Re: CVE request - Linux kernel: VFAT slab-based buffer overflow

[Greg KH <greg () kroah com>]

On Wed, Feb 27, 2013 at 07:14:55PM +0100, Petr Matousek wrote:
> On Wed, Feb 27, 2013 at 10:05:20AM -0800, Greg KH wrote:
> > On Wed, Feb 27, 2013 at 05:13:06PM +0100, Petr Matousek wrote:
> > > On Wed, Feb 27, 2013 at 06:48:34AM -0800, Greg KH wrote:
> > > > On Wed, Feb 27, 2013 at 07:31:30AM +0100, Petr Matousek wrote:
> > > > > For starters, security () kernel org submissions should be posted to
> > > > > oss-security or any other security related public mailing list when
> > > > > the
> > > > > patch is being committed.
> > > >
> > > > That's not going to happen, and you know that, to do so would be
> > > > totally
> > > > irresponsible of us and directly harm your users.  That's what
> > > > vendor-sec (or whatever it is called now) is for.
> > >
> > > linux-distros [1] is vendor-sec replacement for Linux related issues.
> > >
> > >   [1] http://oss-security.openwall.org/wiki/mailing-lists/distros
> >
> > Yes, sorry, I couldn't remember the name of it at the moment :)
> >
> > > > Hasn't that been
> > > > happening for a while now, or has no one been notifying that list of
> > > > these issues?
> > >
> > > Regrettably no. No notifications of Linux kernel security issues
> > > reported to security () kernel org mailing list to linux-distros (former
> > > vendor-sec) are happening on regular basis. I (speaking as Red Hat
> > > Security Response Team member in charge of kernel security issues) would
> > > really appreciate the notifications. Even marking commits that were
> > > committed as a result of security () kernel org submission as sko
> > > originated would be really helpful.
> > >
> > > The linux-distros/oss-sec members can make sure that each issue gets CVE
> > > and it's properly publicly communicated at the right time (preferably
> > > when the issue is public -- when it is committed).
> > >
> > > Should you consider this approach, is there anything I can help with to
> > > make that happen?
> >
> > Yes, I need someone to actually do this.  There used to be a Red Hat
> > security team member that did this, or so I thought.
>
> That was most probably Eugene Teo, he's no longer in Red Hat. I am not
> subscribed to security () kernel org.

Mark Cox is subscribed to this, and has volunteered to now be forwarding
this information to the linux-distros list.

Thanks for prodding this to happen.

greg k-h