Yes, fixed bug. So all current and LTS kernels which are still maintained will drown in CVEs with every release, and the easy fix for an overworked engineer at some downstream is to deliberately ship with a kernel that's just out of maintenance.
@bboreham it says how to get additional ones, but the language is clear:
> Because of this, the CVE assignment team is overly cautious and
> +assign CVE numbers to any bugfix that they identify
> [...]
> assignment will only automatically happen after a fix
> +is available and applied to a stable kernel tree, and it will be tracked
> +that way by the git commit id of the original fix.
@RichiH you seem to be reading “any bugfix that they identify” as “every bugfix”, while Greg is saying that CVEs will be assigned for bugfixes that relate to security.
@bboreham I am not seeing that reading, as it's clearly stated "almost any bug might be exploitable to compromise the security of the kernel" and thus "the CVE assignment team is overly cautious and assign[s] CVE numbers to any bugfix that they identify"
The LKML thread walks back on this, but the fact that there's a thread seems proof that several people read it similarly to how I read it
The passive aggressive phrasing of the policy does not bode well, either
The rest of the industry is moving to "unless you have a PoC in hand, it's not an exploit" for very good reasons. Anyone maintaining any open source project knows the pain of random people running scanners without skill or understanding and demanding free labor. Or the bug bounty beggars. And yes, NVD is a clown show.
But flooding everything with shit is not the answer.
@RichiH On the other hand, maybe this will finally break the thin thread of awfulness that is the NVD and leave room for a more reasonable replacement?
Hard to think of what that’d be like, but maybe the notion of reporting every bug and having some sort of extension per ecosystem that’d let you validate whether your implementation is possibly vulnerable where that’s possible. Something that’d allow static analysis to be made with higher quality 🤔
All of this reminds me of the infamous talk Linus gave at Google, presenting this new thing called Git.. "SHA1 might not be considered secure any more, but I can use it as it's not security relevant <20 minutes later> and if I lose my computer I can simply copy my kernel repository from anywhere and just compare the commit id in HEAD and trust that everything is correct"
With people as smart as the core kernel folks are, it's hard to find a good faith interpretation.
Add comment