[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Fri, 23 Feb 2024 06:40:18 +0100
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVEs issued by the Linux kernel CNA
On Thu, Feb 22, 2024 at 09:05:42PM +0100, Solar Designer wrote:
> Speaking of which, we allow for CVEs to be requested via linux-distros,
> to be assigned by one of the CNAs in there. The current Linux kernel
> CVE documentation is very strict about rejecting such third-party
> assignments if they're "for an actively supported kernel":
That's the rules from CVE themselves, it's not unique to the kernel
here. You will run into this more as more open source projects take
over the CVE process for their codebases. curl and python are two
examples of which linux-distros are not allowed to do this for either.
> "Any CVE that is assigned against the Linux kernel for an actively
> supported kernel version, by any group other than the kernel assignment
> CVE team should not be treated as a valid CVE. Please notify the kernel
> CVE assignment team at <cve@...nel.org> so that they can work to
> invalidate such entries through the CNA remediation process."
>
> So I guess we should now exclude upstream actively supported kernels
> from this offer/practice.
Yes, that is a requirement that all CNAs must now follow.
> Distro CNAs can still assign CVEs for issues limited to
> downstream/distro kernels and for issues in upstream kernels that are
> not currently supported upstream.
Yes.
> I guess they can also assign
> CVEs against downstream/distro kernels even if the code is the same as
> in an upstream actively supported kernel, but the threat model is
> different (e.g., untrusted filesystem images are brought into the threat
> model in a distro). Sounds right?
That is probably NOT ok as per the CVE rules, sorry.
All CNAs should know how to handle this, otherwise they wouldn't be
allowed to be a CNA. Whomever was acting as a CNA for linux-distros
knows these rules, please discuss this with them if you have specific
questions.
thanks,
greg k-h
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
