Date: Wed, 10 Jun 2020 17:36:45 +0200 From: Greg KH <greg@...ah.com> To: oss-security@...ts.openwall.com Subject: Re: kernel: Multiple SSBD related flaws CVE-2020-10766 , CVE-2020-10767, CVE-2020-10768 On Thu, Jun 11, 2020 at 01:14:03AM +1000, Wade Mealing wrote: > > Did you ask the authors of the patches? I think they might have already > > assigned CVEs from Google's pool, based on previous interactions with > > those developers... > > I am in discussions with Anthony Steinhauser from Google, Anthony > stated there were no CVE's assigned. This message was mainly for the > other CNA's ( https://cve.mitre.org/cve/request_id.html ) who may be > able to assign CVE's. Is oss-security the place to sync up on those things? I thought you all had your own list to sync on those things, as that must happen often. > If the kernel was a CVE Numbering Authority, they could assign their > own ( https://cve.mitre.org/cve/cna.html#become_a_cna ) and this whole > problem would not exist. I'm not on the security@...nel.org mailing > list (even after asking), so I can't really say what goes on behind > those closed doors, I would think it falls under their interests. The kernel does NOT want to become a CVE Numbering Authority, and our documentation explicitly states that if you want a CVE for a kernel issue, you can just go ask MITRE or someone else for it: https://www.kernel.org/doc/html/latest/admin-guide/security-bugs.html There's loads of reasons why CVEs don't really work for the kernel at all, as has been discussed many times here on this list, and in other places, and even with MITRE themselves (and they agree with me). I don't think we want to rehash that again here :) thanks, greg k-h
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.