Re: CVE requests: Two kernel issues

[Eugene Teo <eugene () redhat com>]

On 08/10/2011 04:42 AM, Moritz Muehlenhoff wrote:
> Hi,
> the following two issues also seem to warrant a CVE assignment:
>
> 1. staging: comedi: fix infoleak to userspace
> http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=819cbb120eaec7e014e5abd029260db1ca8c5735
>
> (It's a staging driver and I'm unsure whether we have assigned
>  CVE IDs for staging drivers in the past. OTOH, this driver
>  is enabled in the Debian 6.0 kernel)

We don't as code from the staging drivers are usually are substandard
and usually not supported.

Btw, can you please mail me a copy of the /boot/config of the most
recent Debian kernel for my reference?

> 2. [SCSI] pmcraid: reject negative request size
> http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=b5b515445f4f5a905c5dd27e6e682868ccd6c09d

I don't have a PMC Sierra MaxRAID controller, so I am not sure what's
the permissions give to /dev/pmcsas%u. I'm checking. Meanwhile, use
CVE-2011-2906 for this issue.

Thanks, Eugene