Re: CVE Requests (maybe): Linux kernel: various info leaks, some NULL ptr derefs

[Thomas Biege <thomas () suse de>]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Am 08.03.2013 06:07, schrieb Kurt Seifried:
> On 03/07/2013 09:55 PM, Petr Matousek wrote:
> > On Thu, Mar 07, 2013 at 01:19:05PM +0400, Solar Designer wrote:
> > > Kurt -
> > >
> > > On Thu, Mar 07, 2013 at 02:13:37AM -0700, Kurt Seifried wrote:
> > > > Bundling the following into a single CVE:
> > > [...]
> > > > Please use CVE-2012-6138 for these issues.
> > >
> > > I think this is wrong.  I would understand if those issues
> > > were all in the same subsystem at least (or if you assigned 
> > > per-subsystem CVE IDs for these), but this is not the case.
> > > Many distros will fix some, but not the others, or not all at
> > > the same time.  There's room for a little bit of bundling here,
> > > but not that much.
>
> > In the past we've usually assigned one CVE per issue even for
> > info leak bugs. Or at least one CVE per subsystem, as Alexander
> > says. I agree with Alexander that one CVE for about ~20 issues is
> > not right.

So, are all CVE-IDs assigned before are invalid now? I just want to
make sure I didn't pollute our databases. :)

Cheers,
Thomas



> Agreed (I was wrong, not much more to say than that =). It sounds
> like Mitre will be handling the additional CVEs for this issue as
> I understand it.
>
> Now my question is how concise do we go with the Linux kernel as
> far as subsystems go? E.g. file subsystem vs network subsystem
> seems obvious, and say ext4 vs. MSDOS file system code seems
> obvious but what about network drivers (same chipset? same maker,
> different chipsets? or like ext2 vs ext3 vs ext4).

- -- 
Thomas Biege <thomas () suse de>, Teamlead MaintenanceSecurity, CSSLP
SUSE LINUX GmbH, GF: Jeff Hawn, Jennifer Guild, Felix Imendörffer, HRB
21284 (AG Nürnberg)
- --
  Wer aufhoert besser werden zu wollen, hoert auf gut zu sein.
                            -- Marie von Ebner-Eschenbach
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.19 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJROgKAAAoJEJqHoVJVjr8DPUYIAN1Bhf+JkBFGH9xEFrrNCZ9m
9w21VJ3RKRPvKdK7I5+9xDTLxHsPuAwEkFMQY27Gs8ALGj4pYukiZ5ifCHJJX5wc
7EaXi5lI9c/wh7PMgVxqoIPQExq4LCHV6/W+b5yPra0A7faFcCkiQNeJfR4qd19z
3YaSEA0u7op0HugvgcOueCEt1b/dRBp6eGfM/ERQ+jNzAJPJoFtnz/x4Chsk+SE7
vKe0Z6RWngUaRsKG0Np+0rXl+HvKLhyL49J1MU2GAsBkYnTzjlalortLZHn0h7PE
jxBDgm6g3axhrQ7ZpbyHdW2xRThTuYthPJI+w85SvXlnPBfLmalpATcqKVhcXSQ=
=NVp2
-----END PGP SIGNATURE-----