Date: Tue, 3 Oct 2017 13:27:09 +0200 From: Greg KH <greg@...ah.com> To: oss-security@...ts.openwall.com Subject: Re: Linux kernel CVEs not mentioned on oss-security On Thu, Sep 28, 2017 at 05:37:21PM -0400, Brad Spengler wrote: > > > CVE-2017-0605: > > > -------------- > > > https://security-tracker.debian.org/tracker/CVE-2017-0605 > > > upstream: (4.12-rc1) [e09e28671cda63e6308b31798b997639120e2a21] > > > > > > is e.g. includedin 3.16.44 (a1141b19b23a0605d46f3fab63fd2d76207096c4), > > > 3.2.89 (e39e64193a8a611d11d4c62579a7246c1af70d1c) but not in 4.9. > > > > > > (afaics not Cc'ed to stable). > > > > Ouch, thanks for letting me know, that's not good, we don't want to get > > the trees out of sync for obvious reasons. > > The above CVE shouldn't exist; the patch doesn't fix any vulnerability > as the upstream commit message itself notes, and didn't need to be > backported to any of the kernels it was backported to. Not only that, the > above advisory marked it as a remote vulnerability with critical severity. > It looks like Debian and Ubuntu released updated kernels, while Red Hat and > SuSE marked it as WONTFIX and unaffected, respectively. I am not sure why > neither simply rejected the CVE. Yeah, this one keeps trying to get re-introduced as a "fix", when it really isn't (see the archives of the stable@...r mailing list for details. I don't know how you can "reject" a CVE, is there a proceedure somewhere? There's lots of CVEs out there that people create against the kernel that just aren't issues at all, but I've been ignoring them as it makes people happy to assign and track them for no reason. Is there some way a project can get them rejected? thanks, greg k-h
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ