Re: [stable] Linux 2.6.25.10

[pageexec]

On 15 Jul 2008 at 13:18, Linus Torvalds wrote:

> 
> 
> On Tue, 15 Jul 2008, pageexec@xxxxxxxxxxx wrote:
> >
> > in any case, i don't see why you can't put keywords into the commit
> > that say the bug being fixed is 'security related' or 'potentially 
> > exploitable', etc. people can then decide how to prioritize them.
> 
> Because I see no point. Quite often, we don't even realize some random bug 
> could have been a security issue.
> 
> It's not worth my energy, in other words. 

i understand and i think noone expects that. in fact, i know how much
expertise and time it takes to determine that. but what happens when
you do figure out the security relevance of a bug during bug submission
(say, it goes directly to security@xxxxxxxxxx with a PoC to trigger it)
or while working out the fix or you see that it falls into an well-known
exploitable bug class? you have the information yet you still make no
mention of it. *that* at least can be fixed, if you chose so.

cheers,
 PaX Team

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/