Subject: Re: thoughts on kernel security issues
From: Alan Cox <alan@lxorguk.ukuu.org.uk>
To: "Julian T. J. Midgley" <jtjm@xenoclast.org>
Cc: Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
In-Reply-To: <cs8nhp$j2d$1@sea.gmane.org>
References: <Pine.LNX.4.58.0501121002200.2310@ppc970.osdl.org>
	 <20050114102249.GA3539@wiggy.net> <cs8cqv$jo5$1@sea.gmane.org>
	 <871xcoxduk.fsf@deneb.enyo.de>  <cs8nhp$j2d$1@sea.gmane.org>
Content-Type: text/plain
Content-Transfer-Encoding: 7bit
Message-Id: <1105745094.9839.47.camel@localhost.localdomain>
Mime-Version: 1.0
Date: Sat, 15 Jan 2005 00:33:34 +0000
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1007
Lines: 22

On Gwe, 2005-01-14 at 15:12, Julian T. J. Midgley wrote:
> You'll have to explain why leaking the information "that there is a
> bug in $PROGRAM", by fixing it (without disclosing either the bug or
> the fix), is a problem.  After all, you can assume that for every

Because the bad guys do keep watch and they do go looking and some of
them are very very bright people. Knowing application A has a bug
generally means you know the kind of bug because it'll be "flavour of
the month" bug. In other words most bugs are variants of the latest
exploit because everyone is now looking at every other app for the same
problem.

We had network buffer overflow period, multiplication/addition overflow
period, 2D maths overflow in image viewer period and so on..

Alan

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/