<story><title>Systemd v228 local root exploit</title><url>http://www.openwall.com/lists/oss-security/2017/01/24/4</url></story><parent_chain><item><author>implr</author><text>&amp;gt;We would like to see that systemd upstream retrieves CVE&amp;#x27;s themself for their own bugs, even if its believed that its just a local DoS.&lt;p&gt;So not only they didn&amp;#x27;t notice this was exploitable, they also seem to think that a local DoS is not enough for a CVE or a public report. Excellent.</text></item></parent_chain><comment><author>KuiN</author><text>This is the really concerning part. &lt;i&gt;silently fixed in the upstream git&lt;/i&gt; is not at all an acceptable way to deal with serious security flaws in your product.</text></comment>
<story><title>Systemd v228 local root exploit</title><url>http://www.openwall.com/lists/oss-security/2017/01/24/4</url></story><parent_chain><item><author>implr</author><text>&amp;gt;We would like to see that systemd upstream retrieves CVE&amp;#x27;s themself for their own bugs, even if its believed that its just a local DoS.&lt;p&gt;So not only they didn&amp;#x27;t notice this was exploitable, they also seem to think that a local DoS is not enough for a CVE or a public report. Excellent.</text></item></parent_chain><comment><author>jsmeaton</author><text>Hanlon&amp;#x27;s Razor; perhaps whoever wrote&amp;#x2F;merged the patch didn&amp;#x27;t consider the possibility of an exploit?</text></comment>