Red Hat's @kurtseifried thinks that 200 hours of brute force is a defense failure. smells like sour grapes for having ignored the problem.

Jun 19, 2017 · 3:38 PM UTC
2
4
it's in the advisory: "it has a good chance of gaining eip control after 2^17 * 5.5 seconds = 200 hours"
1
you gave it a CVE, not Qualys. since you failed to discuss it with us, now's the time (to rescind it).
this is just ridiculous, you can't even explain what exactly is wrong (and thus how to correct it). no kernel enforced gap size is safe.
you're responsible for your actions, not Qualys (their advisory makes it quite clear what they did and did not do).
e.g., grsec's brute force prevention had to be disabled to be able to trigger the bug at all. PaX doesn't have such by design.
was your tweet professional too? anyway, we'll now have to do your professional job apparently.
1