Root/
1 | Linux kernel developers take security very seriously. As such, we'd |
2 | like to know when a security bug is found so that it can be fixed and |
3 | disclosed as quickly as possible. Please report security bugs to the |
4 | Linux kernel security team. |
5 | |
6 | 1) Contact |
7 | |
8 | The Linux kernel security team can be contacted by email at |
9 | <security@kernel.org>. This is a private list of security officers |
10 | who will help verify the bug report and develop and release a fix. |
11 | It is possible that the security team will bring in extra help from |
12 | area maintainers to understand and fix the security vulnerability. |
13 | |
14 | As it is with any bug, the more information provided the easier it |
15 | will be to diagnose and fix. Please review the procedure outlined in |
16 | REPORTING-BUGS if you are unclear about what information is helpful. |
17 | Any exploit code is very helpful and will not be released without |
18 | consent from the reporter unless it has already been made public. |
19 | |
20 | 2) Disclosure |
21 | |
22 | The goal of the Linux kernel security team is to work with the |
23 | bug submitter to bug resolution as well as disclosure. We prefer |
24 | to fully disclose the bug as soon as possible. It is reasonable to |
25 | delay disclosure when the bug or the fix is not yet fully understood, |
26 | the solution is not well-tested or for vendor coordination. However, we |
27 | expect these delays to be short, measurable in days, not weeks or months. |
28 | A disclosure date is negotiated by the security team working with the |
29 | bug submitter as well as vendors. However, the kernel security team |
30 | holds the final say when setting a disclosure date. The timeframe for |
31 | disclosure is from immediate (esp. if it's already publically known) |
32 | to a few weeks. As a basic default policy, we expect report date to |
33 | disclosure date to be on the order of 7 days. |
34 | |
35 | 3) Non-disclosure agreements |
36 | |
37 | The Linux kernel security team is not a formal body and therefore unable |
38 | to enter any non-disclosure agreements. |
39 |
Branches:
ben-wpan
ben-wpan-stefan
javiroman/ks7010
jz-2.6.34
jz-2.6.34-rc5
jz-2.6.34-rc6
jz-2.6.34-rc7
jz-2.6.35
jz-2.6.36
jz-2.6.37
jz-2.6.38
jz-2.6.39
jz-3.0
jz-3.1
jz-3.11
jz-3.12
jz-3.13
jz-3.15
jz-3.16
jz-3.18-dt
jz-3.2
jz-3.3
jz-3.4
jz-3.5
jz-3.6
jz-3.6-rc2-pwm
jz-3.9
jz-3.9-clk
jz-3.9-rc8
jz47xx
jz47xx-2.6.38
master
Tags:
od-2011-09-04
od-2011-09-18
v2.6.34-rc5
v2.6.34-rc6
v2.6.34-rc7
v3.9