Re: Linux kernel CVEs not mentioned on oss-security

[Kurt Seifried <kseifried () redhat com>]

On Mon, Sep 25, 2017 at 3:50 PM, Priedhorsky, Reid <reidpr () lanl gov> wrote:
> My questions:
>
> 1. Is oss-security’s coverage of security issues in open-source software
> intended to be comprehensive? If so, this appears not to be true for the
> Linux kernel.

Nope. To quote the web site: 'Open Source software security discussions "
http://www.openwall.com/lists/ the fact that it has turned into a security
announce list with limited discussion is  just how things go I guess. Also
it's tough because the Linux Kernel has explicitly said they won't get
CVE's for all their security issues, they simply fix and move on, their
culture is "run something current, if not, to bad" (which part of me agrees
with, but that doesn't work so well for IoT/enterprise/people needing a
high degree of stability/assurance).


> 2. Is there another source of comprehensive coverage of vulnerabilities in
> the Linux kernel, including but not necessarily limited to all CVEs issued
> for it?

There are commercial security information vendors that claim to provide
this, I won't name names as I don't know how good they are. Step 1 here for
the open source community would be making sure Kernel issues get CVEs, and
then that those CVEs get into the CVE database so people are aware of them.


> I appreciate everyone’s time and effort on all this stuff. This post
> should not be interpreted as singling out Debian for criticism.
>
> Thanks,
> Reid




-- 

Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert () redhat com