[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20130227180248.GA31167@kroah.com>
Date: Wed, 27 Feb 2013 10:02:48 -0800
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request - Linux kernel: VFAT slab-based
buffer overflow
On Wed, Feb 27, 2013 at 06:46:30PM +0100, Jason A. Donenfeld wrote:
> On Wed, Feb 27, 2013 at 5:17 PM, Greg KH <greg@...ah.com> wrote:
> > Are you willing to do it?
>
> If it's a patch for an issue sent to security@, then it is, in fact, a
> "trivial task" as to whether or not it was a security fix. There's no
> issue of responsibility of judgement, at all.
That's not true at all, lots of things sent to security@ end up not
being security issues when they are fixed. Then there's the issue of
"what is and is not a security fix", and that is a discussion that we
aren't going to have here, sorry.
One problem is that there are very few things reported and fixed through
security@. Maybe one patch every other kernel release or so. And some
subsystems (i.e. networking) refuse to go through the security alias.
The _large_ majority of all fixes go through their individual subsystem
development process, and those are the ones you should be searching
through the commit logs for, as this patch itself proves.
thanks,
greg k-h
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
