oss-sec mailing list archives
Re: Qualys Security Advisory - The Stack Clash
From: Solar Designer <solar () openwall com>
Date: Sat, 24 Jun 2017 16:14:42 +0200
On Fri, Jun 23, 2017 at 08:02:36AM -0600, Kurt Seifried wrote:
OpenBSD made changes to the then known qsort() issue, and implemented what was then thought to be the solution to the stack guard issue, the 1 megabyte guard pages. Subsequent discussion (without OpenBSD present, due to them breaking the embargo) took place and as you know we ended up with some pretty significant changes to glibc (I don't know if OpenBSD has picked this group of fixes up or not).
I think Kurt's words "without OpenBSD present, due to them breaking the embargo" are Kurt's (and maybe others') impression only (and maybe these people's personal decision(s) not to inform OpenBSD going forward, as Kurt mentioned he did help ping OpenBSD this time when Qualys wasn't getting a response from them in early May). No decision on the distros list at large was made to either inform or not inform OpenBSD of further issues. As it happened, we did CC the discussion around Cron to Todd (although like I said in my posting about Cron in here, there was no point in having that minor issue embargoed in the first place). The glibc issues and fixes are most likely irrelevant to *BSD libc's - in fact, we should have been more careful not to spam the full distros list with them (I think some sub-threads correctly went to linux-distros only, but some did not). Alexander
Current thread:
- Re: Qualys Security Advisory - The Stack Clash, (continued)
- Re: Qualys Security Advisory - The Stack Clash Florian Weimer (Jun 22)
- Re: Qualys Security Advisory - The Stack Clash Agostino Sarubbo (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash Brad Spengler (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash Solar Designer (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash Daniel Micay (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash Brad Spengler (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash Mike O'Connor (Jun 22)
- Re: Qualys Security Advisory - The Stack Clash Solar Designer (Jun 24)
- Re: Qualys Security Advisory - The Stack Clash Jeff Law (Jun 23)
- Re: Qualys Security Advisory - The Stack Clash Kurt Seifried (Jun 23)
- Re: Qualys Security Advisory - The Stack Clash Solar Designer (Jun 24)
- Re: Qualys Security Advisory - The Stack Clash Brad Spengler (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash Qualys Security Advisory (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash PaX Team (Jun 21)
- Re: Qualys Security Advisory - The Stack Clash Jeff Law (Jun 21)