Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 23 Nov 2010 12:00:51 -0500
From: Dan Rosenberg <>
Subject: Re: Linux kernel address leaks

For starters, I don't want to turn this into a conversation about
CVEs.  The point of my post was to generate discussion on a particular
class of information leakage and talk about how to address it.

That said, MITRE's website defines an "exposure" (the "E" in "CVE") as
follows [1]:

"An information security 'exposure' is a system configuration issue or
a mistake in software that allows access to information or
capabilities that can be used by a hacker as a stepping-stone into a
system or network.

CVE considers a configuration issue or a mistake an exposure if it
does not directly allow compromise but could be an important component
of a successful attack, and is a violation of a reasonable security

I don't think it's appropriate to use CVEs as a blackmailing tool, and
I don't actually think these issues need CVEs.  But claiming that it
would be inappropriate to assign them because they're not "security
problems" is a bit misguided.  We're not talking about leaking
function addresses here - we're talking about leaking the addresses of
live kernel data structures, which in my opinion is more of a risk.



On Tue, Nov 23, 2010 at 11:46 AM, Marcus Meissner <> wrote:
> On Tue, Nov 23, 2010 at 09:59:13AM +0100, Yves-Alexis Perez wrote:
>> On lun., 2010-11-22 at 18:54 -0500, Michael Gilbert wrote:
>> > Oh, and if you get CVEs assigned, that kind of forces them to fix the
>> > problem, right?
>> >
>> I'm not that sure (there are CVEs for issues considered too small by the
>> developers involved, not only in Linux, which are still opened), and I'm
>> not sure using CVE system for “blackmailing” is a good usage for that
>> tool.
> CVEs are for security problems. Leaking kernel function addresses to
> userspace is not a security issue in my opinion.
> (Leaking content of kernel memory however is.)
> Ciao, Marcus

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.