Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 6 Oct 2010 14:10:55 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: Dan Rosenberg <dan.j.rosenberg@...il.com>
cc: oss-security@...ts.openwall.com, Eugene Teo <eugeneteo@...nel.sg>,
        "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE request: multiple kernel stack memory
 disclosures


When dealing with findings of this scale, sometimes the best we can do 
(within a reasonable amount of time) is to combine things.

Let's consider the general guidelines of "split by vuln type" and "split 
by affected version."  Although the severity of each bug may vary, they 
all appear to be related to "not initializing re-used memory."

The remaining question is how to determine "affected version."  Ideally 
one might like to know the minimum set of affected versions for each bug 
(both in 2.6 and 2.4), but this might not be readily available.  We could 
then just decide to split things based on which bugs got fixed in which 
2.6.x.y release.  If Dan, Eugene, or someone else has that kind of 
information (which is painful for me to research as a kernel "outsider"), 
then we can group bugs that are fixed in the same 2.6.x.y release, then 
assign a single CVE to each group.

We effectively exclude those one-off issues that are already assigned 
CVEs.

- Steve

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.