[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sat, 11 Nov 2017 14:49:19 -0500
From: Stuart Gathman <stuart@...hman.org>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2017-15102: Linux kernel: usb: NULL-deref due
to a race condition in [legousbtower] driver
On 11/09/2017 12:09 PM, David A. Wheeler wrote:
> In the US, there has been recent proposed legislation that requires
> that "Internet of Things" devices sold to the federal government cannot have
> "known security vulnerabilities" ("Internet of Things Cybersecurity Improvement
> Act of 2017" proposed by Senators Mark Warner (R-Va.) and Cory Gardner (D-Colo.)).
> I suspect many other countries have or will pass similiar laws,
> or will interpret their existing laws this way.
> It's easy to argue that known security vulnerabilities are known flaws
> that should be remediated by the manufacturer (at no cost to the consumer).
>
> I agree that many vulnerabilities don't have CVE ids.
> You don't need to identify *all* vulnerabilities in old kernels... just enough to make
> it easier to update the kernel than try to back-patch everything.
> If manufacturers have to fix the CVEs to sell products, or to avoid massive returns,
> that creates an *economic* reason for manufacturers to
> begin responsibly maintain their products.
This will create an economic reason to use closed source software - as
there would then be far fewer "known security vulnerabilities".
"As long as we keep it secret, we don't have to fix it...."
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
