oss-sec mailing list archives
Re: CVEs issued by the Linux kernel CNA
From: Solar Designer <solar () openwall com>
Date: Thu, 22 Feb 2024 21:05:42 +0100
On Tue, Feb 20, 2024 at 03:30:28PM -0800, Alan Coopersmith wrote:
As recently announced [1], kernel.org is now a CNA for the Linux kernel, and
See also discussion here: https://lwn.net/Articles/961961/
today issued its first 8 CVEs, as seen in the archives of their mailing list at https://lore.kernel.org/linux-cve-announce/ .
There are many more already, all of them also archived at: https://lists.openwall.net/linux-cve-announce/
Their documentation [2] warns that we should expect a "seemingly large number of CVEs that are issued by the Linux kernel team". Since there's already an archived mailing list covering the CVE assignments, I don't think it makes sense to mirror that large amount of traffic here, but to only bring to oss-security those that are especially interesting or useful to discuss further. What do others think? [1] http://www.kroah.com/log/blog/2024/02/13/linux-is-a-cna/ [2] https://docs.kernel.org/process/cve.html
Yes, I agree. Besides "especially interesting or useful to discuss further", another exception will be for issues that were brought to linux-distros, for transparency. Speaking of which, we allow for CVEs to be requested via linux-distros, to be assigned by one of the CNAs in there. The current Linux kernel CVE documentation is very strict about rejecting such third-party assignments if they're "for an actively supported kernel": "Any CVE that is assigned against the Linux kernel for an actively supported kernel version, by any group other than the kernel assignment CVE team should not be treated as a valid CVE. Please notify the kernel CVE assignment team at <cve () kernel org> so that they can work to invalidate such entries through the CNA remediation process." So I guess we should now exclude upstream actively supported kernels from this offer/practice. Distro CNAs can still assign CVEs for issues limited to downstream/distro kernels and for issues in upstream kernels that are not currently supported upstream. I guess they can also assign CVEs against downstream/distro kernels even if the code is the same as in an upstream actively supported kernel, but the threat model is different (e.g., untrusted filesystem images are brought into the threat model in a distro). Sounds right? Alexander
Current thread:
- CVEs issued by the Linux kernel CNA Alan Coopersmith (Feb 20)
- Re: CVEs issued by the Linux kernel CNA Marcus Meissner (Feb 21)
- Re: CVEs issued by the Linux kernel CNA Solar Designer (Feb 22)
- Re: CVEs issued by the Linux kernel CNA Greg KH (Feb 22)
- Re: CVEs issued by the Linux kernel CNA eduardo vela (Feb 24)
- Re: CVEs issued by the Linux kernel CNA Greg KH (Feb 22)
- Re: CVEs issued by the Linux kernel CNA Vegard Nossum (Mar 13)