Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Sun, 27 Aug 2023 20:56:12 +0200
From: "Eduardo' Vela\" <Nava>" <>
Subject: Re: linux-distros list policy and Linux kernel, again

On Sun, 27 Aug 2023, 19:41 Demi Marie Obenour, <>

> Does this include unfixed vulnerabilities?

The link* has more details, but briefly, deduplication is done by fix

Efforts to fix unfixed Syzkaller crashes (also something being worked on)
are complementary to the effort to generate CVE identifiers for them, if
that's your question (so, yes? Unfixed vulnerabilities found by Syzkaller
are meant to be fixed first and then a CVE is generated for the reports
fixed by their corresponding Fix commit).

Generating CVEs for Syzkaller reports without deduplicating them first
would be disruptive and useless (the link* goes into more details).
Deduplication is subjective as it depends on how the bugs are understood.
The analysis that is needed to deduplicate is happening as part of the fix
review process.

One could, of course, create a different mechanism to automatically (or
semi-automatically) deduplicate Syzkaller reports and accept the risk of
duplicate CVEs. This may be something to look at in the future, but it's
not what's being worked on for the first iteration, and we probably will
have a lot to fix and learn from even after the first wave of CVEs are



Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.