Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.64.1104051014001.20885@faron.mitre.org>
Date: Tue, 5 Apr 2011 10:28:51 -0400 (EDT)
From: "Steven M. Christey" <coley@...-smtp.mitre.org>
To: Josh Bressers <bressers@...hat.com>
cc: oss-security@...ts.openwall.com,
        "Steven M. Christey" <coley@...-smtp.mitre.org>,
        Eugene Teo <eugene@...hat.com>
Subject: Re: CVE request: kernel: multiple issues in ROSE


Given the complexity/number of patches, one could arguably call it "lack 
of length validation" entirely, but I think it's reasonable to give it a 
few CVE's.  Note - we need different CVE's for the issues found by Dan 
Hutchings versus those found by Dan Rosenberg.

Dan, could you confirm that this breakdown makes sense?

1) buffer overflows (not validating length is <= the maximum)

2) use of negative signed integers in memcpy() and other operations where
    conversion creates a large unsigned integer, referred to as
    "underflow"

3) any other types of problems that aren't covered by those two?  (The
    length validation checks don't always have enough context in the source
    code).

We would need separate CVE's for the issues found by Dan versus the issues 
found by Ben Hutchings.

Arguably, #2 could probably be broken down further, but without enough 
source code context in the patches, it's not immediately clear.

- Steve

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.