[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20210319144311.GA22152@grsecurity.net>
Date: Fri, 19 Mar 2021 10:43:11 -0400
From: Brad Spengler <spender@...ecurity.net>
To: oss-security@...ts.openwall.com
Subject: Re: Re: CVE-2021-20219 Linux kernel: improper
synchronization in flush_to_ldisc() can lead to DoS
Hi Sasha,
I'm sorry, but I can't let this email demonstrating a complete lack of
self-awareness go without comment.
> I suppose we can't *require* them, but it's a matter of curtesy, right?
> They already have that information, and instead of making a bunch of
> other people do the same job they could just share the information to
> begin with.
I'm seriously baffled that you could type those words out with a straight
face. As we know happens often, including with the recent iSCSI
vulnerabilities, upstream has intentionally omitted CVE information
from kernel commit messages -- in other words:
"they already have the information, and instead of making a bunch of
other people do the same job they could just share the information to
begin with."
Do none of you understand at all that the problems that exist are entirely
of your own creation? Neither you nor Greg ever come to this list with
announcements of your own. That you have to endure a tiny fraction of what
the rest of the world is inflicted with from your intentional actions --
sorry, you are not the victims here, and it's completely ridiculous to
paint yourselves as one.
Greg started his tirade yesterday with a false assumption that the stable
kernels had already fixed the one issue August of last year. That was not
true (stable kernels < 5.7 were all missing the fix). Then he claimed SuSE
didn't bother to backport the fix. That was not true:
https://github.com/SUSE/kernel/commit/b93bddd7ae24aa8ebe48d13dcff4011a34861482
If you guys want to complain about bad information, leaving it out of useless
snarky replies would be a good start.
> Exactly, they already must have this information, which is where some of
> the frustration around these notifications comes from: it reads as
> nothing more than a lip service.
You're assuming too much -- it's quite clearly someone new at RH doing these
recent advisories.
Thanks,
-Brad
Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
