Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <514529694.39760564.1502113890222.JavaMail.zimbra@redhat.com>
Date: Mon, 7 Aug 2017 09:51:30 -0400 (EDT)
From: Vladis Dronov <vdronov@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: [CVE-2017-7533] kernel: inotify: a race between
 inotify_handle_event() and sys_rename()

Hello,

1) We would like to make an additional announcement that an important part of this flaw
research was conducted by Leilei Lin <leilei.lin@...baba-inc.com> of Alibaba Group, who
developed the initial patches:

https://patchwork.kernel.org/patch/9755753/
https://patchwork.kernel.org/patch/9755757/

2) Unfortunately, the wording "in the wild" in this announcement is probably incorrect.
The mentioned exploit was developed by the flaw researchers and we are not aware of it
being available publicly or used by a wider audience. We are sorry for this misinformation.

Best regards,
Vladis Dronov | Red Hat, Inc. | Product Security Engineer

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.