Messages in this thread | | | Date | Fri, 13 Dec 2013 10:00:45 -0800 | Subject | Re: [PATCH 1/9] Known exploit detection | From | Kees Cook <> |
| |
On Fri, Dec 13, 2013 at 5:23 AM, Ingo Molnar <mingo@kernel.org> wrote: > > * Dan Carpenter <dan.carpenter@oracle.com> wrote: > >> On Fri, Dec 13, 2013 at 11:31:48AM +0100, Alexander Holler wrote: >> > I've never seen a comment inside the kernel sources which does point >> > to a CVE, so I assume there already does exists some agreement about >> > not doing so. >> >> We do occasionally put CVE numbers in the commit message, but >> normally the commit comes first before we ask for a CVE number. > > The detection code will most likely come after the fix is applied. > > In that case the 'ID' of the message could also be the commit ID of > the fix in question: > > detect_exploit("[exploit for d8af4ce490e9: Fix syscall bug]") > > or so - no CVE needed, it's a free form ID that can contain anything > descriptive about the bug the attacker attempted to exploit.
FWIW, I'd vastly prefer the CVE. The commit rapidly becomes meaningless as things go into -stable, or manual backports. The CVE is intended to be the single unique descriptor of a security problem.
-Kees
-- Kees Cook Chrome OS Security
| |