Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 4 Aug 2017 10:51:51 -0700
From: Greg KH <>
Cc:, Dmitry Vyukov <>,
	Kostya Serebryany <>
Subject: Re: Reporting and disclosing Linux kernel

On Fri, Aug 04, 2017 at 06:59:15PM +0200, Andrey Konovalov wrote:
> Hi!
> It's not completely clear to me how to properly report and disclose
> Linux kernel security issues.

As your document shows, it all depends on what type of issue it is, and
what _you_ want to get out of it. [1]

> There are a few different parties [1, 2, 3] that need to be informed
> and coordinated.

Again, it depends on what you want to do :)

> I couldn't find a publicly available actionable list of steps, so I've
> outlined it as I see it here:
> Thoughts? Comments?

That looks like a good start, nice job.


greg k-h

[1] This matters a lot.  Here's my feeling on the matter:

    If you just want the bug fixed so you can get on with whatever else
    you were doing, just notify, the bug will get
    fixed and pushed out to all trees as soon as possible.

    If you think it affects users of the "traditional" Linux distros,
    then contact distros and hope someone contacts security@k.o later to
    get the issue resolved for everyone else.

    If it affects only an odd one-off or embedded device that will never
    get updated, again, security@k.o and oss-security to get some public
    leverage to try to get the vendor to fix the issue.

    If you don't really care what happens to anyone, oss-security works :)

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.