[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 23 Jul 2015 03:30:08 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: Linux x86_64 NMI security issues
Andy et al.,
First of all, thank you for your hard work on these issues!
On Wed, Jul 22, 2015 at 11:12:00AM -0700, Andy Lutomirski wrote:
> +++++ CVE-2015-3291 +++++
> +++++ CVE-2015-5157 +++++
> +++++ NMI bug, no CVE assigned +++++
> +++++ CVE-2015-3290 +++++
Red Hat folks, and Petr in particular - please post to this thread when
you have statements on which RHEL kernels are affected by which of these
issues. RHEL kernels are upstream for several other distros/projects.
Finally, I'm afraid I have to remind you Andy that we have a policy in
here to avoid CC'ing other mailing lists on oss-security postings (and
vice versa), and especially not to do that with LKML:
http://oss-security.openwall.org/wiki/mailing-lists/oss-security#list-content-guidelines
"Please don't cross-post messages to oss-security and other mailing
lists at once, especially not to high-volume lists such as LKML and
netdev, as this tends to result in threads that wander partially or
fully off-topic (e.g., Linux kernel coding style detail may end up being
discussed in comments to a patch posted to LKML, but it would be
off-topic for oss-security). If you feel that something needs to be
posted to oss-security and to another list, please make separate
postings. You may mention the other posting(s) in your oss-security
posting, and even link to other lists' archives."
The threads on linux-distros (where Andy first brought one of these
issues on July 13) were very interesting, but they'd be beyond what all
but very few oss-security subscribers need. It would be "unaffordable"
for most subscribers to read a hundred of messages in a few days on x86
NMI specifics and Linux kernel internals. I guess your CC'ing LKML
won't result in a similar thread being CC'ed in here, but it might, and
if it does it'd be really tough for oss-security moderators to handle it
well (accepting all such messages would be bad, and rejecting some also
bad since it breaks the thread).
That said, the detail level of your posting is just right for this list,
and I am looking forward to seeing you add more detail later as you
wrote you intend to. I am only worried about the uncontrolled CC's of
future postings from the LKML side.
Thanks again,
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
