Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 26 May 2022 18:44:38 +0200
From: Norbert Slusarek <>
To: Solar Designer <>
Subject: Re: CVE-2022-1729: race condition in Linux perf
 subsystem leads to local privilege escalation

>What do you suggest we do regarding the LPE exploit you sent to

I saw your reveal of linux-distros from 2020 and the exchange
didn't include any text nor attachments. In that case, the
exploit should remain private to linux-distros accordingly.

>What do you suggest we do with this policy aspect going forward, so that
>people do not get into a situation where they're required to do
>something they didn't want to subscribe to?

How is this policy aspect enforced in the first place?
If it's not, I suggest you remove it entirely as there is no reason
to have policies which cannot (and shouldn't) be enforced.
Overall, as a researcher I would prefer having a way just to inform
distros of a bug, *without* being subject to these requirements.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.