Re: CVE request - Linux kernel: VFAT slab-based buffer overflow

[Petr Matousek <pmatouse () redhat com>]

On Wed, Feb 27, 2013 at 06:48:34AM -0800, Greg KH wrote:
> On Wed, Feb 27, 2013 at 07:31:30AM +0100, Petr Matousek wrote:
> > For starters, security () kernel org submissions should be posted to
> > oss-security or any other security related public mailing list when
> > the
> > patch is being committed.
>
> That's not going to happen, and you know that, to do so would be
> totally
> irresponsible of us and directly harm your users.  That's what
> vendor-sec (or whatever it is called now) is for.

linux-distros [1] is vendor-sec replacement for Linux related issues.

  [1] http://oss-security.openwall.org/wiki/mailing-lists/distros

> Hasn't that been
> happening for a while now, or has no one been notifying that list of
> these issues?

Regrettably no. No notifications of Linux kernel security issues
reported to security () kernel org mailing list to linux-distros (former
vendor-sec) are happening on regular basis. I (speaking as Red Hat
Security Response Team member in charge of kernel security issues) would
really appreciate the notifications. Even marking commits that were
committed as a result of security () kernel org submission as sko
originated would be really helpful.

The linux-distros/oss-sec members can make sure that each issue gets CVE
and it's properly publicly communicated at the right time (preferably
when the issue is public -- when it is committed).

Should you consider this approach, is there anything I can help with to
make that happen?

Thank you,
-- 
Petr Matousek / Red Hat Security Response Team