oss-security - Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <513A0280.5030100@suse.de>
Date: Fri, 08 Mar 2013 16:23:44 +0100
From: Thomas Biege <thomas@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Requests (maybe): Linux kernel: various info
 leaks, some NULL ptr derefs

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Am 08.03.2013 06:07, schrieb Kurt Seifried:
> On 03/07/2013 09:55 PM, Petr Matousek wrote:
>> On Thu, Mar 07, 2013 at 01:19:05PM +0400, Solar Designer wrote:
>>> Kurt -
>>> 
>>> On Thu, Mar 07, 2013 at 02:13:37AM -0700, Kurt Seifried wrote:
>>>> Bundling the following into a single CVE:
>>> [...]
>>>> Please use CVE-2012-6138 for these issues.
>>> 
>>> I think this is wrong.  I would understand if those issues
>>> were all in the same subsystem at least (or if you assigned 
>>> per-subsystem CVE IDs for these), but this is not the case.
>>> Many distros will fix some, but not the others, or not all at
>>> the same time.  There's room for a little bit of bundling here,
>>> but not that much.
> 
>> In the past we've usually assigned one CVE per issue even for
>> info leak bugs. Or at least one CVE per subsystem, as Alexander
>> says. I agree with Alexander that one CVE for about ~20 issues is
>> not right.

So, are all CVE-IDs assigned before are invalid now? I just want to
make sure I didn't pollute our databases. :)

Cheers,
Thomas



> 
> Agreed (I was wrong, not much more to say than that =). It sounds
> like Mitre will be handling the additional CVEs for this issue as
> I understand it.
> 
> Now my question is how concise do we go with the Linux kernel as
> far as subsystems go? E.g. file subsystem vs network subsystem
> seems obvious, and say ext4 vs. MSDOS file system code seems
> obvious but what about network drivers (same chipset? same maker,
> different chipsets? or like ext2 vs ext3 vs ext4).
> 
> 

- -- 
Thomas Biege <thomas@...e.de>, Teamlead MaintenanceSecurity, CSSLP
SUSE LINUX GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB
21284 (AG Nürnberg)
- --
  Wer aufhoert besser werden zu wollen, hoert auf gut zu sein.
                            -- Marie von Ebner-Eschenbach
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJROgKAAAoJEJqHoVJVjr8DPUYIAN1Bhf+JkBFGH9xEFrrNCZ9m
9w21VJ3RKRPvKdK7I5+9xDTLxHsPuAwEkFMQY27Gs8ALGj4pYukiZ5ifCHJJX5wc
7EaXi5lI9c/wh7PMgVxqoIPQExq4LCHV6/W+b5yPra0A7faFcCkiQNeJfR4qd19z
3YaSEA0u7op0HugvgcOueCEt1b/dRBp6eGfM/ERQ+jNzAJPJoFtnz/x4Chsk+SE7
vKe0Z6RWngUaRsKG0Np+0rXl+HvKLhyL49J1MU2GAsBkYnTzjlalortLZHn0h7PE
jxBDgm6g3axhrQ7ZpbyHdW2xRThTuYthPJI+w85SvXlnPBfLmalpATcqKVhcXSQ=
=NVp2
-----END PGP SIGNATURE-----

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.