Re: CVE request - Linux kernel: VFAT slab-based buffer overflow

[Greg KH <greg () kroah com>]

On Wed, Feb 27, 2013 at 08:06:18PM +0100, Jason A. Donenfeld wrote:
> On Wed, Feb 27, 2013 at 5:17 PM, Greg KH <greg () kroah com> wrote:
> > Every single patch we make to the kernel is public, it is up to you to
> > determine if you feel it is a "security fix" or not.  And to do so is a
> > non-trivial task, something that I sure don't want to be responsible for
> > trying to do.  And since no one else has ever stepped up to want to do
> > it either, there's not much more that can be done.
> >
> > Are you willing to do it?
>
> Yes! Sign me up, I volunteer. I'd be happy to watch the coordination
> between security@ and the git repo, and sent oss-sec an email when
> they align. Pencil me in.

No, I'm saying you need to watch the public commits, not the security@
traffic (which is very low), as that is where the huge majority of fixes
are made.

See my other responses about how the members of security@ are going to
notify the linux-distros list, not oss-sec.

greg k-h