Date: Tue, 23 Nov 2010 12:00:51 -0500 From: Dan Rosenberg <dan.j.rosenberg@...il.com> To: oss-security@...ts.openwall.com Subject: Re: Linux kernel address leaks For starters, I don't want to turn this into a conversation about CVEs. The point of my post was to generate discussion on a particular class of information leakage and talk about how to address it. That said, MITRE's website defines an "exposure" (the "E" in "CVE") as follows : "An information security 'exposure' is a system configuration issue or a mistake in software that allows access to information or capabilities that can be used by a hacker as a stepping-stone into a system or network. CVE considers a configuration issue or a mistake an exposure if it does not directly allow compromise but could be an important component of a successful attack, and is a violation of a reasonable security policy." I don't think it's appropriate to use CVEs as a blackmailing tool, and I don't actually think these issues need CVEs. But claiming that it would be inappropriate to assign them because they're not "security problems" is a bit misguided. We're not talking about leaking function addresses here - we're talking about leaking the addresses of live kernel data structures, which in my opinion is more of a risk. -Dan  http://cve.mitre.org/about/terminology.html On Tue, Nov 23, 2010 at 11:46 AM, Marcus Meissner <meissner@...e.de> wrote: > On Tue, Nov 23, 2010 at 09:59:13AM +0100, Yves-Alexis Perez wrote: >> On lun., 2010-11-22 at 18:54 -0500, Michael Gilbert wrote: >> > Oh, and if you get CVEs assigned, that kind of forces them to fix the >> > problem, right? >> > >> I'm not that sure (there are CVEs for issues considered too small by the >> developers involved, not only in Linux, which are still opened), and I'm >> not sure using CVE system for “blackmailing” is a good usage for that >> tool. > > CVEs are for security problems. Leaking kernel function addresses to > userspace is not a security issue in my opinion. > > (Leaking content of kernel memory however is.) > > Ciao, Marcus >
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.