Re: CVE request: Linux kernel: tty: kobject reference leakage in tty_open

[Kurt Seifried <kseifried () redhat com>]

On 03/13/2015 01:46 PM, Greg KH wrote:
> On Fri, Mar 13, 2015 at 11:30:23PM +0530, P J P wrote:
> >    Hello,
> >
> > Linux kernel built with the virtual console support(CONFIG_VT) is vulnerable
> > to a NULL pointer dereference issue. It could occur while accessing pseudo
> > terminal device(/dev/pts/*) files.
> >
> > An unprivileged user could use this flaw to crash the system kernel resulting
> > in DoS.
> >
> > Upstream fix:
> > -------------
> >    -> https://git.kernel.org/linus/c290f8358acaeffd8e0c551ddcc24d1206143376
>
> Digging up patches from 2011?  Why?  It should have long-ago been
> backported to all relevant kernel releases from any company that has a
> kernel that is still supported today that is older than the 3.2 release
> and newer than 2.6.28.

Because some Linux OS related companies provide software with API/ABI
compatibility guarantees which results in a very long term back porting
effort especially if the software is supported for 10-13 years. Also
there's a large embedded market for Linux that is also interested in
stability/being boring.

> And if you are a company that is ignoring stable kernel patches for
> their old kernel releases, well, that's just not very wise :)

See the funny thing is we're not ignoring them. We're identifying and
backporting the important ones, like security fixes. But as you know
Kernel patch volume is quite high and not all patches are properly
labelled as important or security by upstream, which leads to:

> What does asking for a CVE for such an old issue help with?

So we can more easily identify the security related vulnerabilities and
patches and provide updates for customers.

This is why it's important to get CVE's onto security issues as soon as
possible. Then we don't have a bunch of random/old issues to deal with
at some point in the future. Aka why I unembargoed all our old cruft and
cleaned house.

#nomoresecretflaws

> thanks,
>
> greg k-h

-- 
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993

Attachment: signature.asc
Description: OpenPGP digital signature