Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 31 Jan 2014 17:27:22 -0700
From: Kurt Seifried <>
Subject: Re: Linux 3.4+: arbitrary write with CONFIG_X86_X32

Hash: SHA1

On 01/31/2014 09:34 AM, wrote:
>>>>>> "SD" == Solar Designer <> writes:
> SD> Hi, This issue was brought to linux-distros and security@k.o 2 
> SD> days ago via the message quoted below, and it was just made SD>
> public at 22:00 UTC today (two hours ago) via grsecurity and PaX 
> SD> (who were the ones to find the issue).  Normally, the person
> who SD> brought this to linux-distros would be the one responsible
> to SD> bring the issue to oss-security as soon as the issue is
> public, SD> but Kees does not appear to be around at the moment and
> the SD> issue is critical enough that I find it inappropriate to
> delay SD> this posting by a few hours more, hence I am doing Kees'
> job by SD> posting this in here.
> SD> This is CVE-2014-0038 (assigned shortly after Kees sent the SD>
> message below).  I will also include PaX Team's revised patch SD>
> below.
> Are you sure this is the correct CVE? It was assigned already
> beginning of Dec. last year.
> Roland

According to the Wikipedia entry on CVE (which I rewrote =):

Date Entry Created

This is the date the entry was created. Please note that for CVEs
assigned directly by Mitre this is the date Mitre created the CVE
entry. For CVEs assigned by CNAs (e.g. Microsoft, Oracle, HP, Red Hat,
etc.) this is also the date the entry was create by Mitre, not by the
CNA. So in the case where a CNA requests a block of CVE numbers in
advance (e.g. Red Hat currently requests CVEs in blocks of 500) the
entry date would be when that CVE is assigned to the CNA. The CVE
itself may not be used for days, weeks, months or even possibly years
(e.g. Red Hat maintains blocks of CVEs for older security issues in
Open Source software that were not assigned a CVEs yet).

So late last year I asked for and received a block of 2014 CVE's from
Mitre which we are now assigning as issues come to light. So yeah,
we're all good.

- -- 
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Version: GnuPG v1


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.