oss-sec mailing list archives
Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs
From: Petr Matousek <pmatouse () redhat com>
Date: Fri, 8 Mar 2013 05:55:44 +0100
On Thu, Mar 07, 2013 at 01:19:05PM +0400, Solar Designer wrote:
Kurt - On Thu, Mar 07, 2013 at 02:13:37AM -0700, Kurt Seifried wrote:Bundling the following into a single CVE:[...]Please use CVE-2012-6138 for these issues.I think this is wrong. I would understand if those issues were all in the same subsystem at least (or if you assigned per-subsystem CVE IDs for these), but this is not the case. Many distros will fix some, but not the others, or not all at the same time. There's room for a little bit of bundling here, but not that much.
In the past we've usually assigned one CVE per issue even for info leak bugs. Or at least one CVE per subsystem, as Alexander says. I agree with Alexander that one CVE for about ~20 issues is not right. -- Petr Matousek / Red Hat Security Response Team
Current thread:
- CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs Mathias Krause (Mar 05)
- Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs Kurt Seifried (Mar 06)
- Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs Mathias Krause (Mar 06)
- Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs Kurt Seifried (Mar 07)
- Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs Solar Designer (Mar 07)
- Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs Kurt Seifried (Mar 07)
- RE: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs Christey, Steven M. (Mar 07)
- Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs Solar Designer (Mar 07)
- Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs Petr Matousek (Mar 07)
- Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs Kurt Seifried (Mar 07)
- Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs Thomas Biege (Mar 08)
- Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs Solar Designer (Mar 07)
- Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs Kurt Seifried (Mar 06)