRC, Qualys
selectively sent the exploits to affected vendors, but that included
sending the Linux-specific exploits to the linux-distros sub-list.

Qualys, I suggest that, like you did with the Sudo exploit, you publish
your Stack Clash exploits in here as soon as third-party exploits of
comparable functionality appear, or next Tuesday, whichever is earlier.

Please confirm that you intend to do so in a reply to this message, so
that everyone in here knows what to expect.

Alexander