[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20130227180520.GC31167@kroah.com>
Date: Wed, 27 Feb 2013 10:05:20 -0800
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request - Linux kernel: VFAT slab-based
buffer overflow
On Wed, Feb 27, 2013 at 05:13:06PM +0100, Petr Matousek wrote:
> On Wed, Feb 27, 2013 at 06:48:34AM -0800, Greg KH wrote:
> > On Wed, Feb 27, 2013 at 07:31:30AM +0100, Petr Matousek wrote:
> > > For starters, security@...nel.org submissions should be posted to
> > > oss-security or any other security related public mailing list when
> > > the
> > > patch is being committed.
> >
> > That's not going to happen, and you know that, to do so would be
> > totally
> > irresponsible of us and directly harm your users. That's what
> > vendor-sec (or whatever it is called now) is for.
>
> linux-distros [1] is vendor-sec replacement for Linux related issues.
>
> [1] http://oss-security.openwall.org/wiki/mailing-lists/distros
Yes, sorry, I couldn't remember the name of it at the moment :)
> > Hasn't that been
> > happening for a while now, or has no one been notifying that list of
> > these issues?
>
> Regrettably no. No notifications of Linux kernel security issues
> reported to security@...nel.org mailing list to linux-distros (former
> vendor-sec) are happening on regular basis. I (speaking as Red Hat
> Security Response Team member in charge of kernel security issues) would
> really appreciate the notifications. Even marking commits that were
> committed as a result of security@...nel.org submission as sko
> originated would be really helpful.
>
> The linux-distros/oss-sec members can make sure that each issue gets CVE
> and it's properly publicly communicated at the right time (preferably
> when the issue is public -- when it is committed).
>
> Should you consider this approach, is there anything I can help with to
> make that happen?
Yes, I need someone to actually do this. There used to be a Red Hat
security team member that did this, or so I thought. What happened to
that process? I'll ask on security@...nel.org if someone wants to
volunteer to do this, but if not, are you, or anyone else you know/trust
willing to do so?
thanks,
greg k-h
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
