oss-sec mailing list archives
Re: Details on this supposed Linux Kernel ksmbd RCE
From: Marcus Meissner <meissner () suse de>
Date: Tue, 27 Dec 2022 11:25:36 +0100
On Fri, Dec 23, 2022 at 10:50:32AM -0600, John Helmert III wrote:
On Fri, Dec 23, 2022 at 05:19:06PM +0100, Marcus Meissner wrote:On Fri, Dec 23, 2022 at 03:20:17PM +0100, Greg KH wrote:On Fri, Dec 23, 2022 at 09:04:25AM -0500, Sasha Levin wrote:On Fri, Dec 23, 2022 at 09:17:28AM +0100, Marcus Meissner wrote:Not sure why they do not like you, but to be very clear anyone else can requests CVEs for the kernel, (except the blacklisted drivers/staging/ area).For CVEs assigned (earlier this month) to issues in drivers/staging, what would be the process to remove the assignment or mark them as invalid?And who is doing this "blacklisting" of staging drivers from CVEs? Why are they special when many distros do enable and rely on them?This is just information I received when I tried to allocate a CVE for a staging driver. It has been over a year ago, so perhaps the this changed meanwhile again.SUSE is a CNA. Wouldn't you be able to oassign a CVE via the SUSE CNA without going through MITRE?
Every CNA has to follow its set CVE assignment rules. The SUSE CNA is only allowed to assign CVEs for issues in SUSE products / SUSE specific code patches, preferably only non-public ones to avoid dups. See: https://www.cve.org/PartnerInformation/ListofPartners/partner/suse There is one fallback OSS CNA, which is the Red Hat CNA. It is allowed to assign CVEs for OSS issues, and also is a root on its own: https://www.cve.org/PartnerInformation/ListofPartners/partner/redhat
In my talks with MITRE, they have said they don't want to make public statments about the CVE issues and Linux, which is sad, but they never mentioned anything about "we will ignore this portion of the kernel source tree". Is that in a public statement anywhere that I can point to when people ask the kernel security team for CVEs?No, it was in a private email, I will search for it, but I cannot promise I will find it again. Ciao, MarcusRelatedly, I find it very frustrating how little visibility there is into the world's interactions with cveform.mitre.org. Your form inputs aren't even sent back to you in the automated response, which makes it quite hard to keep track of the state of changes you've asked for.
Yes, I agree, it is a bit intransparent. Lets see how this all changes, as this manual CVE requesting should be done way less in the future, as most requests will be more via the CVE automation APIs in the future (FWIW CNAs already submit via github pull requests). Ciao, Marcus
Current thread:
- Details on this supposed Linux Kernel ksmbd RCE Josh Bressers (Dec 22)
- Re: Details on this supposed Linux Kernel ksmbd RCE Jan Schaumann (Dec 22)
- Re: Details on this supposed Linux Kernel ksmbd RCE Greg KH (Dec 22)
- Re: Details on this supposed Linux Kernel ksmbd RCE Marcus Meissner (Dec 23)
- Re: Details on this supposed Linux Kernel ksmbd RCE Eric Biggers (Dec 23)
- Re: Details on this supposed Linux Kernel ksmbd RCE Jeffrey Walton (Dec 23)
- Re: Details on this supposed Linux Kernel ksmbd RCE Sasha Levin (Dec 23)
- Re: Details on this supposed Linux Kernel ksmbd RCE Greg KH (Dec 23)
- Re: Details on this supposed Linux Kernel ksmbd RCE Marcus Meissner (Dec 23)
- Re: Details on this supposed Linux Kernel ksmbd RCE John Helmert III (Dec 23)
- Re: Details on this supposed Linux Kernel ksmbd RCE Marcus Meissner (Dec 27)
- Re: Details on this supposed Linux Kernel ksmbd RCE Greg KH (Dec 22)
- Re: Details on this supposed Linux Kernel ksmbd RCE Marcus Meissner (Dec 27)
- Re: Details on this supposed Linux Kernel ksmbd RCE Jan Schaumann (Dec 22)
- Re: Details on this supposed Linux Kernel ksmbd RCE John Helmert III (Dec 23)
- Re: Details on this supposed Linux Kernel ksmbd RCE Marcus Meissner (Dec 31)