[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.64.1102101005280.6839@faron.mitre.org>
Date: Thu, 10 Feb 2011 10:13:57 -0500 (EST)
From: "Steven M. Christey" <coley@...-smtp.mitre.org>
To: oss-security@...ts.openwall.com
cc: Dan Rosenberg <dan.j.rosenberg@...il.com>
Subject: Re: CVE request: kernel: btrfs heap overflow
The Linux kernel (and open source in general) can be unusual because,
ideally, you only want CVEs assigned for "published" code that has some
chance of being used in somebody's network. The OSS model more-or-less
means that all code is public. In the ancient days of early CVE, we
considered excluding code that was only in beta, but then you had software
with extremely large user bases (sometimes in the millions) that were in
permanent "beta," and that still happens today.
Add on the rapidly-changing nature of the Linux kernel and the fact that
so many different versions are used in so many distros and other
environments, and the amount of research that the distros seem to have to
conduct to figure out if their local kernel version is affected or not,
and the impossibility of an outsider (CVE) having full knowledge of which
code is being used where, means that CVE assignment even for release
candidates is a reasonable thing to do (the analytical expense of studying
the kernel, affected versions, and related distributions is just too high
- creating a CVE for a reported issue is much less expensive).
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
