[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20240130214500.GA24892@openwall.com>
Date: Tue, 30 Jan 2024 22:45:00 +0100
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Re: FWD: Kernel vulnerabilities CVE-2021-33630 & CVE-2021-33631
Thank you Greg for looking into these issues. It's great that most
longterm kernel trees appear already fixed.
On Tue, Jan 30, 2024 at 08:34:03AM -0800, Greg KH wrote:
> Yeah, that looks really high but who knows how CVSS scores really are
> calculated :)
Actually, we do - this is transparent. NVD publishes not only the
scores, but also all the inputs, and the formula is public and they have
a calculator on their website:
https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
Vulnerability scoring is genuinely difficult. I think CVSS is a pretty
good attempt at standardizing it, but it cannot capture all the nuance,
especially not in the Base Score.
For CVE-2021-33631 (the ext4 BUG), both the distro vendor's and NVD's
CVSS input vectors specify AV:L/AC:L/PR:L/UI:N, which means the
vulnerability can be triggered by a local system user at will and
without additional privileges. I'd say that deliberately getting the
kernel to work on a corrupted filesystem requires at least one of:
physical access (AV:P) or privileges on the system (PR:H) or user
interaction (UI:R). However, there's no way to encode this in one CVSS
vector. Also, in the physical access case, at least the availability
impact typically does not apply (would be A:N).
Maybe having multiple CVSS vectors per vulnerability (and then taking
the average score?) could be a solution, but it'd require that someone
very familiar with the affected component and its usage actually spend
time thinking of all relevant combinations. Not likely to happen.
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
