Re: Linux kernel: userfaultfd bypasses tmpfs file permissions (CVE-2018-18397; since 4.11; fixed in 4.14.87 and 4.19.7)

[Solar Designer <solar () openwall com>]

Important correction:

On Fri, Dec 14, 2018 at 02:07:55PM +0100, Solar Designer wrote:
> > On Wed, 2018-12-12 at 15:24 +0100, Solar Designer wrote:
> > > A question to ask may be: out of Linux kernel vulnerabilities being
> > > patched, are there more high and critical overall severity (e.g., as
> > > risk impact times risk probability) vulnerabilities found in "too
> > > recent" kernels than there are high and critical severity untracked
> > > vulnerabilities (also or instead) affecting "sufficiently old" kernels?

> [...] to answer my question above we need median and not average.

Actually, that wouldn't answer this exact question - it'd answer a
similar question about tracked vulnerabilities, and the answer would
tell us how frequently a vulnerability would need to be patched on a
system (apparently, 1/8 of the time for RHEL7 vs. latest mainline now).

We can't answer the question about untracked vulnerabilities from
per-vulnerability data because untracked implies we lack such data.

Alexander