Date: Thu, 27 Jun 2013 23:04:58 -0400 From: Alexandre Rebert <alexandre.rebert@...il.com> To: coley@...re.org Cc: oss-security@...ts.openwall.com, kseifried@...hat.com, Russ Allbery <rra@...nford.edu>, cve-assign@...re.org Subject: Re: 1.2k bug reports for Debian, some may be security Hi, I can confirm most of the bugs have no security implications, and should probably not get CVEs. Given the high number of crashes we found, it is highely likely that some will impact security though. Mayhem considered multiple input sources during the analysis of the 23K binaries: environment variables, command line arguments, files and standard input. Sockets was not one of them. That means that we only need to consider two attack vectors: (1) crashes of setuid/setgid programs, and (2) crashes with input files that are potentially untrusted. For (1), I have not checked whether we found crashes in setuid/setgid programs yet. It is however straightforward to compile a list and forward it to whoever is filing the CVEs. They might not be exploitable, but a crash in such programs is concerning and might be worth a CVE. Let me know if that's something you'd like us to do. For (2), it is difficult to automatically identify such crashes. As Steve mentioned, it may require a deep familiarity with the program. Package maintainers or upstream developers are the most suited people to judge whether a crash should be considered security critical. It is an unsatisfying solution, as the burden to report vulnerabilities would lie on them, but I don't see a way around it. > I was under the impression from an incomplete read of the MAYHEM paper that > it could generate shellcode for code execution, yet I'm only hearing of > reports for crashes. If code execution can be proven, then that may be > informative. Yes, that is correct. Mayhem actually generated a couple of exploits from the crashes we found. We are currently looking at them individually, and we will report all exploits that are security issues. Regards, The Mayhem Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.