oss-security - Re: CVE Request: staging/cxt1e1/linux.c: Correct arbitrary memory write in c4

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <201403062027.s26KRKqp023921@linus.mitre.org>
Date: Thu, 6 Mar 2014 15:27:20 -0500 (EST)
From: cve-assign@...re.org
To: speiro@....upv.es
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE Request: staging/cxt1e1/linux.c: Correct arbitrary memory write in c4_ioctl()

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

The scope of CVE doesn't exclude issues that exist only in software
that's at a beta level or similar level. See for example "Attendees
agreed that CVE should include problems in beta software, provided
that the beta code was intended for public dissemination" in the
http://cve.mitre.org/data/board/archives/2000-03/msg00007.html post.

The CVEs of interest to the community tend to be ones that are
"common" -- in other words, they are present at multiple sites, and a
CVE ID would actually be used (typically in multiple contexts) as the
mechanism for naming and tracking the vulnerability.

For the specific case of staging drivers, a relevant example is "this
driver is enabled in the Debian 6.0 kernel" for:

  http://www.openwall.com/lists/oss-security/2011/08/09/7
  http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-2909

So, any background about the discovery would be helpful, e.g., is the
driver enabled in a distribution, or is someone shipping a Linux-based
appliance or device that relies on the driver. The full list is
substantial -- http://cateee.net/lkddb/web-lkddb/STAGING.html seems
relevant although that's a third-party presentation and not directly
the primary source.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJTGNlEAAoJEKllVAevmvmsaAYIAMlV3r9YhS0rD2kb3PCenoT6
PVcAYWuyIu+IDWp74V2r6Bg6mKZzyyVMiqpw8CgNsK2zfHtcEDsrIcttIWK6VbJj
Pxkc0jQUdfqNhg/Z6gtqhUZ4Wnee9vBQo4cFfKBhlqQuPz/wV/kHqMic57n4RcCS
/n2KufYn2mB5bZMUkxM0Ky7DJslrUtyIsG7APpgPT0adcv/XhFYVAo54bvfyZIqo
RczpMPQRq9ke/xbM5x0e6UMSU43337GcRZs8w8Cb5Tr1/7vNX+7G/PqFxo5RjRz7
vVjVF/5pgna+dWzcREARCMrqTp6QrBTFVeuiNPC2Re8fczxNByZCwx2q9Xn3Ji4=
=wMyp
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.