Mauro Carvalho Chehab | 1d7078d | 2016-09-19 08:07:49 -0300 | [diff] [blame^] | 1 | Security bugs |
| 2 | ============= |
| 3 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 4 | Linux kernel developers take security very seriously. As such, we'd |
| 5 | like to know when a security bug is found so that it can be fixed and |
| 6 | disclosed as quickly as possible. Please report security bugs to the |
| 7 | Linux kernel security team. |
| 8 | |
| 9 | 1) Contact |
Mauro Carvalho Chehab | 1d7078d | 2016-09-19 08:07:49 -0300 | [diff] [blame^] | 10 | ---------- |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 11 | |
| 12 | The Linux kernel security team can be contacted by email at |
| 13 | <security@kernel.org>. This is a private list of security officers |
| 14 | who will help verify the bug report and develop and release a fix. |
| 15 | It is possible that the security team will bring in extra help from |
| 16 | area maintainers to understand and fix the security vulnerability. |
| 17 | |
| 18 | As it is with any bug, the more information provided the easier it |
| 19 | will be to diagnose and fix. Please review the procedure outlined in |
| 20 | REPORTING-BUGS if you are unclear about what information is helpful. |
| 21 | Any exploit code is very helpful and will not be released without |
| 22 | consent from the reporter unless it has already been made public. |
| 23 | |
| 24 | 2) Disclosure |
Mauro Carvalho Chehab | 1d7078d | 2016-09-19 08:07:49 -0300 | [diff] [blame^] | 25 | ------------- |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 26 | |
| 27 | The goal of the Linux kernel security team is to work with the |
| 28 | bug submitter to bug resolution as well as disclosure. We prefer |
| 29 | to fully disclose the bug as soon as possible. It is reasonable to |
| 30 | delay disclosure when the bug or the fix is not yet fully understood, |
| 31 | the solution is not well-tested or for vendor coordination. However, we |
| 32 | expect these delays to be short, measurable in days, not weeks or months. |
| 33 | A disclosure date is negotiated by the security team working with the |
| 34 | bug submitter as well as vendors. However, the kernel security team |
| 35 | holds the final say when setting a disclosure date. The timeframe for |
Lucas De Marchi | 25985ed | 2011-03-30 22:57:33 -0300 | [diff] [blame] | 36 | disclosure is from immediate (esp. if it's already publicly known) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 37 | to a few weeks. As a basic default policy, we expect report date to |
| 38 | disclosure date to be on the order of 7 days. |
| 39 | |
| 40 | 3) Non-disclosure agreements |
Mauro Carvalho Chehab | 1d7078d | 2016-09-19 08:07:49 -0300 | [diff] [blame^] | 41 | ---------------------------- |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 42 | |
| 43 | The Linux kernel security team is not a formal body and therefore unable |
| 44 | to enter any non-disclosure agreements. |