Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 10 Feb 2011 10:13:57 -0500 (EST)
From: "Steven M. Christey" <coley@...-smtp.mitre.org>
To: oss-security@...ts.openwall.com
cc: Dan Rosenberg <dan.j.rosenberg@...il.com>
Subject: Re: CVE request: kernel: btrfs heap overflow


The Linux kernel (and open source in general) can be unusual because, 
ideally, you only want CVEs assigned for "published" code that has some 
chance of being used in somebody's network.  The OSS model more-or-less 
means that all code is public.  In the ancient days of early CVE, we 
considered excluding code that was only in beta, but then you had software 
with extremely large user bases (sometimes in the millions)  that were in 
permanent "beta," and that still happens today.

Add on the rapidly-changing nature of the Linux kernel and the fact that 
so many different versions are used in so many distros and other 
environments, and the amount of research that the distros seem to have to 
conduct to figure out if their local kernel version is affected or not, 
and the impossibility of an outsider (CVE) having full knowledge of which 
code is being used where, means that CVE assignment even for release 
candidates is a reasonable thing to do (the analytical expense of studying 
the kernel, affected versions, and related distributions is just too high 
- creating a CVE for a reported issue is much less expensive).

- Steve

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.