oss-security - Re: Linux 3.4+: arbitrary write with CONFIG_X86

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140131180623.GA20526@openwall.com>
Date: Fri, 31 Jan 2014 22:06:23 +0400
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Linux 3.4+: arbitrary write with CONFIG_X86_X32 (CVE-2014-0038)

On Fri, Jan 31, 2014 at 06:54:17PM +0100, rf@...eap.de wrote:
> >>>>> "SD" == Solar Designer <solar@...nwall.com> writes:
>     SD> The "assigned" date seen on CVE IDs often indicates when a pool
>     SD> of CVE IDs was created and then assigned to a CNA (Red Hat in
>     SD> this case), not when individual CVE IDs are assigned to actual
>     SD> issues.  It is perfectly normal (albeit confusing) for the
>     SD> "assigned" date to be earlier than the vulnerability discovery
>     SD> date.  This was discussed in here before:
> 
>     SD> http://www.openwall.com/lists/oss-security/2012/01/23/4
> 
>     SD> CNAs:
> 
>     SD> http://cve.mitre.org/cve/cna.html
> 
> Sorry for the repetition,

That's OK.

> but I wasn't subscribed yet at the time

I think you were in fact not subscribed in 2012.

> or is this a FAQ?

This is not a very frequent question, but I've seen this sort of
confusion several times, in different places.  I don't know if it's
addressed in some sort of FAQ list.

I think there's room for improvement for the language used on CVE ID
pages like https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0038 ,
which currently says:

"Date Entry Created
20131203	 Disclaimer: The entry creation date may reflect when
the CVE-ID was allocated or reserved, and does not necessarily indicate
when this vulnerability was discovered, shared with the affected vendor,
publicly disclosed, or updated in CVE."

but follows this with:

"Phase (Legacy)
Assigned (20131203)"

I'm not surprised the latter continues to confuse people, as it appears
not to fall under the disclaimer.  I think the disclaimer should be
worded such that it'd clearly apply to "Phase (Legacy) \n Assigned" as
well.  (And even then some confusion will remain, just maybe less of it.)

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.