linux-kernel - Fwd: Registering the supplementary patch of CVE-2013-0290 as CVE

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAK=B_Ct98PFTZHJg7XYy9BJCV9eawM-nfmbfU=Ky+PE++i0dNw@mail.gmail.com>
Date:   Mon, 9 Aug 2021 17:17:54 +0900
From:   EJ Choi <ejpiper308@...il.com>
To:     linux-kernel@...r.kernel.org
Subject: Fwd: Registering the supplementary patch of CVE-2013-0290 as CVE

Hi,
I'm Eunji Choi, and I'm working on incomplete security patch detection for OSS.

While I was looking for some cases, I found commit
add05ad4e9f5c4efee9b98535db5efa32b0d0492
which is the supplementary patch for commit
77c1090f94d1b0b5186fb13a1b71b47b1343f87f (fixes CVE-2013-0290).

It seems that the problem related to system call failure occurred
due to the previous patch and has been fixed.
(Incomplete fix for CVE-2013-0290)

I searched the multiple public security vulnerability database(such as NVD),
and couldn't find any information about the patch(add05a).

Registering the problem and its patch commit as new CVE seems to be
helpful for people using Linux.
Because some people can apply the previous patch to their SW to fix
CVE-2013-0290.

I'd like to hear your opinion.

Thank you,
Eunjin Choi.