Re: [stable] Linux 2.6.25.10

pageexec
2008-07-15T20:25:48Z

On 15 Jul 2008 at 13:18, Linus Torvalds wrote:

>
>
> On Tue, 15 Jul 2008, pageexec@freemail.hu wrote:
> >
> > in any case, i don't see why you can't put keywords into the commit
> > that say the bug being fixed is 'security related' or 'potentially
> > exploitable', etc. people can then decide how to prioritize them.
>
> Because I see no point. Quite often, we don't even realize some random bug
> could have been a security issue.
>
> It's not worth my energy, in other words.

i understand and i think noone expects that. in fact, i know how much
expertise and time it takes to determine that. but what happens when
you do figure out the security relevance of a bug during bug submission
(say, it goes directly to security@kernel.org with a PoC to trigger it)
or while working out the fix or you see that it falls into an well-known
exploitable bug class? you have the information yet you still make no
mention of it. *that* at least can be fixed, if you chose so.

cheers,
PaX Team