oss-sec mailing list archives
Re: CVE request -- kernel: execshield: predictable ascii armour base address
From: Kurt Seifried <kseifried () redhat com>
Date: Tue, 20 Mar 2012 10:30:08 -0600
On 03/20/2012 10:01 AM, Nick Kralevich wrote:
Can someone explain to me why this is worthy of a CVE? I can see this as a bug of course. But a "vulnerability"? This bug, by itself, does not cause a vulnerability. It just makes vulnerabilities easier to exploit. I'm not sure this is worthy of a CVE unless we're willing to assign CVEs to all fixed address allocations. -- Nick
To quote Steven on a previous issue: http://seclists.org/oss-sec/2012/q1/177 =================== In this case, the product's security feature is not living up to its advertised capability (by generating shorter passwords than expected) so, even if it's not that severe an issue, it's probably still of some importance to some people. =================== in this case replace "shorter passwords" with "random addresses that are not random". -- Kurt Seifried Red Hat Security Response Team (SRT)
Current thread:
- CVE request -- kernel: execshield: predictable ascii armour base address Petr Matousek (Mar 20)
- Re: CVE request -- kernel: execshield: predictable ascii armour base address Eugene Teo (Mar 20)
- Re: CVE request -- kernel: execshield: predictable ascii armour base address Nick Kralevich (Mar 20)
- Re: CVE request -- kernel: execshield: predictable ascii armour base address Marcus Meissner (Mar 20)
- Re: CVE request -- kernel: execshield: predictable ascii armour base address Petr Matousek (Mar 21)
- Re: CVE request -- kernel: execshield: predictable ascii armour base address Kurt Seifried (Mar 20)
- Re: CVE request -- kernel: execshield: predictable ascii armour base address Nick Kralevich (Mar 20)
- Re: CVE request -- kernel: execshield: predictable ascii armour base address Eugene Teo (Mar 20)