linux-kernel - Re: [stable] Linux 2.6.25.10

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080714120418.GA5334@kroah.com>
Date:	Mon, 14 Jul 2008 05:04:18 -0700
From:	Greg KH <greg@...ah.com>
To:	pageexec@...email.hu
Cc:	Andrew Morton <akpm@...ux-foundation.org>,
	torvalds@...ux-foundation.org, linux-kernel@...r.kernel.org,
	stable@...nel.org
Subject: Re: [stable] Linux 2.6.25.10

Sorry for the delay, was on vacation...

On Thu, Jul 03, 2008 at 09:31:45PM +0200, pageexec@...email.hu wrote:
> [spender's asked to be off the CC]

Chicken :)

> On 3 Jul 2008 at 11:57, Greg KH wrote:
> 
> > On Thu, Jul 03, 2008 at 10:29:14AM -0700, Greg KH wrote:
> > Adding 2 more addresses to this thread, as they were said to have
> > questions about this kernel release.
> 
> not only this one, but every commit for the past few years that fixed
> bugs with security impact. for reference:
> 
> http://lwn.net/Articles/285438/
> http://lwn.net/Articles/286263/
> http://lwn.net/Articles/287339/
> http://lwn.net/Articles/288473/

As I'm somewhere there is no web access, mind summarizing these if they
are relevant?

> > Again, if the above information is somehow insufficient as to what
> > exactly is fixed in the -stable releases, and anyone has questions about
> > how these release announcements are created, please let me know.
> 
> what is the disclosure policy used for commits fixing bugs with security
> impact (both vanilla and -stable, especially if there's a difference)?

What is outlined in Documentation/SecurityBugs.

> what do you include/omit?

Personally, I omit posting full "and here is explicitly how to exploit
this problem" notices as that is foolish.

But also remember that -stable releases are just a compilation of
patches that developers have sent to the stable developers, we use the
original commit messages as published in the main kernel tree, except
where the patch differs, which is rare.  So it's not like these releases
are any different than the main kernel releases on descriptions of
patches and issues surrounding them.

> how does it relate to what is declared in Documentation/SecurityBugs?

That deals with how security bugs that are sent to security@...nel.org
are handled, which is totally different from -stable releases, right?

thanks,

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/