[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <trinity-3f5f7066-5ba5-45cb-b229-a2207e9fe209-1653583477988@3c-app-gmx-bap49>
Date: Thu, 26 May 2022 18:44:38 +0200
From: Norbert Slusarek <nslusarek@....net>
To: Solar Designer <solar@...nwall.com>
Cc: oss-security@...ts.openwall.com, peterz@...radead.org
Subject: Re: CVE-2022-1729: race condition in Linux perf
subsystem leads to local privilege escalation
>What do you suggest we do regarding the LPE exploit you sent to
>linux-distros?
I saw your reveal of linux-distros from 2020 and the exchange
didn't include any text nor attachments. In that case, the
exploit should remain private to linux-distros accordingly.
>What do you suggest we do with this policy aspect going forward, so that
>people do not get into a situation where they're required to do
>something they didn't want to subscribe to?
How is this policy aspect enforced in the first place?
If it's not, I suggest you remove it entirely as there is no reason
to have policies which cannot (and shouldn't) be enforced.
Overall, as a researcher I would prefer having a way just to inform
distros of a bug, *without* being subject to these requirements.
Norbert
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
