Re: CVE request - Linux kernel: VFAT slab-based buffer overflow

["Jason A. Donenfeld" <Jason () zx2c4 com>]

On Thu, Feb 28, 2013 at 12:07 AM, Greg KH <greg () kroah com> wrote:
> Really?  Ok then, please go ahead and try doing this yourself if you
> feel it is so "obvious" to do.

I did yesterday, actually. I saw some commit that said "use after
free!", saw that it was triggerable by an unpriv'd user, and sent it
into the list. Kurt took a look at it, agreed with the assessment, and
assigned a CVE. The commit itself said "use after free" -- I didn't
even have to do any heavy lifting or hair-splitting investigation.


> > Kernel developers are super smart -- some of the brightest guys out
> > there.
>
> Nope, we are dumb, we do uninteresting, boring work, dealing with broken
> hardware and demanding users every day.  If we were smarter, we wouldn't
> be doing this type of thing.

Come on...