Re: Reporting and disclosing Linux kernel vulnerabilities

[Greg KH <greg () kroah com>]

On Fri, Aug 04, 2017 at 06:59:15PM +0200, Andrey Konovalov wrote:
> Hi!
>
> It's not completely clear to me how to properly report and disclose
> Linux kernel security issues.

As your document shows, it all depends on what type of issue it is, and
what _you_ want to get out of it. [1]

> There are a few different parties [1, 2, 3] that need to be informed
> and coordinated.

Again, it depends on what you want to do :)

> I couldn't find a publicly available actionable list of steps, so I've
> outlined it as I see it here:
>
> https://github.com/google/syzkaller/blob/master/docs/linux_kernel_reporting_bugs.md#reporting-security-bugs
>
> Thoughts? Comments?

That looks like a good start, nice job.

thanks,

greg k-h

[1] This matters a lot.  Here's my feeling on the matter:

    If you just want the bug fixed so you can get on with whatever else
    you were doing, just notify security () kernel org, the bug will get
    fixed and pushed out to all kernel.org trees as soon as possible.

    If you think it affects users of the "traditional" Linux distros,
    then contact distros and hope someone contacts security@k.o later to
    get the issue resolved for everyone else.

    If it affects only an odd one-off or embedded device that will never
    get updated, again, security@k.o and oss-security to get some public
    leverage to try to get the vendor to fix the issue.

    If you don't really care what happens to anyone, oss-security works :)