Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access

[Roland Dreier <roland () purestorage com>]

On Thu, Apr 2, 2015 at 12:52 AM, Shachar Raindel <raindel () mellanox com> wrote:
> This is a common practice in the security industry, called
> "responsible disclosure."
>
> Following the kernel  security bugs policy [1], we reported it to
> the kernel security contacts few days before making the issue public.
> Few days after issue became public, we published a clear report to all
> of the relevant mailing lists.

Isn't the point of responsible disclosure to delay disclosure until a
fix is in place?  What's the point of sending a notification to the
kernel security team if you're going to disclose publicly before the
upstream kernel is fixed?

 - R.