oss-sec mailing list archives
Re: handling of Linux kernel vulnerabilities (was: CVE request - Linux kernel: VFAT slab-based buffer overflow)
From: Eric Lacombe <goretux () gmail com>
Date: Tue, 05 Mar 2013 10:26:22 +0100
Le mardi 5 mars 2013 09:20:49, Greg KH a écrit :
On Mon, Mar 04, 2013 at 10:12:56PM +0100, Eric Lacombe wrote:Hi, Le lundi 4 mars 2013 11:48:58, Greg KH a écrit :On Sun, Mar 03, 2013 at 10:39:30PM -0500, Michael Gilbert wrote:I was getting encouraged by the recent anger-centric posts, the "what is it that we're supposed to do better?" ones. That gave me some encouragement that there was the possibility of positive change, but the "we're not going to make users more unsafe by telling them about issues affecting them" is a persistence of the denial state. That logic completely violates the known idiom that knowledge is power: give users the knowledge that they need to protect themselves, and they will; starve them of that knowledge, and they remain vulnerable.That's a load of crap. Seriously, you know it only benefits the "bad guys" if I were to say, "This patch just went into Linus's tree that fixes a security problem that you can exploit in this manner". No user would have a chance to fix their systems before the vulnerability was added to the "ultra-sploit" tool and everyone would have their systems trashed.I think there's a difference between disclosing the vulnerability and disclosing it with a related exploit. The first one allows to fulfill what Michael Gilbert explains without the consequences that you focus on.You really think there is a difference? I assert that there is none, and history has shown that this is the case, but feel free to prove me wrong.
It depends on the way you look at it : For really skilled bad guys, disclosing the vulnerability and the exploit with it or not doesn't make such a difference, because in the first place they are able to look at the kernel commits and spot what they care about for their evil job. No matter, there is public disclosure or not. And these really bad guys are not pushed to share this information to everyone. Besides, it seems more interesting for this kind of guys to keep their findings secret (to make money, to rebel on something through cyber attack means, ...) (What would be the purpose otherwise? --> Pure Evil? ). But disclosing to everyone the vulnerability and the exploit _altogether_, does benefit all the script kiddies, all the malicious persons not skilled enough to develop their own exploits (and we can agree that it depends on the vulnerabilities. Remember CVE-2008-0009 and CVE-2008-0010, about vmsplice. It was not thoroughly understood by everyone from the beginning). Thus, my point is that disclosing the vulnerability benefits more the good guys than it does increase the risk of the exploitation of the vuln. But disclosing the exploit _at the same time_ can only negatively impact the outcome, because lots of good guys (end users, but not only, some admins, ...) will not look at it, they only bother to know if there is security issues, in order to take a decision on updating their systems. By the way it's only my feelings on this topic. Best regards, Eric Lacombe
Current thread:
- Re: handling of Linux kernel vulnerabilities (was: CVE request - Linux kernel: VFAT slab-based buffer overflow), (continued)
- Re: handling of Linux kernel vulnerabilities (was: CVE request - Linux kernel: VFAT slab-based buffer overflow) Greg KH (Mar 03)
- Re: handling of Linux kernel vulnerabilities (was: CVE request - Linux kernel: VFAT slab-based buffer overflow) Michael Gilbert (Mar 03)
- Re: handling of Linux kernel vulnerabilities (was: CVE request - Linux kernel: VFAT slab-based buffer overflow) Greg KH (Mar 03)
- Re: handling of Linux kernel vulnerabilities (was: CVE request - Linux kernel: VFAT slab-based buffer overflow) Eric Lacombe (Mar 04)
- Re: handling of Linux kernel vulnerabilities (was: CVE request - Linux kernel: VFAT slab-based buffer overflow) Greg KH (Mar 04)
- Re: handling of Linux kernel vulnerabilities Kurt Seifried (Mar 04)
- Re: handling of Linux kernel vulnerabilities Solar Designer (Mar 04)
- Re: handling of Linux kernel vulnerabilities Noel Butler (Mar 05)
- Re: handling of Linux kernel vulnerabilities Solar Designer (Mar 05)
- Re: handling of Linux kernel vulnerabilities Alton Moore (Mar 05)
- Re: handling of Linux kernel vulnerabilities (was: CVE request - Linux kernel: VFAT slab-based buffer overflow) Eric Lacombe (Mar 05)
- Re: handling of Linux kernel vulnerabilities Andreas Ericsson (Mar 04)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Yves-Alexis Perez (Feb 27)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Greg KH (Feb 27)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Jason A. Donenfeld (Feb 27)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Greg KH (Feb 27)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Jason A. Donenfeld (Feb 27)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Kurt Seifried (Feb 27)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Jiri Kosina (Feb 27)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Daniel Kahn Gillmor (Feb 27)
- Re: CVE request - Linux kernel: VFAT slab-based buffer overflow Jason A. Donenfeld (Feb 27)