oss-sec mailing list archives
Re: Linux kernel CVEs not mentioned on oss-security
From: Greg KH <greg () kroah com>
Date: Wed, 27 Sep 2017 15:04:24 +0200
On Wed, Sep 27, 2017 at 02:51:49PM +0200, Solar Designer wrote:
Besides, Greg focuses on the problem that some ignore the stable kernels or the "curated and tested stream of fixes" that could be seen in there, whereas another concern mentioned earlier in the thread is that the stream is also incomplete because some security fixes are not marked as such and not CC'ed to stable. So that's two problems mentioned in the thread, but vendor-sec was not / linux-distros is not related to either.
For that second issue, I've not ever really run into any "known security fix" not being cc:ed to stable. Do you have any known examples where I can go poke the maintainers to do better? We have plenty of the normal "bugfix was merged that a few years later turned out to be a 'security' issue, but no one realized it at the time" changes that get merged. And to help combat that, we are doing more and more "smart mining"[1] of the kernel commits to try to catch patches that match those types of fixes and get them merged into the stable kernels. You can see the initial results of this work with the huge increase in patches being merged to the 4.9 and 4.4 stable kernels vs. any older stable kernel trees in the past. thanks, greg k-h [1] yes, we know people have been doing this for years, but they almost never notify upstream about this for various reasons.
Current thread:
- Re: Linux kernel CVEs not mentioned on oss-security, (continued)
- Re: Linux kernel CVEs not mentioned on oss-security Priedhorsky, Reid (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Simon McVittie (Sep 25)
- Re: Linux kernel CVEs not mentioned on oss-security Moritz Muehlenhoff (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Agostino Sarubbo (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Greg KH (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Nicholas Luedtke (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Agostino Sarubbo (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Greg KH (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Muhammed Mustapha Abiola (Sep 27)
- Re: Linux kernel CVEs not mentioned on oss-security Solar Designer (Sep 27)
- Re: Linux kernel CVEs not mentioned on oss-security Greg KH (Sep 27)
- Re: Linux kernel CVEs not mentioned on oss-security Solar Designer (Sep 27)
- Re: Linux kernel CVEs not mentioned on oss-security Greg KH (Sep 28)
- Re: Linux kernel CVEs not mentioned on oss-security Salvatore Bonaccorso (Sep 28)
- Re: Linux kernel CVEs not mentioned on oss-security Greg KH (Sep 28)
- Re: Linux kernel CVEs not mentioned on oss-security Brad Spengler (Sep 28)
- Re: Linux kernel CVEs not mentioned on oss-security Greg KH (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Kurt Seifried (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Agostino Sarubbo (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Kurt Seifried (Sep 26)
- Re: Linux kernel CVEs not mentioned on oss-security Marcus Meissner (Sep 27)