[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAFswPa83igZYQN7oAEEZERPCyOuiJv3sFD_+SZx2M_g8fhJDbg@mail.gmail.com>
Date: Sun, 27 Aug 2023 20:56:12 +0200
From: "Eduardo' Vela\" <Nava>" <evn@...gle.com>
To: oss-security@...ts.openwall.com
Subject: Re: linux-distros list policy and Linux kernel, again
On Sun, 27 Aug 2023, 19:41 Demi Marie Obenour, <demi@...isiblethingslab.com>
wrote:
> Does this include unfixed vulnerabilities?
>
The link* has more details, but briefly, deduplication is done by fix
commit.
Efforts to fix unfixed Syzkaller crashes (also something being worked on)
are complementary to the effort to generate CVE identifiers for them, if
that's your question (so, yes? Unfixed vulnerabilities found by Syzkaller
are meant to be fixed first and then a CVE is generated for the reports
fixed by their corresponding Fix commit).
Generating CVEs for Syzkaller reports without deduplicating them first
would be disruptive and useless (the link* goes into more details).
Deduplication is subjective as it depends on how the bugs are understood.
The analysis that is needed to deduplicate is happening as part of the fix
review process.
One could, of course, create a different mechanism to automatically (or
semi-automatically) deduplicate Syzkaller reports and accept the risk of
duplicate CVEs. This may be something to look at in the future, but it's
not what's being worked on for the first iteration, and we probably will
have a lot to fix and learn from even after the first wave of CVEs are
generated.
* https://github.com/google/cvelist/tree/cve-automation/fuzzer
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
