oss-security - Re: CVE request - kernel: ima: fix null pointer dereference

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Tue, 9 Feb 2010 08:15:32 -0800
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request - kernel: ima: fix null pointer
 dereference

On Wed, Feb 10, 2010 at 12:09:23AM +0800, Eugene Teo wrote:
> On 02/09/2010 11:56 PM, Greg KH wrote:
> >On Mon, Feb 08, 2010 at 09:30:48AM +0800, Eugene Teo wrote:
> >>Was cc'ed this in a couple of kernel mailing lists.
> >>
> >>This was introduced in 6c21a7fb4 (v2.6.33-rc1).
> >
> >Do we need CVE numbers for issues that never showed up in a released
> >kernel version?  I don't see how this could affect anyone, unless they
> >were foolish enough to ship a product on a non-released kernel :)
> 
> You got a point there, but I requested this in order to keep track
> of security issues that we might need to backport in our future
> kernels.

Fair enough, that makes sense.  Although anyone backporting ima code
needs to seriously consider the lunacy of what they are doing :)

good luck,

greg k-h

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.