Re: Current standards/criteria for 'Undefined Behavior'

• To: Carsten Eiram <che@riskbasedsecurity.com>, "Adinolfi, Daniel R" <dadinolfi@mitre.org>
• Subject: Re: Current standards/criteria for 'Undefined Behavior'
• From: Art Manion <amanion@cert.org>
• Date: Thu, 6 Jul 2017 16:11:32 -0400
• Authentication-results: spf=none (sender IP is 129.83.29.3) smtp.mailfrom=LISTS.MITRE.ORG; mitre.mail.onmicrosoft.com; dkim=none (message not signed) header.d=none;mitre.mail.onmicrosoft.com; dmarc=none action=none header.from=cert.org;
• Cc: cve-editorial-board-list <cve-editorial-board-list@LISTS.MITRE.ORG>
• Delivery-date: Thu Jul 6 16:30:42 2017
• Dkim-filter: OpenDKIM Filter v2.11.0 veto.sei.cmu.edu v66KBamk025981
• In-reply-to: <CACph5NXYh4g=NvHMXuE3xz5yip1SuF_Qqcvq5XyGp4Ns-FkihA@mail.gmail.com>
• List-help: <mailto:LISTSERV@LISTS.MITRE.ORG?body=INFO%20CVE-EDITORIAL-BOARD-LIST>
• List-owner: <mailto:CVE-EDITORIAL-BOARD-LIST-request@LISTS.MITRE.ORG>
• List-subscribe: <mailto:CVE-EDITORIAL-BOARD-LIST-subscribe-request@LISTS.MITRE.ORG>
• List-unsubscribe: <mailto:CVE-EDITORIAL-BOARD-LIST-unsubscribe-request@LISTS.MITRE.ORG>
• References: <alpine.LNX.2.00.1705021224040.32256@forced.attrition.org> <BY2PR09MB104693962DC9E3AFA1117DC9CC160@BY2PR09MB1046.namprd09.prod.outlook.com> <alpine.LNX.2.00.1705081849310.32256@forced.attrition.org> <59571B66-144E-4120-B166-7EDDD6C53E5D@mitre.org> <CACph5NXYh4g=NvHMXuE3xz5yip1SuF_Qqcvq5XyGp4Ns-FkihA@mail.gmail.com>
• Sender: <owner-cve-editorial-board-list@lists.mitre.org>
• Spamdiagnosticmetadata: 6cdb8bfc89744bd8bfee511e3e65aa05
• Spamdiagnosticoutput: 1:2
• User-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:52.0) Gecko/20100101 Thunderbird/52.2.1

On 5/11/17 7:19 AM, Carsten Eiram wrote:

I hope the new MITRE CVE team realizes they are in a minority of people 
in
this industry, who actually consider such issues as being CVE worthy by
default or even security-relevant without some proof of there being a
(realistic) security impact.

...

We do not disagree that issues leading to undefined
behaviour _theoretically_ have a security impact. Rarely is it ever 
proven,
though. In fact, I don't think Agostino Sarubbo (or Hanno for that 
matter)
has proven a single of the UBSan issues, which he has reported many of,
actually did have a real-world impact.

Some in-depth UB analysis:

  https://blog.regehr.org/archives/1520

Was the conclusion that CVE IDs would *not* be assigned for UB, unless 
there was reasonable evidence of a security impact?

 - Art

• Follow-Ups:
  • RE: Current standards/criteria for 'Undefined Behavior'
    • From: "Coffin, Chris" <ccoffin@mitre.org>

• Prev by Date: Re: CNA Rules Revision Process
• Next by Date: RE: Current standards/criteria for 'Undefined Behavior'
• Previous by thread: New CNA - ZTE
• Next by thread: RE: Current standards/criteria for 'Undefined Behavior'
• Index(es):
  • Date
  • Thread