News for hackers. Stuff that matters.

A comment on Linux kernel use-after-free in Netfilter, local privilege escalation. Parent comment

Re:Linux kernel use-after-free in Netfilter, local privilege... by jstanley on Tuesday May 09, 2023 @11:00PM (#35883156)
> Somebody from the Linux kernel team then emailed the proposed fix to <linux-distros () vs openwall org> and that email also included a link to download our description of exploitation techniques and our exploit source code.

> Therefore, according to the linux-distros list policy, the exploit must be published within 7 days from this advisory. In order to comply with that policy, [...]

What? Someone publishes information about your vuln to a random mailing list, and this somehow creates an obligation on you to follow that mailing list's policies? I don't get it.

[ Parent | on HN ]
Re:Linux kernel use-after-free in Netfilter, local privilege... by batch12 on Tuesday May 09, 2023 @11:21PM (#35883267)
Maybe they consider the exploit is in the wild when sending to a distro that large[0] with recipients that aren't provably trustworthy.

[0] https://oss-security.openwall.org/wiki/mailing-lists/distros

[ Parent | on HN ]
Re:Linux kernel use-after-free in Netfilter, local privilege... by failsecure on Tuesday May 09, 2023 @11:20PM (#35883264)
Maybe linux-distros has a poc or GTFO rule in place to keep the unchecked "I can get root on your box with this one weird trick but I won't tell you how" emails to a minimum. Just a guess though.
[ Parent | on HN ]
Re:Linux kernel use-after-free in Netfilter, local privilege... by jstanley on Wednesday May 10, 2023 @09:39AM (#35887196)
That's fine. They didn't want it on linux-distros anyway!
[ Parent | on HN ]
Re:Linux kernel use-after-free in Netfilter, local privilege... by amatecha on Wednesday May 10, 2023 @01:19AM (#35883920)
I believe they are referring to this:

https://oss-security.openwall.org/wiki/mailing-lists/distros

> Please note that the maximum acceptable embargo period for issues disclosed to these lists is 14 days. Please do not ask for a longer embargo. In fact, embargo periods shorter than 7 days are preferable.

[ Parent | on HN ]