3 ms·
The problem is that if you make too big of a deal about a particular patch, then someone just reverse engineers the vuln from the fix and your responsible discl
by bragr 5mo ago
The problem is that if you make too big of a deal about a particular patch, then someone just reverse engineers the vuln from the fix and your responsible disclosure period doesn't exist anymore.
Gentoo has to take some blame too for not keeping all the kernels they maintain patched in a timely way.
- john_strinlai 5mo agoyou minimize this with the curated contact list. the baddies are looking at every patch anyways.
- tremon 5mo ago> Gentoo has to take some blame too for not keeping all the kernels they maintain patched in a timely way. How do you figure that? From what I could tell from the earlier post, the fix has only been backported to 6.18 and later, and as TFA indicates the distro's were not informed of the security implications of this fix. All distro's shipping a major kernel version from more than a year ago -- and that includes all LTS kernels -- are vulnerable, regardless of how "timely" their patch schedules follow upstream.
- bragr 5mo ago>All distro's shipping a major kernel version from more than a year ago -- and that includes all LTS kernels -- are vulnerable, regardless of how "timely" their patch schedules follow upstream To be fair, I question the wisdom of managing kernels like that across all distros.