From mboxrd@z Thu Jan 1 00:00:00 1970 From: Roland Dreier Subject: Re: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access Date: Thu, 2 Apr 2015 09:32:56 -0700 Message-ID: References: Mime-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Return-path: In-Reply-To: Sender: stable-owner@vger.kernel.org To: Shachar Raindel Cc: "oss-security@lists.openwall.com" , " (linux-rdma@vger.kernel.org)" , "stable@vger.kernel.org" List-Id: linux-rdma@vger.kernel.org On Thu, Apr 2, 2015 at 12:52 AM, Shachar Raindel wrote: > This is a common practice in the security industry, called > "responsible disclosure." > > Following the kernel security bugs policy [1], we reported it to > the kernel security contacts few days before making the issue public. > Few days after issue became public, we published a clear report to all > of the relevant mailing lists. Isn't the point of responsible disclosure to delay disclosure until a fix is in place? What's the point of sending a notification to the kernel security team if you're going to disclose publicly before the upstream kernel is fixed? - R.