[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <AANLkTikLaACS7oDJVp8aOMyFSiFeMhc+95eVG1=e-1xb@mail.gmail.com>
Date: Tue, 23 Nov 2010 12:00:51 -0500
From: Dan Rosenberg <dan.j.rosenberg@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Linux kernel address leaks
For starters, I don't want to turn this into a conversation about
CVEs. The point of my post was to generate discussion on a particular
class of information leakage and talk about how to address it.
That said, MITRE's website defines an "exposure" (the "E" in "CVE") as
follows [1]:
"An information security 'exposure' is a system configuration issue or
a mistake in software that allows access to information or
capabilities that can be used by a hacker as a stepping-stone into a
system or network.
CVE considers a configuration issue or a mistake an exposure if it
does not directly allow compromise but could be an important component
of a successful attack, and is a violation of a reasonable security
policy."
I don't think it's appropriate to use CVEs as a blackmailing tool, and
I don't actually think these issues need CVEs. But claiming that it
would be inappropriate to assign them because they're not "security
problems" is a bit misguided. We're not talking about leaking
function addresses here - we're talking about leaking the addresses of
live kernel data structures, which in my opinion is more of a risk.
-Dan
[1] http://cve.mitre.org/about/terminology.html
On Tue, Nov 23, 2010 at 11:46 AM, Marcus Meissner <meissner@...e.de> wrote:
> On Tue, Nov 23, 2010 at 09:59:13AM +0100, Yves-Alexis Perez wrote:
>> On lun., 2010-11-22 at 18:54 -0500, Michael Gilbert wrote:
>> > Oh, and if you get CVEs assigned, that kind of forces them to fix the
>> > problem, right?
>> >
>> I'm not that sure (there are CVEs for issues considered too small by the
>> developers involved, not only in Linux, which are still opened), and I'm
>> not sure using CVE system for “blackmailing” is a good usage for that
>> tool.
>
> CVEs are for security problems. Leaking kernel function addresses to
> userspace is not a security issue in my opinion.
>
> (Leaking content of kernel memory however is.)
>
> Ciao, Marcus
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
