Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 7 Nov 2017 20:30:05 +0000
From: "Maier, Kurt H" <kurt.maier@...l.gov>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: CVE-2017-15102: Linux kernel: usb: NULL-deref
 due to a race condition in [legousbtower] driver

On Tue, 2017-11-07 at 21:22 +0100, Greg KH wrote:
> 
> I hate to ask, but why are you getting CVEs for bugs fixed over a
> year
> ago, and are already in all stable kernel releases a year ago?  Why
> does
> it matter?
> 
> Unless you happen to have a product that doesn't ever do kernel
> updates
> from the stable trees, and well, then you know what you are doing and
> don't need CVEs assigned either, right?  :)
> 

Kernel maintainers' policy is clear, and nobody is asking for that to
change, but please don't sandbag the process of keeping track of
vulnerabilities.  The fraction of "products" (regardless of vendor)
that run linux and never get updates approaches unity.  Being able to
precisely catalog which linux releases suffer from which
vulnerabilities is useful to many.

khm

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.