Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 28 Feb 2013 00:28:48 +0100 (CET)
From: Jiri Kosina <jikos@...os.cz>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request - Linux kernel: VFAT slab-based buffer
 overflow

On Wed, 27 Feb 2013, Greg KH wrote:

> > May I just bluntly call out shenanigans here? Yes, some bugs are
> > esoteric and it's not immediately obvious that they are security
> > related. But there are so many bugs that are _clearly_
> > security-related.
> 
> Really?  Ok then, please go ahead and try doing this yourself if you
> feel it is so "obvious" to do.

What Jason is asking for (at least to my understanding) is that if we are 
fixing a bug from a known-to-automatically-be-security-issue, we let the 
world know explicitly.
We are not pro-actively doing that now, are we?

Yes, there are going to be lots and lots of bugs which turn out to be 
security issues once analyzed by super-smart guys wearing their 
darker-coloured hats, and that's unavoidable.
Killing all the efforts that try to mitigate this effect with as little 
investments as possible seems to be slightly counter-productive though.

We are not going to be perfect at it, ever, sure. Perfect is the enemy of 
good.
Also, defining the list in a sensible way is challenging of course, but 
let's have this for starters:

- use-after-free
- null(+epsilon) pointer dereference
- array access overflow
- signedness problem in sizeof() with argument coming from userspace
- operating VMAs without mmap_sem
- ...

Hmm?

-- 
Jiri Kosina

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.