[lkml]   [2005]   [Jan]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: thoughts on kernel security issues
    On Wed, Jan 12, 2005 at 06:28:38PM -0800, Andrew Morton wrote:
    > IMO, local DoS holes are important mainly because buggy userspace
    > applications allow remote users to get in and exploit them, and for that
    > reason we of course need to fix them up. Even though such an attacker
    > could cripple the machine without exploiting such a hole.
    > For the above reasons I see no need to delay publication of local DoS holes
    > at all. The only thing for which we need to provide special processing is
    > privilege escalation bugs.
    > Or am I missing something?

    So, a "classification" of the severity of the bug would cause different
    type of disclosures? That's a good idea in theory, but trying to nail
    down specific for bug classifications tends to be difficult.

    Although I think both Red Hat and SuSE have a classification system in
    place already that might help out here.

    Anyway, if so, I like it. I think that would be a good thing to have,
    if for no other reason that I don't want to see security announcements
    for every single driver bug that's patched that had caused a user
    created oops.


    greg k-h
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to
    More majordomo info at
    Please read the FAQ at

     \ /
      Last update: 2005-03-22 14:09    [W:0.021 / U:87.100 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site