[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAHmME9otG1bE_WsvOOCx2FfucP7EnHxN0ZNwHtta9vzEvpJ0Xg@mail.gmail.com>
Date: Thu, 28 Feb 2013 00:00:27 +0100
From: "Jason A. Donenfeld" <Jason@...c4.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request - Linux kernel: VFAT slab-based buffer overflow
On Wed, Feb 27, 2013 at 10:44 PM, Greg KH <greg@...ah.com> wrote:
> That's the whole problem here, who is going to do such a classification,
> and after that, the notification? The first part is the toughest to do,
> as discussed elsewhere in this thread.
May I just bluntly call out shenanigans here? Yes, some bugs are
esoteric and it's not immediately obvious that they are security
related. But there are so many bugs that are _clearly_
security-related. Kernel developers are super smart -- some of the
brightest guys out there. When you're committing a fix for a
use-after-free, or an array indexing error, or something clearly
security-related, the claim, "well I'm not really a big security bug
classifier sort of guy..." just doesn't ring honest. You all are super
smart; it takes your brain less than a single cycle to realize this or
that memory corruption can lead to priv escalation. I admit there are
some bugs where it's not so obvious, but for so many cases, the
classification step can be done by many diverse kernel devs.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
