Re: [qemu-web PATCH v2] Add "Security Process" information to the main website

[Eric Blake <eblake@redhat.com>]

On 1/23/20 11:11 AM, Thomas Huth wrote:
> One reporter of a security issue recently complained that it might not
> be the best idea to store our "Security Process" in the Wiki. Well, while
> the page in the Wiki is protected (so that only some few people can edit
> it), it is still possible that someone might find a bug in the Wiki
> software to alter the page contents...
> Anyway, it looks more trustworthy if we present the "Security Process"
> information in the static website instead. Thus this patch adds the
> information from the wiki to the Jekyll-based website now.
> 
> Signed-off-by: Thomas Huth <thuth@redhat.com>
> ---
>   v2: Improved some sentences as suggested by Paolo
> 

> +### Publication embargo
> +
> +As a security issue reported, that is not already publically disclosed

publicly

> +elsewhere, has an embargo date assigned and communicated to reporter. Embargo

Reads awkwardly. I'd suggest:

If a security issue is reported that is not already publicly disclosed, 
an embargo date may be assigned and communicated to the reporter.

> +periods will be negotiated by mutual agreement between members of the security
> +team and other relevant parties to the problem. Members of the security contact
> +list agree not to publically disclose any details of the security issue until

publicly

> +the embargo date expires.
> +

> +
> +For  example, consider upstream commit [9201bb9 "sdhci.c: Limit the maximum
> +block size"](http://git.qemu.org/?p=qemu.git;a=commit;h=9201bb9), an of out of
> +bounds (OOB) memory access (ie. buffer overflow) issue that was found and fixed
> +in the SD Host  Controller emulation (hw/sd/sdhci.c).

Odd double space.

> +
> +On the surface, this bug appears to be a genuine security flaw, with potentially
> +severe implications. But digging further down, there are only two ways to use
> +SD Host Controller emulation, one is via 'sdhci-pci' interface and the other
> +is via 'generic-sdhci' interface.
> +
> +Of these two, the 'sdhci-pci' interface had actually been disabled by default
> +in the upstream QEMU releases (commit [1910913 "sdhci: Make device "sdhci-pci"
> +unavailable with -device"](http://git.qemu.org/?p=qemu.git;a=commit;h=1910913)
> +at the time the flaw was reported; therefore, guests could not possibly use
> +'sdhci-pci' for any  purpose.

and again.


-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3226
Virtualization:  qemu.org | libvirt.org