Date: Thu, 30 Jun 2022 22:12:46 +0200 From: Norbert Slusarek <nslusarek@....net> To: Solar Designer <solar@...nwall.com> Cc: oss-security@...ts.openwall.com, peterz@...radead.org, vegard.nossum@...cle.com Subject: Re: CVE-2022-1729: race condition in Linux perf subsystem leads to local privilege escalation >I'm attaching Norbert's exploit (lpe.c) that was attached to his May 12 >notification to linux-distros. We're now one month past the due date >for Norbert's expected posting of this (should have been May 27, which >is 7 days after public disclosure of the vulnerability on oss-security). > >Norbert, I would still appreciate a reply to the message below. I'm >quoting it in full for context since it's been a month. > >Thanks, > >Alexander > >"If you shared exploit(s) that are not an essential part of the issue >description, then at your option you may slightly delay posting them to >oss-security but you must post the exploits to oss-security within at >most 7 days of making the mandatory posting above. If you exercise this >option, you have two mandatory postings to make: first with a >sufficiently detailed issue description (as requested above) and with an >announcement of your intent to post the exploits separately (please >mention exactly when), and second with the exploits - or indeed you >could have included the exploits right away, in your first and only >mandatory posting." > >Did you read this before posting? If not, anything we should have done >to ensure you'd have read it? I missed it when I read the policy. I think having all of the requirements structured in one place is a good idea. Vegard's new page regarding reporting bugs in the Linux kernel makes it clear which essential rules to follow for the Linux security list as well as linux-distros and oss-security. Norbert
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.