Re: CVE request - Linux kernel: VFAT slab-based buffer overflow

[Petr Matousek <pmatouse () redhat com>]

On Wed, Feb 27, 2013 at 08:15:47AM -0800, Greg KH wrote:
> On Wed, Feb 27, 2013 at 07:08:58PM +0400, Solar Designer wrote:
> > On Wed, Feb 27, 2013 at 06:48:34AM -0800, Greg KH wrote:
> > > On Wed, Feb 27, 2013 at 07:31:30AM +0100, Petr Matousek wrote:
> > > > For starters, security () kernel org submissions should be posted to
> > > > oss-security or any other security related public mailing list when the
> > > > patch is being committed.
> > >
> > > That's not going to happen, and you know that, to do so would be totally
> > > irresponsible of us and directly harm your users.
> >
> > Huh?!  Maybe you misread what Petr wrote?  Note: "when the patch is
> > being committed".  At this point, the security issue is public, and it
> > just needs to be properly communicated to all those interested
> > (including distros, sysadmins, etc.), such as via oss-security.  Not
> > doing this favors those few who spend time to review commits on their
> > own; some of them do it for purposes other than informing the public.
>
> We (the kernel team) well know this, and have been over this topic
> numerous times in the past.  We have come to the conclusion that it is
> not good for us to be publicly stating "here look, here's how you
> exploit the kernel!" at the exact moment we commit the patch to the
> public tree because suddenly you now have shown how all systems in the
> world are exploitable, with no chance for anyone to have protected their
> systems ahead of time.
>
> Instead, we have no problem with groups like vendor-sec being notified
> of these issues, and allowing them to push out updates, before _they_
> notify the world of the problem.  And, for a long time, I thought
> vendor-sec was being notified of all of the issues that
> security () kernel org knew about, if this has suddenly changed, please let
> me know and I will be glad to resolve it.

As stated in my previous comment, this is not happening.

-- 
Petr Matousek / Red Hat Security Response Team