Date: Fri, 4 Aug 2017 10:51:51 -0700 From: Greg KH <greg@...ah.com> To: oss-security@...ts.openwall.com Cc: willemdebruijn.kernel@...il.com, Dmitry Vyukov <dvyukov@...gle.com>, Kostya Serebryany <kcc@...gle.com> Subject: Re: Reporting and disclosing Linux kernel vulnerabilities On Fri, Aug 04, 2017 at 06:59:15PM +0200, Andrey Konovalov wrote: > Hi! > > It's not completely clear to me how to properly report and disclose > Linux kernel security issues. As your document shows, it all depends on what type of issue it is, and what _you_ want to get out of it.  > There are a few different parties [1, 2, 3] that need to be informed > and coordinated. Again, it depends on what you want to do :) > I couldn't find a publicly available actionable list of steps, so I've > outlined it as I see it here: > > https://github.com/google/syzkaller/blob/master/docs/linux_kernel_reporting_bugs.md#reporting-security-bugs > > Thoughts? Comments? That looks like a good start, nice job. thanks, greg k-h  This matters a lot. Here's my feeling on the matter: If you just want the bug fixed so you can get on with whatever else you were doing, just notify security@...nel.org, the bug will get fixed and pushed out to all kernel.org trees as soon as possible. If you think it affects users of the "traditional" Linux distros, then contact distros and hope someone contacts firstname.lastname@example.org later to get the issue resolved for everyone else. If it affects only an odd one-off or embedded device that will never get updated, again, email@example.com and oss-security to get some public leverage to try to get the vendor to fix the issue. If you don't really care what happens to anyone, oss-security works :)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ