Date: Wed, 19 Dec 2012 11:08:11 -0700 From: Kurt Seifried <kseifried@...hat.com> To: oss-security@...ts.openwall.com CC: Greg KH <greg@...ah.com> Subject: Re: Plug-and-wipe and Secure Boot semantics -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 On 12/19/2012 09:34 AM, Greg KH wrote: > We don't know what vendors are basing their UEFI bios > implementation on the open source version, I know there is at least > one UEFI bios that is not based on the open source version, or so > it is reported (the BSD license of Tianocore means that we will > never really know.) > > Determining what machine is running what bios from what company > that was based on what version of the open source UEFI > implementation is going to be a huge problem in the long run and > something that I sure don't want to have to track. > > There have been reported bugs in the Tianocore in the past, I > don't think they were "security" issues in and of themselves, > should we be reporting them here to get CVE numbers if they are? If it's a security issue it should ideally get a CVE so it can be tracked. I only do Open Source CVE assignments though, for closed source stuff/etc you'd want to ask cve-assign@...re.org directly. > thanks, > > greg k-h - -- Kurt Seifried Red Hat Security Response Team (SRT) PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993 -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) iQIcBAEBAgAGBQJQ0gKLAAoJEBYNRVNeJnmTsnkP/icX2MQbPxUKwQS7VylIoq56 yLRUmt49Mn2LGRv6j6SsB0oSOeS/f5uybLu+exAv5Vs1fhLv9wycw4mMQfDuPStK NmIUUf2P7boNCxxzYr7Kj7/1VAP7k7EnMiUYSvrFl8CLVNI5YyA//u5WX5kZVcg6 w1tl98sMUBdLKftIruFO/bK8dCS+O6SICNKTQSEj5Kp+bPLx5wLWo1i0eO1YvzJu E7xKGiQWYbVZ88zPI3yRE/FIn739VPhAeNc9TEGPmKC1RefpcIwlZmyL1lVGMeha sX8mKRQUK1E1sOtME09tK3IQjHBzWYTlofojt8vjQ5a8bAlFeQolZvvfUMUYIWcf lPTpoDprIVkwbFVpGz82KRSIF5+v0/6G24qizIJGzpSYstZ97xj6X9fSg9bNAPq+ Aj7/Cy8K55moJqIDkIv3yOkco784+F2/eqYIzlXXkMd0yuvIe22PtvlPyD1x2Lx0 dOjj8yYxPAG1kA6xhHo6r/+2cAC4LNQ1B0jK1llcCpmJBkYGxGQXfT0Nztb2sRiH BBoWxkX8SPYIFHZhQGIDsRvQdSBtxsH3VVaG9G6V8UNvMe86Rak2bhN0qwnj4rZ3 plie/zLzE1qKIMNtXq41ZyWqu2Id1U725mjEVGaTiie/VPQ1iEjPQ1dSa4POFI5G WUVPO0+NFdvBhhcGhL18 =AJfT -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.