Linux-NFS Archive on lore.kernel.org
 help / color / Atom feed
* [engineering.redhat.com #494100] Question on submitting patch for a security bug
       [not found] ` <CAJ7L_Gp2HJoFOVxTgakCJw3LMuiPY0+60-giOtw3OwRD6zyNTQ@mail.gmail.com>
@ 2019-08-05 17:38   ` Red Hat Product Security
  0 siblings, 0 replies; only message in thread
From: Red Hat Product Security @ 2019-08-05 17:38 UTC (permalink / raw)
  To: b.zolnierkie, bob.liu, chuck.lever, davem, emamd001, gregkh,
	kubakici, kvalo, navid.emamdoost, sam
  Cc: airlied, alexandre.belloni, alexandre.torgue, allison,
	andriy.shevchenko, anna.schumaker, axboe, bfields, colin.king,
	daniel, devel, dri-devel, joabreu, johnfwhitmore, josef, jslaby,
	kjlu, kstewart, linux-arm-kernel, linux-block, linux-ide,
	linux-kernel, linux-mediatek, linux-nfs, linux-serial,
	linux-stm32, linux-wireless, matthias.bgg, matthias,
	mcoquelin.stm32, nbd, netdev, nishkadg.linux, peppe.cavallaro,
	smccaman, tglx, thierry.reding, trond.myklebust, unglinuxdriver,
	vishal, vkoul

Hello Navid,

On Thu, 18 Jul 2019 01:30:20 GMT, emamd001@umn.edu wrote:
> I've found a null dereference bug in the Linux kernel source code. I was
> wondering should I cc the patch to you as well (along with the
> maintainers)?

No. Please do not cc <secalert@redhat.com> on the upstream kernel patches.
It is meant for reporting security issues only.

Going through the patches here

1. Issues in ../staging/ drivers are not considered for CVE, they are not to be
used
in production environment.

2. Many of the patches listed fix NULL pointer dereference when memory
allocation
fails and returns NULL.

3. Do you happen to have reproducers for these issues? Could an unprivileged
user trigger them?

> Also, I was wondering what are the steps to get CVE for the bug (this is
> the first time I am reporting a bug)?

Generally CVE is assigned after confirming that a given issue really is a
security issue. And it may
have impact ranging from information leakage, DoS to privilege escalation or
maybe arbitrary code
execution. Every NULL pointer dereference is not security issue.


Hope it helps. Thank you.
---
Prasad J Pandit / Red Hat Product Security Team


^ permalink raw reply	[flat|nested] only message in thread

only message in thread, back to index

Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <RT-Ticket-494100@engineering.redhat.com>
     [not found] ` <CAJ7L_Gp2HJoFOVxTgakCJw3LMuiPY0+60-giOtw3OwRD6zyNTQ@mail.gmail.com>
2019-08-05 17:38   ` [engineering.redhat.com #494100] Question on submitting patch for a security bug Red Hat Product Security

Linux-NFS Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-nfs/0 linux-nfs/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-nfs linux-nfs/ https://lore.kernel.org/linux-nfs \
		linux-nfs@vger.kernel.org linux-nfs@archiver.kernel.org
	public-inbox-index linux-nfs


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-nfs


AGPL code for this site: git clone https://public-inbox.org/ public-inbox