[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20190822195653.GA25735@kroah.com>
Date: Thu, 22 Aug 2019 12:56:53 -0700
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Subject: Re: Linux kernel: multiple vulnerabilities in the USB
subsystem x2
On Thu, Aug 22, 2019 at 12:59:14PM -0400, Brad Spengler wrote:
> Sorry, a little too much marketing coming out of this camp these days, and
> this one demands a response.
>
> On Thu, Aug 22, 2019 at 09:20:00AM -0700, Greg KH wrote:
> > On Thu, Aug 22, 2019 at 05:16:03PM +0200, Andrey Konovalov wrote:
> > > On a side note, currently there's an issue with many Linux kernel bugs
> > > being fixed, but not backported to distro kernels. Those bugs might
> > > have security implications, but there's no way to know that, unless
> > > someone specifically spends time to assess them in that regard.
> > > Requesting CVEs for those bugs is a way to get the fixes into distro
> > > kernels (even though that doesn't always work promptly [1] :).
> > >
> > > [1] https://www.openwall.com/lists/oss-security/2018/10/30/2
> >
> > Note, I am scraping the logs for anything that says it is fixed due do a
> > syzbot find or report and backporting them to the stable kernel
> > branches. So those distros that do follow the LTS/stable kernel
> > releases do get these fixes.
>
> All of the fixes, Greg?
All of the ones that say they are found by the syzbot, yes. If I have
missed any, please let me know, I am only human.
> You'd also need to explain very easy to find examples like this:
> https://www.spinics.net/lists/stable/msg317698.html
> of random LTS kernels not receiving security fixes. This particular issue was
> public since April (which is when we backported fixes for it to 4.4/4.14).
> It's now 4 months later and your 4.4 6-year "supported" LTS kernel still
> doesn't contain the fixes.
I don't track CVEs nor care about them at all, and rely on others who
depend on those older kernels to provide complex backports as they can
test them the best. Nothing new at all, it's always been that way.
If you know of specific fixes that I have missed, I am glad to accept
backports. Right now we are averaging about 22 patches a day in the
latest stable release, and 19 in the latest LTS release. That's a tiny
5.5% of the number of patches that are being developed and merged
upstream, which means that we know we are missing stuff and we rely on
people to point out where we have done so.
We take patches from all distros and companies and users where they
notice that we have missed things, I would love to take anything that
you have noticed that I missed.
thanks!
greg k-h
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
