Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Tue, 3 Oct 2017 13:27:09 +0200
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Subject: Re: Linux kernel CVEs not mentioned on oss-security

On Thu, Sep 28, 2017 at 05:37:21PM -0400, Brad Spengler wrote:
> > > CVE-2017-0605:
> > > --------------
> > > https://security-tracker.debian.org/tracker/CVE-2017-0605
> > > upstream: (4.12-rc1) [e09e28671cda63e6308b31798b997639120e2a21]
> > > 
> > > is e.g. includedin 3.16.44 (a1141b19b23a0605d46f3fab63fd2d76207096c4),
> > > 3.2.89 (e39e64193a8a611d11d4c62579a7246c1af70d1c) but not in 4.9.
> > > 
> > > (afaics not Cc'ed to stable).
> > 
> > Ouch, thanks for letting me know, that's not good, we don't want to get
> > the trees out of sync for obvious reasons.
> 
> The above CVE shouldn't exist; the patch doesn't fix any vulnerability
> as the upstream commit message itself notes, and didn't need to be
> backported to any of the kernels it was backported to.  Not only that, the
> above advisory marked it as a remote vulnerability with critical severity.
> It looks like Debian and Ubuntu released updated kernels, while Red Hat and
> SuSE marked it as WONTFIX and unaffected, respectively.  I am not sure why
> neither simply rejected the CVE.

Yeah, this one keeps trying to get re-introduced as a "fix", when it
really isn't (see the archives of the stable@...r mailing list for
details.

I don't know how you can "reject" a CVE, is there a proceedure
somewhere?  There's lots of CVEs out there that people create against
the kernel that just aren't issues at all, but I've been ignoring them
as it makes people happy to assign and track them for no reason.

Is there some way a project can get them rejected?

thanks,

greg k-h

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ