Re: CVE request - Linux kernel: VFAT slab-based buffer overflow

[Michael Gilbert <mgilbert () debian org>]

On Tue, Feb 26, 2013 at 6:05 PM, Jason A. Donenfeld wrote:
> On Tue, Feb 26, 2013 at 10:05 PM, Kurt Seifried
> > The problem with security is you have to basically do it 100%
> > correctly 100% of the time, otherwise things fall through the cracks
> > (like this VFAT thing).
>
> Also, what about the tmpfs one from yesterday? Nobody involved in the
> patch reported that as a security bug to this list, until I saw it
> myself, just by chance, as a random person on the internet, and posted
> it to the list. In that case, it was clearly marked "use-after-free",
> but nobody involved requested a CVE.

I actually see Greg KH's recent interest in oss-sec as a positive
sign.  For years and years kernel developers have been stuck at the
first stage of grieving (denial).  Thanks to recent public shaming,
the second stage (anger) is seeming to set in, which at the very least
is progress.  Personally, I'm hoping to see bargaining in fewer than
the 20 years it took to get here.  There are five stages total, so if
each takes as long as the first, there is the distinct possibility
that we'll be waiting a century for a high-quality kernel security
posture ;)

Anyway, on a more serious note, at some point, acceptance will look
something like a real kernel-sec team that does essentially what you
just did, but on a continual basis: reviewing most/all commits for
potential security concerns and forwarding them to oss-sec to increase
identification and awareness to be applied downstream.  Unfortunately
a person/group needs to want to scratch that particular itch, and more
importantly be able to deal with leaders antipathetic to their work.
Also, as Kurt was alluding to, the rewards don't seem to be there, and
of course there is a lot of potential for pain (i.e. dealing with the
anger).

Best wishes,
Mike