[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 05 Jun 2013 13:21:02 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
CC: Marcus Meissner <meissner@...e.de>, a.p.zijlstra@...llo.nl,
eranian@...gle.com, ak@...ux.intel.com, security@...nel.org
Subject: Re: CVE Request: More perf security fixes
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 06/04/2013 09:53 AM, Marcus Meissner wrote:
> Hi,
>
> The perf kernel folks seem to have fixed some more perf issues
> which have not yet got CVEs.
>
> Our partner Intel thinks that these 3 are security relevant, so we
> think they also need seperate CVEs.
>
> I only glanced what the issue is, please correct if my
> classification is wrong..
>
> 1. Info leak (?) via PERF_SAMPLE_BRANCH_KERNEL
>
> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7cc23cd6c0c7d7f4bee057607e7ce01568925717
This
>
one is a right proper mess. I'm going to suggest in future we
send one email per Linux Kernel vuln so in case discussions takes off
the other vulns included don't get caught up in the mess.
> 2. Denial of service (system crash)
>
> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f1923820c447e986a9da0fc6bf60c1dccdf0408e
This
>
one seems clear, please use CVE-2013-2146 for this issue.
> 3. Information leak (??) via perf LBR filter
>
> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6e15eb3ba6c0249c9e8c783517d131b47db995ca
This
>
one is a right proper mess. I'm going to suggest in future we
send one email per Linux Kernel vuln so in case discussions takes off
the other vulns included don't get caught up in the mess.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.13 (GNU/Linux)
iQIcBAEBAgAGBQJRr4+eAAoJEBYNRVNeJnmT23AP/0V/QI3Ad/8oVXc/aXZVXuSf
iefMVriDJAdmGIgX0lLqtGy7ovq1ckz8AwqdfA+6IuX3re7PgcX7qLBIMycyCJne
VnKzuCAvUqS+8rjKvXgBJE5BYicYqTSXpDHzjt4C+rDFDhwGK+lswfcblXgVVTKZ
3FBDbxQ4TrwCGI5YBILYw8p3lkArlBkALwU89Kj8z8nSKU/BRmWfmd5ACvwOgHhu
1OLIvicOBMI7/UB/NhNNE8MZ7+fORtkIQdKKWAfiIrLhsR8sMPlu9WD7FSaFiZQl
68LOQRMzrJGcFe2+oCOx2OQbl+0hcVBdLoQ50DtJ8dpFmo+YiQgJHG4192VFtvwk
aA30jQKwsTEWTSrROtzvDBTTR5jHsp9oficT1MISnS1D3JtuzX5I4h+vqWtclzRo
SLVSvysKHhIpkUXN4tieEfcWwlsR2IG2XPc+qXtxY7ZrFhGfdXq+78wHJQ4fuD/c
bmlhwK+pNe0Il6eQHPld6uRvGpqGpZL/CBCQAOvs7KyqXcPq05sEwg3MVjX6HmAr
QTYIlksdBeffeZ1ZX6Qpn7s5DjXvw2NsNkwhPNweWUdX8OFL2Fbc3oMVbxXlqi7o
kjBa/+oZGBv0CIyKcwucBQOxhdYYrBjEYAs+qAq52NHfw8O2MbsBxCT6KKb4eFEl
dPfQoKn2D0Tvu4R8p3Od
=Xpu8
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
