[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 13 Nov 2017 16:15:24 +0100
From: Greg KH <greg@...ah.com>
To: Vladis Dronov <vdronov@...hat.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE-2017-15102: Linux kernel: usb: NULL-deref due
to a race condition in [legousbtower] driver
On Mon, Nov 13, 2017 at 10:07:00AM -0500, Vladis Dronov wrote:
> Hello, Greg, all,
>
> My fault here was indeed not stating that a Red Hat's product is
> vulnerable (thus, a CVE was assigned), but stating that only Linux
> kernel is vulnerable (while indeed it was fixed a long ago). Please,
> accept my apologies.
Ok, not a problem, thanks for the apology.
> > I hate to ask, but why are you getting CVEs for bugs fixed over a year
> > ago, and are already in all stable kernel releases a year ago? Why does
> > it matter?
>
> I'm afraid, you won't like the answer, but in a short word, the Red Hat
> is a CNA (CVE Numbering Authority) for Red Hat's products and the Linux
> kernel and we've decided to assign this CVE.
So the answer is just "we've decided to", right?
If so, that's fine, you are allowed to do so being a CNA, but what is
keeping you from doing the same for the thousands of other bugs that
have been fixed since this one that is in a specific Red Hat product?
It's the arbitrarily nature here that I am curious about, it feels like
it should be "all or nothing", for CVEs to mean much here. Right now it
seems like it is just, "all that we care to track"? :)
thanks,
greg k-h
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
