Re: CVE request - Linux kernel: VFAT slab-based buffer overflow

[Greg KH <greg () kroah com>]

On Wed, Feb 27, 2013 at 06:46:30PM +0100, Jason A. Donenfeld wrote:
> On Wed, Feb 27, 2013 at 5:17 PM, Greg KH <greg () kroah com> wrote:
> > Are you willing to do it?
>
> If it's a patch for an issue sent to security@, then it is, in fact, a
> "trivial task" as to whether or not it was a security fix. There's no
> issue of responsibility of judgement, at all.

That's not true at all, lots of things sent to security@ end up not
being security issues when they are fixed.  Then there's the issue of
"what is and is not a security fix", and that is a discussion that we
aren't going to have here, sorry.

One problem is that there are very few things reported and fixed through
security@.  Maybe one patch every other kernel release or so.  And some
subsystems (i.e. networking) refuse to go through the security alias.

The _large_ majority of all fixes go through their individual subsystem
development process, and those are the ones you should be searching
through the commit logs for, as this patch itself proves.

thanks,

greg k-h