Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 13 Dec 2018 21:02:12 +0100
From: Yves-Alexis Perez <corsac@...ian.org>
To: oss-security@...ts.openwall.com
Cc: Jann Horn <jannh@...gle.com>
Subject: Re: Linux kernel: userfaultfd bypasses tmpfs file
 permissions (CVE-2018-18397; since 4.11; fixed in 4.14.87 and 4.19.7)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

On Wed, 2018-12-12 at 15:24 +0100, Solar Designer wrote:
> A question to ask may be: out of Linux kernel vulnerabilities being
> patched, are there more high and critical overall severity (e.g., as
> risk impact times risk probability) vulnerabilities found in "too
> recent" kernels than there are high and critical severity untracked
> vulnerabilities (also or instead) affecting "sufficiently old" kernels?

Data collected by Kees and regularly updated might help here. See 
https://events.linuxfoundation.org/wp-content/uploads/2017/12/Overview-and-Recent-Developments-Kernel-Self-Protection-Project_Kees-Cook.pdf#%5B%7B%22num%22%3A22%2C%22gen%22%3A0%7D%2C%7B%22name%22%3A%22XYZ%22%7D%2C0%2C446.4%2C0%5D
for the last edition (sorry for the weird anchor, in case it breaks it's on
slide 5)

Regards,
- -- 
Yves-Alexis
-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEE8vi34Qgfo83x35gF3rYcyPpXRFsFAlwSusQACgkQ3rYcyPpX
RFvdUwf+J6G9ACV35269DdJSWO27c/LuAhuxxCHbSjEf3EeGamBcEksV6+OysAiv
9oy/iwnk37ksv7ZlRDiJbhIRZQyKWv8vTHx+X0ntgi5MIs31Yby3Q3agL1irW+b+
2DnUoeoZH+RIXk9Tm97XfJTDm9hJere7hwI8jQAUuNf/a2vu9oDlCYnvh5ZRz537
4Q4w2lR03dsRCm8gvDFtbLjYzTu3xoscEkHafxoSbU/7RLkqYAmbU6FhqfZ4MQ9m
Q/oNIDIw/Lh28kByTII98Af6P03td1pS1aPre8KYw62BuJrZ87+z22ehjP7j5srm
l0Qx1W3g6fudzwY4RVTkqtQMyAZ5/w==
=O/RN
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.