Re: Qualys Security Advisory - The Stack Clash

[Solar Designer <solar () openwall com>]

On Fri, Jun 23, 2017 at 08:02:36AM -0600, Kurt Seifried wrote:
> OpenBSD made changes to the then known qsort() issue, and implemented
> what was then thought to be the solution to the stack guard issue, the 1
> megabyte guard pages. Subsequent discussion (without OpenBSD present,
> due to them breaking the embargo) took place and as you know we ended up
> with some pretty significant changes to glibc (I don't know if OpenBSD
> has picked this group of fixes up or not).

I think Kurt's words "without OpenBSD present, due to them breaking the
embargo" are Kurt's (and maybe others') impression only (and maybe these
people's personal decision(s) not to inform OpenBSD going forward, as
Kurt mentioned he did help ping OpenBSD this time when Qualys wasn't
getting a response from them in early May).  No decision on the distros
list at large was made to either inform or not inform OpenBSD of further
issues.  As it happened, we did CC the discussion around Cron to Todd
(although like I said in my posting about Cron in here, there was no
point in having that minor issue embargoed in the first place).  The
glibc issues and fixes are most likely irrelevant to *BSD libc's - in
fact, we should have been more careful not to spam the full distros list
with them (I think some sub-threads correctly went to linux-distros
only, but some did not).

Alexander