[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20190822165914.GA29435@grsecurity.net>
Date: Thu, 22 Aug 2019 12:59:14 -0400
From: Brad Spengler <spender@...ecurity.net>
To: oss-security@...ts.openwall.com
Subject: Re: Linux kernel: multiple vulnerabilities in the USB
subsystem x2
Sorry, a little too much marketing coming out of this camp these days, and
this one demands a response.
On Thu, Aug 22, 2019 at 09:20:00AM -0700, Greg KH wrote:
> On Thu, Aug 22, 2019 at 05:16:03PM +0200, Andrey Konovalov wrote:
> > On a side note, currently there's an issue with many Linux kernel bugs
> > being fixed, but not backported to distro kernels. Those bugs might
> > have security implications, but there's no way to know that, unless
> > someone specifically spends time to assess them in that regard.
> > Requesting CVEs for those bugs is a way to get the fixes into distro
> > kernels (even though that doesn't always work promptly [1] :).
> >
> > [1] https://www.openwall.com/lists/oss-security/2018/10/30/2
>
> Note, I am scraping the logs for anything that says it is fixed due do a
> syzbot find or report and backporting them to the stable kernel
> branches. So those distros that do follow the LTS/stable kernel
> releases do get these fixes.
All of the fixes, Greg? Who backports them? Would you like to share with
the list what happens when an upstream fix doesn't apply cleanly to an
earlier kernel? What happens when a volunteer doesn't show up to backport
the fix for you?
If security fixes are being tracked as your "everything is fine, nothing to
see here" reply suggests, we wouldn't be carrying hundreds of security fixes
your LTS kernels are missing.
You'd also need to explain very easy to find examples like this:
https://www.spinics.net/lists/stable/msg317698.html
of random LTS kernels not receiving security fixes. This particular issue was
public since April (which is when we backported fixes for it to 4.4/4.14).
It's now 4 months later and your 4.4 6-year "supported" LTS kernel still
doesn't contain the fixes.
This list should be for informing people, not for spreading misinformation
and a sense of security that you must know is false.
Thanks,
-Brad
Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
