[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [qemu-web PATCH v2] Add "Security Process" information to the main w
Re: [qemu-web PATCH v2] Add "Security Process" information to the main website
Thu, 23 Jan 2020 13:43:14 -0600
Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Thunderbird/68.4.1
On 1/23/20 11:11 AM, Thomas Huth wrote:
One reporter of a security issue recently complained that it might not
be the best idea to store our "Security Process" in the Wiki. Well, while
the page in the Wiki is protected (so that only some few people can edit
it), it is still possible that someone might find a bug in the Wiki
software to alter the page contents...
Anyway, it looks more trustworthy if we present the "Security Process"
information in the static website instead. Thus this patch adds the
information from the wiki to the Jekyll-based website now.
Signed-off-by: Thomas Huth <address@hidden>
v2: Improved some sentences as suggested by Paolo
+### Publication embargo
+As a security issue reported, that is not already publically disclosed
+elsewhere, has an embargo date assigned and communicated to reporter. Embargo
Reads awkwardly. I'd suggest:
If a security issue is reported that is not already publicly disclosed,
an embargo date may be assigned and communicated to the reporter.
+periods will be negotiated by mutual agreement between members of the security
+team and other relevant parties to the problem. Members of the security contact
+list agree not to publically disclose any details of the security issue until
+the embargo date expires.
+For example, consider upstream commit [9201bb9 "sdhci.c: Limit the maximum
+block size"](http://git.qemu.org/?p=qemu.git;a=commit;h=9201bb9), an of out of
+bounds (OOB) memory access (ie. buffer overflow) issue that was found and fixed
+in the SD Host Controller emulation (hw/sd/sdhci.c).
Odd double space.
+On the surface, this bug appears to be a genuine security flaw, with
+severe implications. But digging further down, there are only two ways to use
+SD Host Controller emulation, one is via 'sdhci-pci' interface and the other
+is via 'generic-sdhci' interface.
+Of these two, the 'sdhci-pci' interface had actually been disabled by default
+in the upstream QEMU releases (commit [1910913 "sdhci: Make device "sdhci-pci"
+unavailable with -device"](http://git.qemu.org/?p=qemu.git;a=commit;h=1910913)
+at the time the flaw was reported; therefore, guests could not possibly use
+'sdhci-pci' for any purpose.
Eric Blake, Principal Software Engineer
Red Hat, Inc. +1-919-301-3226
Virtualization: qemu.org | libvirt.org