[Bug malloc/25945] ASLR information leak via Safe-Linking and tcache or fastbin chunks.

["carlos at redhat dot com" <sourceware-bugzilla@sourceware.org>]

https://sourceware.org/bugzilla/show_bug.cgi?id=25945

--- Comment #5 from Carlos O'Donell <carlos at redhat dot com> ---
(In reply to Florian Weimer from comment #4)
> I'm not sure if this actually eligible for a CVE ID because it is an
> unreleased feature.  I've asked here:
> 
> <https://www.openwall.com/lists/oss-security/2020/05/08/3>
> 
> It's also a bug in a mitigation measure that requires another application
> bug in order to matter, and we usually do not treat those bugs as
> vulnerabilities in their own right.

I also appreciate that this is that it does not encourage prompt disclosure.

I will do my best to give positive incentive for prompt disclosure.

The things that are within my control are:

- Recognition with git authorship for patches you created.
  - See https://sourceware.org/glibc/wiki/Contribution%20checklist for how to
submit a patch and specifically the copyright requirements.

- Recognition with "Reported-by:" markup in git commit messages (if you are not
the patch author).

- Recognition with your name in the project NEWS for the release as the
reporter.

Please feel free to suggest any other actions I can take to provide incentive.

Regarding the assignment of the CVE ID, like Florian says, we're gathering
consensus on this for unreleased products.

-- 
You are receiving this mail because:
You are on the CC list for the bug.