Re: CVE-2022-1729: race condition in Linux perf subsystem leads to local privilege escalation

[Solar Designer <solar () openwall com>]

On Wed, May 25, 2022 at 12:20:44AM +0200, Norbert Slusarek wrote:
> Hello Alexander,
>
> > Since you shared actual exploit code on linux-distros, you're supposed
> > to also post that to oss-security within 7 days of your first posting
> > above, so by or on May 27. Do you intend to?
>
> I don't intend to share the exploit to the public, mainly because
> the issue was fixed only few days ago. Instead, anyone wanting to check
> his own system for the bug should resort to the attached PoC repro.
>
> > I realize this is one of the aspects that not everyone is happy about.
>
> Yes, you got that right.

Thank you for posting the repro.

What do you suggest we do regarding the LPE exploit you sent to
linux-distros?

What do you suggest we do with this policy aspect going forward, so that
people do not get into a situation where they're required to do
something they didn't want to subscribe to?

Alexander