[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 8 Jun 2015 15:44:05 -0400 (EDT)
From: cve-assign@...re.org
To: walters@...bum.org
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com
Subject: Re: CVE request for polkit
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Your message seems to be about various security analysis posted to a
mailing-list thread with about 10 messages, accompanied by at least
two bug reports:
https://bugs.freedesktop.org/show_bug.cgi?id=90837
https://bugs.freedesktop.org/show_bug.cgi?id=90832
with a total of about 15 comments. In this situation, we're not sure
that there's any practical way for us to distill that into a consensus
statement of what the CVE or CVEs would be for.
The original 2015-05-29 message seems to be about clients whereas the
first 2015-06-03 message seems to be about users or uids. Is there any
polkit documentation that suggests that two clients are allowed to
interfere with each other as long as they have the same uid? (This is
in the general case where at least one of the two clients is executing
with substantial restrictions.)
For purposes of CVE, we may be able to model this as a situation in
which the (realistically exploitable) counter wraparound is a clear
implementation error and can have a CVE ID, but the concept of uid
matching is a design change that is essentially outside the scope of
CVE. Would that be OK?
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJVdfACAAoJEKllVAevmvmsm30H/2mgnbGvu8dH39DeFuAGHNZz
UB7F680kDYPQr8onOQU9vBvLqxmEUFg9JA08EtnMeuKomcvH6UD8w9cQEv8TVtFw
b9vDEYkrMKlY8V8sWvhebpnqOURUa9oy8wockAwq/ZAUlz1P9leaQ1N4w9emMvhj
l4PheYuFb1OuIz8kUzhkq1adPeLKMFnjd8abVckHNFtSFhch8A/Lrl56qmJ26MGw
0Rgng4e3gziN1QDT4WsEqm0haehPitJefa61sEuWMcDh+aJjOKzBYScdGCk9A01d
91EFwwZMDq9QPYM1y3UlbvBuypSSafpgZEsJDIyBUeCSVBIAnWqJeJSYQvupyiM=
=+9Uv
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
