Date: Mon, 20 Apr 2015 12:34:23 -0400 (EDT) From: cve-assign@...re.org To: danmcd@...iti.com Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE request - illumos -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > Illumos bug #5853 (https://www.illumos.org/issues/5853), now fixed, can > be exploited to escalate privilege. It's not easy to do so, but it is > enough to cause concern and ask for a CVE number. > > At least two distros already have this fix in place. I'd appreciate a > CVE number (and if possible a way to request these on a non-public > list... sorry if I missed the FAQ). Yes, there can be a CVE mapping for this. However, because there's additional information in https://www.illumos.org/issues/5853 that's not discussed in your message, we don't know whether one or two CVE IDs is the correct number. If each of the two observations of "default error is negative one. However, callers are expecting errnos or zero." and "we're supposed to be checking the alignment of two different offsets, pfr_loff and pfr_ioff, but end up checking pfr_loff twice" could be independently exploitable, then there will be two CVE IDs. If only one is exploitable, or if exploitation requires both, then there will be one CVE ID. The cve-assign@...re.org address can be used for non-public requests for illumos CVEs. There may be other options for the open-source parts, but we think that not all of illumos is open source. http://wiki.illumos.org/display/illumos/illumos+FAQs says "There still remain some binary-only, closed source components that we inherited from Oracle." If the component also affects an Oracle product, then Oracle could assign the CVE ID. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.14 (SunOS) iQEcBAEBAgAGBQJVNSoVAAoJEKllVAevmvmsdNUH/i2pmI4pWlW/hREqWhMt15HG tjkozI17nMUh3RRGp0eYcc0lHUVMlvSTcEZI/4XNhtSh5RaUlHSEYEolvE767WY8 odgLDuQK8yvDTpXA0rxvmnYiBy4ZR+kZrmx2ejtJfSeR7df7UwjpMwSJYyoirffa wbfqxv1Pniww9tN1GfZyPIg9Hf6+9ib+QB/CZhzW5nF/7XLlvcttRzPeO5lxEN5V y/0b5i73N0KD1QfF7ubNG4hIa3foXkz4v2UplAy5XYt/Zw6la4v9XNKNReP+bLRj MxTuluANPV5U62wSy5h27QpzfZaHKoJjCoYNurl3BYfribv6hoNa7Wle4ZCJKsg= =d2+H -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.