Date: Mon, 8 Jun 2015 15:44:05 -0400 (EDT) From: cve-assign@...re.org To: walters@...bum.org Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE request for polkit -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Your message seems to be about various security analysis posted to a mailing-list thread with about 10 messages, accompanied by at least two bug reports: https://bugs.freedesktop.org/show_bug.cgi?id=90837 https://bugs.freedesktop.org/show_bug.cgi?id=90832 with a total of about 15 comments. In this situation, we're not sure that there's any practical way for us to distill that into a consensus statement of what the CVE or CVEs would be for. The original 2015-05-29 message seems to be about clients whereas the first 2015-06-03 message seems to be about users or uids. Is there any polkit documentation that suggests that two clients are allowed to interfere with each other as long as they have the same uid? (This is in the general case where at least one of the two clients is executing with substantial restrictions.) For purposes of CVE, we may be able to model this as a situation in which the (realistically exploitable) counter wraparound is a clear implementation error and can have a CVE ID, but the concept of uid matching is a design change that is essentially outside the scope of CVE. Would that be OK? - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJVdfACAAoJEKllVAevmvmsm30H/2mgnbGvu8dH39DeFuAGHNZz UB7F680kDYPQr8onOQU9vBvLqxmEUFg9JA08EtnMeuKomcvH6UD8w9cQEv8TVtFw b9vDEYkrMKlY8V8sWvhebpnqOURUa9oy8wockAwq/ZAUlz1P9leaQ1N4w9emMvhj l4PheYuFb1OuIz8kUzhkq1adPeLKMFnjd8abVckHNFtSFhch8A/Lrl56qmJ26MGw 0Rgng4e3gziN1QDT4WsEqm0haehPitJefa61sEuWMcDh+aJjOKzBYScdGCk9A01d 91EFwwZMDq9QPYM1y3UlbvBuypSSafpgZEsJDIyBUeCSVBIAnWqJeJSYQvupyiM= =+9Uv -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ