Conversation

Notices

1. Embed this notice
   Greg K-H (gregkh@social.kernel.org)'s status on Wednesday, 14-Feb-2024 06:11:03 JST Greg K-H
   Linux is now a CNA: http://www.kroah.com/log/blog/2024/02/13/linux-is-a-cna/
   
   This has taken a long time, I'd like to thank all the groups that helped, and especially the CVE group themselves. Our application was a bit different than other groups, but they understood that this is important for security overall.
   • Embed this notice
     Thorsten Leemhuis (acct. 1/4) (kernellogger@fosstodon.org)'s status on Wednesday, 14-Feb-2024 16:17:08 JST Thorsten Leemhuis (acct. 1/4)

     in reply to

     @gregkh

     Will also be interesting to see how many CVE will be issued it the end; it sounds like it will be a whole lot, which likely will have some interesting effects. 😬

     Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     Thorsten Leemhuis (acct. 1/4) (kernellogger@fosstodon.org)'s status on Wednesday, 14-Feb-2024 16:17:09 JST Thorsten Leemhuis (acct. 1/4)

     in reply to

     @gregkh

     Will be interesting to see how the new process[1] plays together with "participation in stable is optional for mainline developers" and the "developers almost never declare specific changes as security fixes"[2] approach I assume still holds true for mainline.

     I sounds like it could easily happen that someone fixes a security bug in mainline w/o telling anybody, so no CVE would be issued unless someone backports the change.

     [1] https://lore.kernel.org/lkml/2024021314-unwelcome-shrill-690e@gregkh/

     [2] http://kroah.com/log/blog/2018/02/05/linux-kernel-release-model/#security

   • Embed this notice
     Greg K-H (gregkh@social.kernel.org)'s status on Wednesday, 14-Feb-2024 16:17:56 JST Greg K-H

     in reply to

     • Thorsten Leemhuis (acct. 1/4)
     @kernellogger That's kind of a "if a tree falls in a forest and no one hears it, does it make a sound?" type of question, right?
     
     Yes, if no one tells us that a specific issue/bugfix/whatever should have a CVE, and it doesn't get backported to stable (which will automatically trigger the review for CVE assignment), then you are correct, nothing will be assigned as obviously, no one noticed it.
     
     So there is no sound :)
     Haelwenn /элвэн/ :triskell: likes this.