[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20101123144629.8bbdb6db.michael.s.gilbert@gmail.com>
Date: Tue, 23 Nov 2010 14:46:29 -0500
From: Michael Gilbert <michael.s.gilbert@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Linux kernel address leaks
On Tue, 23 Nov 2010 12:17:43 -0500, Dan Rosenberg wrote:
> > But you can't access kernel memory as a common user unless you already have a second
> > bug. That second bug is the CVE. Saying this leak helps escate privs is like saying
> > /etc/password leaks account names. You already have to have system access to use that
> > info.
> >
>
> I'm going to stop nitpicking over CVE definitions, because it's not
> the point of this conversation. Let's forget I ever brought it up. I
> agree that this isn't a direct threat, but in the interest of being
> proactive rather than reactive, fixing this (in combination with other
> previously mentioned hardening efforts) would make exploitation of
> other vulnerabilities harder.
I think that the only way to support your goal is to make the case that
the CVE definition does cover such exposures. In my opinion it
certainly does; although at the lowest possible severity.
The best course of action is to ask for the assignments, and perhaps
Steve Christey will clarify. That's not "blackmail" or anything
nefarious, that's simply the proper procedure for disclosing a
security-relevant issue.
For those that are against increased CVE assignments due to the
inevitable sensational "high bug count journalism", get over it.
Realize that the people that do this simply do not recognize the hidden
factors at play and the fact that quantity does not equal quality.
They're a lost cause.
Oh, and Dan, don't get discouraged so easily. You're tackling a hard
problem (well, a technically straightforward problem, but a hard
social problem). You're bound to run into barriers simply due to human
nature. If it were easy it would already be done.
Best wishes,
Mike
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
