[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <CAFswPa8A2EeST20UtGzVDFo+bVh5QVYCKO+W861PvQTonkZKKw@mail.gmail.com>
Date: Sat, 24 Feb 2024 09:22:29 +0100
From: eduardo vela <evn@...glers.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVEs issued by the Linux kernel CNA
On Fri, 23 Feb 2024, 06:40 Greg KH, <greg@...ah.com> wrote:
> On Thu, Feb 22, 2024 at 09:05:42PM +0100, Solar Designer wrote:
> > Speaking of which, we allow for CVEs to be requested via linux-distros,
> > to be assigned by one of the CNAs in there. The current Linux kernel
> > CVE documentation is very strict about rejecting such third-party
> > assignments if they're "for an actively supported kernel":
>
> That's the rules from CVE themselves, it's not unique to the kernel
> here. You will run into this more as more open source projects take
> over the CVE process for their codebases. curl and python are two
> examples of which linux-distros are not allowed to do this for either.
>
> > "Any CVE that is assigned against the Linux kernel for an actively
> > supported kernel version, by any group other than the kernel assignment
> > CVE team should not be treated as a valid CVE. Please notify the kernel
> > CVE assignment team at <cve@...nel.org> so that they can work to
> > invalidate such entries through the CNA remediation process."
> >
> > So I guess we should now exclude upstream actively supported kernels
> > from this offer/practice.
>
> Yes, that is a requirement that all CNAs must now follow.
>
> > Distro CNAs can still assign CVEs for issues limited to
> > downstream/distro kernels and for issues in upstream kernels that are
> > not currently supported upstream.
>
> Yes.
>
> > I guess they can also assign
> > CVEs against downstream/distro kernels even if the code is the same as
> > in an upstream actively supported kernel, but the threat model is
> > different (e.g., untrusted filesystem images are brought into the threat
> > model in a distro). Sounds right?
>
> That is probably NOT ok as per the CVE rules, sorry.
This would likely result in MITRE (the root) just asking the conflicting
CNAs to decide who will issue the CVE.
RedHat and Google are root CNAs, so it likely would be resolved on the
roots meeting.
All CNAs should know how to handle this, otherwise they wouldn't be
> allowed to be a CNA. Whomever was acting as a CNA for linux-distros
> knows these rules, please discuss this with them if you have specific
> questions.
>
> thanks,
>
> greg k-h
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
