[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 26 Jun 2017 16:59:57 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: pageexec@...email.hu, oss-security <oss-security@...ts.openwall.com>
Subject: Re: Re: More CONFIG_VMAP_STACK vulnerabilities,
refcount_t UAF, and an ignored Secure Boot bypass / rootkit meth
On 2017-06-26 3:50 PM, PaX Team wrote:
> On 26 Jun 2017 at 13:47, Kurt Seifried wrote:
>
>> I think we can agree as a community of professionals that insults and name
>> calling are unnecessary and also not very effective.
> I completely agree with you but then I can't explain why you chose to insult
> our projects last week and still have not remedied it (both the CVE and your
> insulting tweet are still up). I find it curious how you can preach about
> professionalism after being the very instigator of the recent splat (heck,
> instead of answering, you called it a conspiracy theory when I asked you in
> private why you issued the CVE to begin with which then forced us to take
> the issue public).
So as per the private email thread we had previously I'm not going to be
interacting with you beyond what is strictly neccesary for CVE and other
professional purposes.
One the CVE REJECT side, CVE-2017-1000377 looks legitimate, although I'm
inclined to agree with Qualys and REJECT it so that you stop emailing. I
did contact MITRE, I haven't had time to reply to them yet (they are
also wondering why the CVE needs REJECT'ing), as such I think it may be
best to recuse myself from this specific CVE and let you handle this
with MITRE. I have also previously told you how to go about doing this.
I will say that CVE identifiers doesn't just cover full code execution
flaws, but also covers situations where for example a security property
is claimed but is not as effective as we thought (e.g. the stackguard
page size in this case). Many CVE's are not fully exploitable on their
own but are part of an exploit chain.
>
> cheers,
> PaX Team
>
--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert@...hat.com
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
