oss-security - Re: Linux kernel CVEs not mentioned on oss-security

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 3 Oct 2017 13:27:09 +0200
From: Greg KH <greg@...ah.com>
To: oss-security@...ts.openwall.com
Subject: Re: Linux kernel CVEs not mentioned on oss-security

On Thu, Sep 28, 2017 at 05:37:21PM -0400, Brad Spengler wrote:
> > > CVE-2017-0605:
> > > --------------
> > > https://security-tracker.debian.org/tracker/CVE-2017-0605
> > > upstream: (4.12-rc1) [e09e28671cda63e6308b31798b997639120e2a21]
> > > 
> > > is e.g. includedin 3.16.44 (a1141b19b23a0605d46f3fab63fd2d76207096c4),
> > > 3.2.89 (e39e64193a8a611d11d4c62579a7246c1af70d1c) but not in 4.9.
> > > 
> > > (afaics not Cc'ed to stable).
> > 
> > Ouch, thanks for letting me know, that's not good, we don't want to get
> > the trees out of sync for obvious reasons.
> 
> The above CVE shouldn't exist; the patch doesn't fix any vulnerability
> as the upstream commit message itself notes, and didn't need to be
> backported to any of the kernels it was backported to.  Not only that, the
> above advisory marked it as a remote vulnerability with critical severity.
> It looks like Debian and Ubuntu released updated kernels, while Red Hat and
> SuSE marked it as WONTFIX and unaffected, respectively.  I am not sure why
> neither simply rejected the CVE.

Yeah, this one keeps trying to get re-introduced as a "fix", when it
really isn't (see the archives of the stable@...r mailing list for
details.

I don't know how you can "reject" a CVE, is there a proceedure
somewhere?  There's lots of CVEs out there that people create against
the kernel that just aren't issues at all, but I've been ignoring them
as it makes people happy to assign and track them for no reason.

Is there some way a project can get them rejected?

thanks,

greg k-h

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.