Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 4 Aug 2017 10:51:51 -0700
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Cc: willemdebruijn.kernel@...il.com, Dmitry Vyukov <dvyukov@...gle.com>,
	Kostya Serebryany <kcc@...gle.com>
Subject: Re: Reporting and disclosing Linux kernel
 vulnerabilities

On Fri, Aug 04, 2017 at 06:59:15PM +0200, Andrey Konovalov wrote:
> Hi!
> 
> It's not completely clear to me how to properly report and disclose
> Linux kernel security issues.

As your document shows, it all depends on what type of issue it is, and
what _you_ want to get out of it. [1]

> There are a few different parties [1, 2, 3] that need to be informed
> and coordinated.

Again, it depends on what you want to do :)

> I couldn't find a publicly available actionable list of steps, so I've
> outlined it as I see it here:
> 
> https://github.com/google/syzkaller/blob/master/docs/linux_kernel_reporting_bugs.md#reporting-security-bugs
> 
> Thoughts? Comments?

That looks like a good start, nice job.

thanks,

greg k-h

[1] This matters a lot.  Here's my feeling on the matter:

    If you just want the bug fixed so you can get on with whatever else
    you were doing, just notify security@...nel.org, the bug will get
    fixed and pushed out to all kernel.org trees as soon as possible.

    If you think it affects users of the "traditional" Linux distros,
    then contact distros and hope someone contacts security@... later to
    get the issue resolved for everyone else.

    If it affects only an odd one-off or embedded device that will never
    get updated, again, security@... and oss-security to get some public
    leverage to try to get the vendor to fix the issue.

    If you don't really care what happens to anyone, oss-security works :)

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ