oss-security - Re: CVE-2021-20177 kernel: iptables string match rule could result in kernel panic

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <X/3JxrqAuE7mDlpZ@kroah.com>
Date: Tue, 12 Jan 2021 17:09:42 +0100
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2021-20177 kernel: iptables string match rule
 could result in kernel panic

On Tue, Jan 12, 2021 at 03:23:16PM +0000, John Haxby wrote:
> 
> 
> > On 12 Jan 2021, at 08:04, Greg KH <greg@...ah.com> wrote:
> > 
> > I still do not understand why you report issues that are fixed over a
> > year ago (October 2019) and assign them a CVE like this.  Who does this
> > help out?  And what about the thousands of other issues that are fixed
> > in the kernel and not assigned a CVE like this, are they somehow not as
> > important to your group?
> > 
> > What determines what you want to give a CVE to and what you do not?
> 
> 
> I think I can answer that.   There's nothing technical going on here,
> it's down to the behaviour of the end users of enterprise systems.

Ok, I can understand that crazyness, and somehow believe it, so I have
not complained when announcements like this come out for issues that
affect RHEL releases as RH is known for abusing^using the CVE system in
this manner.  But that was not the case here at all, which is why I
asked this.

thanks,

greg k-h

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.