Date: Tue, 28 Apr 2009 20:27:19 -0500 From: Steven French <sfrench@...ibm.com> To: dann frazier <dannf@...ian.org> Cc: oss-security@...ts.openwall.com, security@...nel.org, jlayton@...hat.com Subject: Re: CVE request? buffer overflow in CIFS in 2.6.* Jeff (Layton) was working an additional fix (updating a proposed fix from Suresh J.). We will review it together tomorrow. Steve French Senior Software Engineer Linux Technology Center - IBM Austin phone: 512-838-2294 email: sfrench at-sign us dot ibm dot com dann frazier <dannf@...ian.org> 04/28/2009 08:12 PM To oss-security@...ts.openwall.com cc security@...nel.org, Steven French/Austin/IBM@...US Subject Re: [oss-security] CVE request? buffer overflow in CIFS in 2.6.* On Sat, Apr 25, 2009 at 05:40:20PM +0800, Eugene Teo wrote: > Hi Steve, > > > One approach might be to "pre-tag" this whole set of changes with a single > > CVE, then when they ultimately get merged into a single kernel version or > > some other concrete milestone, the "scope" of that CVE ends. > > I'm fine with this approach. It can actually help to make it easier to > manage this set of changes. To summarize (and make sure I understand), the plan is to create a single CVE for a collection of CIFS fixes. So far, this series includes the following changesets, but others may be added as well: http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.29.y.git;a=commitdiff;h=15bd8021d870d2c4fbf8c16578d72d03cfddd3a7 http://git.kernel.org/?p=linux/kernel/git/sfrench/cifs-2.6.git;a=commitdiff;h=f083def68f84b04fe3f97312498911afce79609e http://git.kernel.org/linus/27b87fe52baba0a55e9723030e76fce94fabcea4 http://git.kernel.org/?p=linux/kernel/git/sfrench/cifs-2.6.git;a=commit;h=7b0c8fcff47a885743125dd843db64af41af5a61 http://git.kernel.org/?p=linux/kernel/git/sfrench/cifs-2.6.git;a=commit;h=968460ebd8006d55661dec0fb86712b40d71c413 Is that correct? If so, is there an estimate for when this set will be deemed complete and a CVE assigned? I think that if we wait too long to close this, we'll end up with distributions releasing updates with only a subset of these fixes, which would make this "collection" somewhat difficult to track by CVE ID handle. I'm otherwise quite happy with this plan, fwiw. -- dann frazier
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.