Date: Wed, 4 May 2016 06:21:52 -0700 From: Greg KH <greg@...ah.com> To: oss-security@...ts.openwall.com Cc: Taesoo Kim <taesoo@...ech.edu>, Chengyu Song <csong84@...ech.edu>, Insu Yun <insu@...ech.edu> Subject: Re: CVE Request: information leak in wilc1000 module of Linux kernel On Wed, May 04, 2016 at 09:12:52AM -0400, Kangjie Lu wrote: > Hello, > > In the milc1000 module (drivers/staging/wilc1000/wilc_wfi_cfgoperations.c), > The 6-bytes stack object “mac” is not initialized but leaked via “nla_put”. > This bug may result in leaks of sensitive kernel stack data. > > The patch of this bug has been accepted by Linux kernel maintainer and will > be > merged in the next kernel release (see the message bellow). > > Fix info: > *http://www.spinics.net/lists/linux-wireless/msg150352.html > <http://www.spinics.net/lists/linux-wireless/msg150352.html>* > git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging.git > > Could you please assign a CVE to it? I wouldn't recommend CVEs for drivers in the staging portion of the Linux kernel tree. It's just too easy to find bugs in them, and very few distros actually enable them. Unless you want to prove that CVEs don't really mean much :) thanks, greg k-h
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.