Re: CVE-2017-15102: Linux kernel: usb: NULL-deref due to a race condition in [legousbtower] driver

[Stuart Gathman <stuart () gathman org>]

On 11/09/2017 12:09 PM, David A. Wheeler wrote:
> In the US, there has been recent proposed legislation that requires
> that "Internet of Things" devices sold to the federal government cannot have
> "known security vulnerabilities" ("Internet of Things Cybersecurity Improvement
> Act of 2017" proposed by Senators Mark Warner (R-Va.) and Cory Gardner (D-Colo.)).
> I suspect many other countries have or will pass similiar laws,
> or will interpret their existing laws this way.
> It's easy to argue that known security vulnerabilities are known flaws
> that should be remediated by the manufacturer (at no cost to the consumer).
>
> I agree that many vulnerabilities don't have CVE ids.
> You don't need to identify *all* vulnerabilities in old kernels... just enough to make
> it easier to update the kernel than try to back-patch everything.
> If manufacturers have to fix the CVEs to sell products, or to avoid massive returns,
> that creates an *economic* reason for manufacturers to
> begin responsibly maintain their products.
This will create an economic reason to use closed source software - as
there would then be far fewer  "known security vulnerabilities".

"As long as we keep it secret, we don't have to fix it...."