[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CA+DvKQ+TfTcK79YgeMZorvpG38HP8zAeB=gioL6xUVDPyn7Ghg@mail.gmail.com>
Date: Tue, 30 May 2017 11:20:05 -0400
From: Daniel Micay <danielmicay@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Linux kernel: stack buffer overflow with
controlled payload in get_options() function
That's not what secure/verified boot means to everyone else, and
there's nothing in mainline with those properties. To everyone else,
it's not an arbitrary bureaucratic/marketing feature. It's
verification of the whole base OS... i.e. Android, Android Things
(Brillo), ChromeOS, iOS and sane embedded Linux systems. Likely
Windows on mobile devices too, and I really doubt that Microsoft
doesn't plan on verifying the userspace OS if they don't already.
Anyway, good luck with meaningless Red Hat security theatre. These
"vulnerabilities" are just reinforcing the view that security people
are foolish. There isn't disagreement that it's a meaningless feature
with this level of incompleteness and yet a CVE is assigned for it?
Okay then...
Sorry for thinking that this should be about something more than
padding CVs and marketing materials.
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
