[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20170804175151.GA13252@kroah.com>
Date: Fri, 4 Aug 2017 10:51:51 -0700
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Cc: willemdebruijn.kernel@...il.com, Dmitry Vyukov <dvyukov@...gle.com>,
Kostya Serebryany <kcc@...gle.com>
Subject: Re: Reporting and disclosing Linux kernel
vulnerabilities
On Fri, Aug 04, 2017 at 06:59:15PM +0200, Andrey Konovalov wrote:
> Hi!
>
> It's not completely clear to me how to properly report and disclose
> Linux kernel security issues.
As your document shows, it all depends on what type of issue it is, and
what _you_ want to get out of it. [1]
> There are a few different parties [1, 2, 3] that need to be informed
> and coordinated.
Again, it depends on what you want to do :)
> I couldn't find a publicly available actionable list of steps, so I've
> outlined it as I see it here:
>
> https://github.com/google/syzkaller/blob/master/docs/linux_kernel_reporting_bugs.md#reporting-security-bugs
>
> Thoughts? Comments?
That looks like a good start, nice job.
thanks,
greg k-h
[1] This matters a lot. Here's my feeling on the matter:
If you just want the bug fixed so you can get on with whatever else
you were doing, just notify security@...nel.org, the bug will get
fixed and pushed out to all kernel.org trees as soon as possible.
If you think it affects users of the "traditional" Linux distros,
then contact distros and hope someone contacts security@k.o later to
get the issue resolved for everyone else.
If it affects only an odd one-off or embedded device that will never
get updated, again, security@k.o and oss-security to get some public
leverage to try to get the vendor to fix the issue.
If you don't really care what happens to anyone, oss-security works :)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
