User: Password:
|
|
Subscribe / Log in / New account

2.6.32.9 Release notes

2.6.32.9 Release notes

Posted Feb 21, 2010 19:23 UTC (Sun) by nelhage (subscriber, #59579)
Parent article: 2.6.32.9 Release notes

Also, I believe '#43: KVM: PIT: control word is write-only.' is CVE-2010-
0309, and is a potential guest -> host denial of service.

Thanks for doing this experiment! It just goes to show how difficult it is
even for a kernel hacker who follows the kernel closely to figure out which
bugs have potential security impact.

Of course, I'm sure some will take that as evidence that we shouldn't even
try, while spender will tell us that this is why Linus, Greg K-H et al. need
be the ones doing it. I won't take a side here, but I think this was
definitely an interesting experiment, and hopefully will lead to interesting
discussion.


(Log in to post comments)

2.6.32.9 Release notes

Posted Feb 22, 2010 9:30 UTC (Mon) by dgm (subscriber, #49227) [Link]

> It just goes to show how difficult it is even for a kernel hacker who follows the kernel closely to figure out which bugs have potential security impact.

This is correct. I would add that given enough time, a determined hacker, and a convenient definition of security, any bug has the potential of having security consequences. Thus, I have to agree with Linus that time spent in assessing if a certain bug is or is not security related is time wasted. Just fix it and move on, or better yet prevent it from happening.

2.6.32.9 Release notes

Posted Feb 22, 2010 14:59 UTC (Mon) by cwarner (guest, #47176) [Link]

If you are knowingly aware it is a security issue your fix may solve the bug but
not the security issue and/or cause another security exploit. Just fixing bugs
isn't understanding how a piece of code works in its entirety. Wholeness and
correctness for a module is important.


Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds