[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20181214131542.GA24885@openwall.com>
Date: Fri, 14 Dec 2018 14:15:42 +0100
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: Jann Horn <jannh@...gle.com>
Subject: Re: Linux kernel: userfaultfd bypasses tmpfs file permissions (CVE-2018-18397; since 4.11; fixed in 4.14.87 and 4.19.7)
Important correction:
On Fri, Dec 14, 2018 at 02:07:55PM +0100, Solar Designer wrote:
> > On Wed, 2018-12-12 at 15:24 +0100, Solar Designer wrote:
> > > A question to ask may be: out of Linux kernel vulnerabilities being
> > > patched, are there more high and critical overall severity (e.g., as
> > > risk impact times risk probability) vulnerabilities found in "too
> > > recent" kernels than there are high and critical severity untracked
> > > vulnerabilities (also or instead) affecting "sufficiently old" kernels?
> [...] to answer my question above we need median and not average.
Actually, that wouldn't answer this exact question - it'd answer a
similar question about tracked vulnerabilities, and the answer would
tell us how frequently a vulnerability would need to be patched on a
system (apparently, 1/8 of the time for RHEL7 vs. latest mainline now).
We can't answer the question about untracked vulnerabilities from
per-vulnerability data because untracked implies we lack such data.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
