Date: Thu, 26 May 2022 18:44:38 +0200 From: Norbert Slusarek <nslusarek@....net> To: Solar Designer <solar@...nwall.com> Cc: oss-security@...ts.openwall.com, peterz@...radead.org Subject: Re: CVE-2022-1729: race condition in Linux perf subsystem leads to local privilege escalation >What do you suggest we do regarding the LPE exploit you sent to >linux-distros? I saw your reveal of linux-distros from 2020 and the exchange didn't include any text nor attachments. In that case, the exploit should remain private to linux-distros accordingly. >What do you suggest we do with this policy aspect going forward, so that >people do not get into a situation where they're required to do >something they didn't want to subscribe to? How is this policy aspect enforced in the first place? If it's not, I suggest you remove it entirely as there is no reason to have policies which cannot (and shouldn't) be enforced. Overall, as a researcher I would prefer having a way just to inform distros of a bug, *without* being subject to these requirements. Norbert
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.