{"id":977,"date":"2016-10-20T16:02:04","date_gmt":"2016-10-20T23:02:04","guid":{"rendered":"https:\/\/outflux.net\/blog\/?p=977"},"modified":"2016-10-20T23:18:32","modified_gmt":"2016-10-21T06:18:32","slug":"cve-2016-5195","status":"publish","type":"post","link":"https:\/\/outflux.net\/blog\/archives\/2016\/10\/20\/cve-2016-5195\/","title":{"rendered":"CVE-2016-5195"},"content":{"rendered":"<p><a href=\"\/blog\/archives\/2016\/10\/18\/security-bug-lifetime\/\">My prior post<\/a> showed my research from earlier in the year at the 2016 Linux Security Summit on kernel security flaw lifetimes. Now that <a href=\"https:\/\/git.kernel.org\/linus\/19be0eaffa3ac7d8eb6784ad9bdbc7d67ed8e619\">CVE-2016-5195<\/a> is public, here are updated graphs and statistics. Due to their rarity, the Critical bug average has now jumped from 3.3 years to 5.2 years. There aren&#8217;t many, but, as I mentioned, they still exist, whether you know about them or not. CVE-2016-5195 was sitting on everyone&#8217;s machine when I gave my <a href=\"https:\/\/www.youtube.com\/watch?v=aMkCKeZ8xZw#t=471\">LSS talk<\/a>, and there are still other flaws on all our Linux machines right now. (And, I should note, this problem is not unique to Linux.) Dealing with knowing that there are always going to be bugs present requires proactive <a href=\"http:\/\/kernsec.org\/wiki\/index.php\/Kernel_Self_Protection_Project\">kernel self-protection<\/a> (to minimize the effects of possible flaws) and vendors dedicated to <a href=\"https:\/\/source.android.com\/security\/bulletin\/\">updating their devices<\/a> regularly and quickly (to keep the exposure window minimized once a flaw is widely known).<\/p>\n<p>So, here are the graphs updated for the 668 CVEs known today:<\/p>\n<ul>\n<li>Critical: 3 @ 5.2 years average<\/li>\n<li>High: 44 @ 6.2 years average<\/li>\n<li>Medium: 404 @ 5.3 years average<\/li>\n<li>Low: 216 @ 5.5 years average<\/li>\n<\/ul>\n<p><img decoding=\"async\" src=\"\/illustrations\/2016\/lifetime-oct20.png\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/illustrations\/2016\/lifetime-high-oct20.png\" alt=\"\" \/><\/p>\n<p style='text-align:left'>&copy; 2016, <a href=\"https:\/\/outflux.net\/blog\/\">Kees Cook<\/a>. This work is licensed under a <a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\">Creative Commons Attribution-ShareAlike 4.0 License<\/a>.<br \/><a rel=\"license\" href=\"http:\/\/creativecommons.org\/licenses\/by-sa\/4.0\/\"><img decoding=\"async\" alt=\"CC BY-SA 4.0\" style=\"border-width:0\" src=\"https:\/\/i.creativecommons.org\/l\/by-sa\/4.0\/88x31.png\" \/><\/a> <\/p>\n","protected":false},"excerpt":{"rendered":"<p>My prior post showed my research from earlier in the year at the 2016 Linux Security Summit on kernel security flaw lifetimes. Now that CVE-2016-5195 is public, here are updated graphs and statistics. Due to their rarity, the Critical bug average has now jumped from 3.3 years to 5.2 years. There aren&#8217;t many, but, as [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[20,18,21,6,14,19],"tags":[],"_links":{"self":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/977"}],"collection":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/comments?post=977"}],"version-history":[{"count":6,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/977\/revisions"}],"predecessor-version":[{"id":984,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/posts\/977\/revisions\/984"}],"wp:attachment":[{"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/media?parent=977"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/categories?post=977"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outflux.net\/blog\/wp-json\/wp\/v2\/tags?post=977"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}