[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    Re: [oss-security] CVEs issued by the Linux kernel CNA
From:       eduardo vela <evn () googlers ! com>
Date:       2024-02-24 8:22:29
Message-ID: CAFswPa8A2EeST20UtGzVDFo+bVh5QVYCKO+W861PvQTonkZKKw () mail ! gmail ! com
[Download RAW message or body]


On Fri, 23 Feb 2024, 06:40 Greg KH, <greg@kroah.com> wrote:

> On Thu, Feb 22, 2024 at 09:05:42PM +0100, Solar Designer wrote:
> > Speaking of which, we allow for CVEs to be requested via linux-distros,
> > to be assigned by one of the CNAs in there.  The current Linux kernel
> > CVE documentation is very strict about rejecting such third-party
> > assignments if they're "for an actively supported kernel":
>
> That's the rules from CVE themselves, it's not unique to the kernel
> here.  You will run into this more as more open source projects take
> over the CVE process for their codebases.  curl and python are two
> examples of which linux-distros are not allowed to do this for either.
>
> > "Any CVE that is assigned against the Linux kernel for an actively
> > supported kernel version, by any group other than the kernel assignment
> > CVE team should not be treated as a valid CVE. Please notify the kernel
> > CVE assignment team at <cve@kernel.org> so that they can work to
> > invalidate such entries through the CNA remediation process."
> >
> > So I guess we should now exclude upstream actively supported kernels
> > from this offer/practice.
>
> Yes, that is a requirement that all CNAs must now follow.
>
> > Distro CNAs can still assign CVEs for issues limited to
> > downstream/distro kernels and for issues in upstream kernels that are
> > not currently supported upstream.
>
> Yes.
>
> > I guess they can also assign
> > CVEs against downstream/distro kernels even if the code is the same as
> > in an upstream actively supported kernel, but the threat model is
> > different (e.g., untrusted filesystem images are brought into the threat
> > model in a distro).  Sounds right?
>
> That is probably NOT ok as per the CVE rules, sorry.


This would likely result in MITRE (the root) just asking the conflicting
CNAs to decide who will issue the CVE.

RedHat and Google are root CNAs, so it likely would be resolved on the
roots meeting.

All CNAs should know how to handle this, otherwise they wouldn't be
> allowed to be a CNA.  Whomever was acting as a CNA for linux-distros
> knows these rules, please discuss this with them if you have specific
> questions.
>
> thanks,
>
> greg k-h
>


[prev in list] [next in list] [prev in thread] [next in thread]