oss-sec mailing list archives

Re: CVEs issued by the Linux kernel CNA


From: eduardo vela <evn () googlers com>
Date: Sat, 24 Feb 2024 09:22:29 +0100

On Fri, 23 Feb 2024, 06:40 Greg KH, <greg () kroah com> wrote:

On Thu, Feb 22, 2024 at 09:05:42PM +0100, Solar Designer wrote:
Speaking of which, we allow for CVEs to be requested via linux-distros,
to be assigned by one of the CNAs in there.  The current Linux kernel
CVE documentation is very strict about rejecting such third-party
assignments if they're "for an actively supported kernel":

That's the rules from CVE themselves, it's not unique to the kernel
here.  You will run into this more as more open source projects take
over the CVE process for their codebases.  curl and python are two
examples of which linux-distros are not allowed to do this for either.

"Any CVE that is assigned against the Linux kernel for an actively
supported kernel version, by any group other than the kernel assignment
CVE team should not be treated as a valid CVE. Please notify the kernel
CVE assignment team at <cve () kernel org> so that they can work to
invalidate such entries through the CNA remediation process."

So I guess we should now exclude upstream actively supported kernels
from this offer/practice.

Yes, that is a requirement that all CNAs must now follow.

Distro CNAs can still assign CVEs for issues limited to
downstream/distro kernels and for issues in upstream kernels that are
not currently supported upstream.

Yes.

I guess they can also assign
CVEs against downstream/distro kernels even if the code is the same as
in an upstream actively supported kernel, but the threat model is
different (e.g., untrusted filesystem images are brought into the threat
model in a distro).  Sounds right?

That is probably NOT ok as per the CVE rules, sorry.


This would likely result in MITRE (the root) just asking the conflicting
CNAs to decide who will issue the CVE.

RedHat and Google are root CNAs, so it likely would be resolved on the
roots meeting.

All CNAs should know how to handle this, otherwise they wouldn't be
allowed to be a CNA.  Whomever was acting as a CNA for linux-distros
knows these rules, please discuss this with them if you have specific
questions.

thanks,

greg k-h


Current thread: