[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <Pine.GSO.4.64.1104051014001.20885@faron.mitre.org>
Date: Tue, 5 Apr 2011 10:28:51 -0400 (EDT)
From: "Steven M. Christey" <coley@...-smtp.mitre.org>
To: Josh Bressers <bressers@...hat.com>
cc: oss-security@...ts.openwall.com,
"Steven M. Christey" <coley@...-smtp.mitre.org>,
Eugene Teo <eugene@...hat.com>
Subject: Re: CVE request: kernel: multiple issues in ROSE
Given the complexity/number of patches, one could arguably call it "lack
of length validation" entirely, but I think it's reasonable to give it a
few CVE's. Note - we need different CVE's for the issues found by Dan
Hutchings versus those found by Dan Rosenberg.
Dan, could you confirm that this breakdown makes sense?
1) buffer overflows (not validating length is <= the maximum)
2) use of negative signed integers in memcpy() and other operations where
conversion creates a large unsigned integer, referred to as
"underflow"
3) any other types of problems that aren't covered by those two? (The
length validation checks don't always have enough context in the source
code).
We would need separate CVE's for the issues found by Dan versus the issues
found by Ben Hutchings.
Arguably, #2 could probably be broken down further, but without enough
source code context in the patches, it's not immediately clear.
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
