[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20220524232155.GA2264@openwall.com>
Date: Wed, 25 May 2022 01:21:55 +0200
From: Solar Designer <solar@...nwall.com>
To: Norbert Slusarek <nslusarek@....net>
Cc: oss-security@...ts.openwall.com, peterz@...radead.org
Subject: Re: CVE-2022-1729: race condition in Linux perf subsystem leads to local privilege escalation
On Wed, May 25, 2022 at 12:20:44AM +0200, Norbert Slusarek wrote:
> Hello Alexander,
>
> >Since you shared actual exploit code on linux-distros, you're supposed
> >to also post that to oss-security within 7 days of your first posting
> >above, so by or on May 27. Do you intend to?
>
> I don't intend to share the exploit to the public, mainly because
> the issue was fixed only few days ago. Instead, anyone wanting to check
> his own system for the bug should resort to the attached PoC repro.
>
> >I realize this is one of the aspects that not everyone is happy about.
>
> Yes, you got that right.
Thank you for posting the repro.
What do you suggest we do regarding the LPE exploit you sent to
linux-distros?
What do you suggest we do with this policy aspect going forward, so that
people do not get into a situation where they're required to do
something they didn't want to subscribe to?
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
