From: Kees Cook <keescook@chromium.org>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: corbet@lwn.net, workflows@vger.kernel.org,
linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org,
security@kernel.org, Sasha Levin <sashal@kernel.org>,
Lee Jones <lee@kernel.org>
Subject: Re: [PATCH] Documentation: Document the Linux Kernel CVE process
Date: Wed, 14 Feb 2024 11:02:30 -0800 [thread overview]
Message-ID: <202402141102.FA1428F1@keescook> (raw)
In-Reply-To: <2024021446-rosy-citation-0a80@gregkh>
On Wed, Feb 14, 2024 at 08:45:19AM +0100, Greg Kroah-Hartman wrote:
> On Wed, Feb 14, 2024 at 07:43:32AM +0100, Greg Kroah-Hartman wrote:
> > On Tue, Feb 13, 2024 at 02:35:24PM -0800, Kees Cook wrote:
> > > On Tue, Feb 13, 2024 at 07:48:12PM +0100, Greg Kroah-Hartman wrote:
> > > > +No CVEs will be assigned for unfixed security issues in the Linux
> > > > +kernel, assignment will only happen after a fix is available as it can
> > > > +be properly tracked that way by the git commit id of the original fix.
> > >
> > > This seems at odds with the literal definition of what CVEs are:
> > > _vulnerability_ enumeration. This is used especially during the
> > > coordination of fixes; how is this meant to interact with embargoed
> > > vulnerability fixing?
> >
> > Yes, this is totally wrong, it was the original first draft of the
> > document, that I did on my workstation, and then went on the road for 3+
> > weeks and I never sycned up when I got home with the updated version
> > that is on my laptop. The updated version addresses this, as it was
> > rightly pointed out by the CVE group that this is not how a CNA is
> > supposed to only work.
> >
> > Yet another reason why keeping changes private is a major pain, not only
> > for security ones! :(
> >
> > Let me send out the proper one after my morning coffee has kicked in and
> > I resolve the differences, and make the grammer fixes that Randy pointed
> > out...
>
> To make it more obvious here, as others have pointed this out to me as
> well, here's the updated paragraph that will be in my v2 patch, with
> proper ';' usage:
>
> No CVEs will be automatically assigned for unfixed security issues in
> the Linux kernel; assignment will only automatically happen after a fix
> is available and applied to a stable kernel tree, and it will be tracked
> that way by the git commit id of the original fix. If anyone wishes to
> have a CVE assigned before an issue is resolved with a commit, please
> contact the kernel CVE assignment team at <cve@kernel.org> to get an
> identifier assigned from their batch of reserved identifiers.
>
> Does that help explain the process better?
Yeah, that's great. It get qualified with the "automatic" bit, which
makes this clear now. Thanks!
-Kees
--
Kees Cook
prev parent reply other threads:[~2024-02-14 19:02 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-02-13 18:48 [PATCH] Documentation: Document the Linux Kernel CVE process Greg Kroah-Hartman
2024-02-13 19:09 ` Greg Kroah-Hartman
2024-02-13 19:20 ` Jonathan Corbet
2024-02-13 19:56 ` Randy Dunlap
2024-02-14 7:15 ` Greg Kroah-Hartman
2024-02-14 16:44 ` Randy Dunlap
2024-02-13 22:35 ` Kees Cook
2024-02-14 6:43 ` Greg Kroah-Hartman
2024-02-14 7:45 ` Greg Kroah-Hartman
2024-02-14 19:02 ` Kees Cook [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202402141102.FA1428F1@keescook \
--to=keescook@chromium.org \
--cc=corbet@lwn.net \
--cc=gregkh@linuxfoundation.org \
--cc=lee@kernel.org \
--cc=linux-doc@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=sashal@kernel.org \
--cc=security@kernel.org \
--cc=workflows@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).