Re: Re: CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS

[Sasha Levin <sashal () kernel org>]

On Thu, Mar 18, 2021 at 10:19:31AM -0700, Kurt H Maier wrote:
> On Thu, Mar 18, 2021 at 01:08:21PM +0100, Greg KH wrote:
> > But none of that takes into account for the backporting of commits into
> > the stable tree, you need a different tool for that, which many of us
> > have our own.  If you use that you will see that the above commit really
> > is in lots of fixed kernel trees:
> >
> > $ id_found_in 3d63b7e4ae0dc5e02d28ddd2fa1f945defc68d81
> > 3.16.61 3.18.115 4.4.140 4.9.112 4.14.54 4.17.5 4.18
>
> It's not really Red Hat's fault that there are six hundred "stable"
> kernel versions, which each change approximately weekly.  It's generally
> not worth tracking, and it would not be sane to expect Red Hat to seek
> or announce CVEs for git branches they don't maintain.

I think that this is an excellent point: RedHat shouldn't be reporting
issues for "Linux Kernel" then. Look at the subject of this mail:

        CVE-2021-20219 Linux kernel: improper synchronization in flush_to_ldisc() can lead to DoS

It doesn't say "Red Hat Linux kernel", it just says "Linux kernel",
right?

Red Hat runs on a forked version of the kernel that has it's own set of
backports, features, and bugs. As you pointed out I think it would make
a lot of sense if they would instead start assigning CVEs for "Red Hat
Linux Kernel".

--
Thanks,
Sasha