oss-security - Re: Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YFULl+8RMJkYL67G@sashalap>
Date: Fri, 19 Mar 2021 16:37:43 -0400
From: Sasha Levin <sashal@...nel.org>
To: oss-security@...ts.openwall.com
Subject: Re: Re: CVE-2021-20219 Linux kernel: improper
 synchronization in flush_to_ldisc() can lead to DoS

Hey Brad,

I'll let Greg respond on your concerns with him, I've removed those
references to him from my reply.

On Fri, Mar 19, 2021 at 03:58:25PM -0400, Brad Spengler wrote:
>Hi Sasha,
>
>> I'm really not sure how to respond to this. I don't own upstream, my
>> name isn't Linus, Greg, nor do I maintain a major subsystem. I don't
>> have any control over how upstream commits look like.
>
>Both you and Greg certainly have control over stable kernel commit
>messages (it's the same ability you use to add the upstream commit ID).

So we do, but traditionally I haven't changed the commit message. I also
don't have an additional source of information when I queue up the
commits, so I'm not sure how my ability to edit stable commit messages
helps here.

>> Great, let's work together on making it better, but it's been following
>> the same pattern for quite a while now.
>
>I think both you and Greg are exaggerating the level of "extra work" this
>temporary blip creates for you -- with the exception of the RH backport
>issue, it was not difficult at all for me to determine what issue was
>being discussed, without even having to plug the CVEs into bugzilla.redhat.com
>which produces:
>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-35519
>https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2021-3428

So this CVE link above is exactly what I referred to: how do you go from
CVE-2021-3428 to the commit in question?

-- 
Thanks,
Sasha

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.