oss-security - RE: Cve issue discussion

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <SG2PR0401MB18341DCF23068229492F4B2A88B50@SG2PR0401MB1834.apcprd04.prod.outlook.com>
Date: Mon, 7 Aug 2017 09:47:20 +0000
From: ne xo <nexo123@...look.kr>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: RE: Cve issue discussion

Hello,

thank you for the reply!

I chose the report at random.

I'm sorry if I was offended to mention the report.

Thanks.
<http://aka.ms/weboutlook>
________________________________
보낸 사람: Agostino Sarubbo <ago@...too.org>
보낸 날짜: 2017년 8월 7일 월요일 오후 4:42:05
받는 사람: oss-security@...ts.openwall.com
제목: Re: [oss-security] Cve issue discussion

On Monday 07 August 2017 01:03:53 ne xo wrote:
> Hello,
>
>
> I am curious about issuing CVEs.
>
> I can see that a "NULL pointer dereference" or a bug where the exploit has
> not been verified also get a CVE.

>
> heap-overflows may or may not be exploitable.
>
>
> It takes a lot of time to analyze the exploit and create the exploit code.
>
>
> Is it right to be assigned a CVE only if it is exploitable?
>
>
> Or do you think all bugs need to get a CVE?
>
>
> Thanks.
>
> ---
>
> ref
>
> ---
>
> [1]http://www.openwall.com/lists/oss-security/2017/04/10/17 - NULL pointer
> dereference
> [2]http://www.openwall.com/lists/oss-security/2017/04/10/15 -
> memory allocation failure

Hi.

Since you mentioned some issues reported by me, let me answer directly.
For the first, it is an undefined behavior, so actually you don't see the
crash.
Nowadays, the undefined behavior issues do not get anymore a CVE.

For the second, ASAN reports that the program want to use more that 64GB of
ram to execute the process so ASAN hangs the process. In this case is up to
the maintainer check whether there is a problem in the code or not, or it is
expected. The better double-check would be verify what happens without ASAN.

I'd like also to mention that MITRE assigns CVE after they analyze the
reported issue, so if an issue does not deserve a CVE, MITRE probably won't
assign accompanied by an explanation.

--
Agostino Sarubbo
Gentoo Linux Developer

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.