oss-sec mailing list archives
Re: Cve issue discussion
From: Agostino Sarubbo <ago () gentoo org>
Date: Mon, 07 Aug 2017 09:42:05 +0200
On Monday 07 August 2017 01:03:53 ne xo wrote:
Hello, I am curious about issuing CVEs. I can see that a "NULL pointer dereference" or a bug where the exploit has not been verified also get a CVE.
heap-overflows may or may not be exploitable. It takes a lot of time to analyze the exploit and create the exploit code. Is it right to be assigned a CVE only if it is exploitable? Or do you think all bugs need to get a CVE? Thanks. --- ref --- [1]http://www.openwall.com/lists/oss-security/2017/04/10/17 - NULL pointer dereference [2]http://www.openwall.com/lists/oss-security/2017/04/10/15 - memory allocation failure
Hi. Since you mentioned some issues reported by me, let me answer directly. For the first, it is an undefined behavior, so actually you don't see the crash. Nowadays, the undefined behavior issues do not get anymore a CVE. For the second, ASAN reports that the program want to use more that 64GB of ram to execute the process so ASAN hangs the process. In this case is up to the maintainer check whether there is a problem in the code or not, or it is expected. The better double-check would be verify what happens without ASAN. I'd like also to mention that MITRE assigns CVE after they analyze the reported issue, so if an issue does not deserve a CVE, MITRE probably won't assign accompanied by an explanation. -- Agostino Sarubbo Gentoo Linux Developer
Current thread:
- Cve issue discussion ne xo (Aug 06)
- Re: Cve issue discussion Agostino Sarubbo (Aug 07)
- RE: Cve issue discussion ne xo (Aug 07)
- Re: Cve issue discussion Glenn Randers-Pehrson (Aug 07)
- Re: Cve issue discussion Marcus Meissner (Aug 07)
- Re: Cve issue discussion Glenn Randers-Pehrson (Aug 07)
- Re: Cve issue discussion Bob Friesenhahn (Aug 07)
- Re: Cve issue discussion John Haxby (Aug 07)
- Re: Cve issue discussion Glenn Randers-Pehrson (Aug 07)
- Re: Cve issue discussion Jesse Hertz (Aug 07)
- Re: Cve issue discussion Glenn Randers-Pehrson (Aug 07)
- RE: Cve issue discussion ne xo (Aug 09)
- RE: Cve issue discussion ne xo (Aug 07)
- Re: Cve issue discussion Agostino Sarubbo (Aug 07)