Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <2661c15d-52d3-41b7-a725-cc66c2094ba4@oracle.com>
Date: Wed, 1 May 2024 13:27:06 -0700
From: Alan Coopersmith <alan.coopersmith@...cle.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVEs issued by the Linux kernel CNA

On 2/20/24 15:30, Alan Coopersmith wrote:
> As recently announced [1], kernel.org is now a CNA for the Linux kernel, and
> today issued its first 8 CVEs, as seen in the archives of their mailing list
> at https://lore.kernel.org/linux-cve-announce/ .
> 
> Their documentation [2] warns that we should expect a "seemingly large number
> of CVEs that are issued by the Linux kernel team".

Quantifying this a bit more now - Greg K-H provided some stats so far in:
https://social.kernel.org/notice/AhSCMVs4RofbnTftGS

which says:

> Year Reserved Assigned Rejected Total
> 2019:   47        2        1      50
> 2020:   37       13        0      50
> 2021:   39      304        7     350
> 2022:    7       43        0      50
> 2023:   60      180       10     250
> 2024:  107      435        8     550
> Total: 297      977       26    1300
> 
> 
> Anything older than 2023 is us back-filling in from the GSD database, and we
> still have a long way to go for there. Some 2023 ones are in there too from
> GSD, but mostly not, all of 2024 is since we took over being a CNA. 

-- 
         -Alan Coopersmith-                 alan.coopersmith@...cle.com
          Oracle Solaris Engineering - https://blogs.oracle.com/solaris

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.