mailing list archives
Re: CVE abstraction choices and the Linux kernel
From: Petr Matousek <pmatouse () redhat com>
Date: Thu, 14 Mar 2013 18:51:58 +0100
On Fri, Mar 08, 2013 at 09:57:00AM -0500, Steven M. Christey wrote:
Whatever decision MITRE makes on how to go forward, we will be
following the spirit of these well-established practices. I know
this conflicts with the open source community's need for a "universal
bug ID," and that's why I'm suggesting the creation of a separate bug
ID system, perhaps centered around a scheme such as a commit ID/hash
(which is often used already, such as in the original CVE request
that prompted this message).
Are you suggesting to create a new ID system for security bugs in
parallel with CVE that focuses on Linux kernel? As you say, such ID
system already exists -- the commit hashes. What we really need is a
(consistent) way of mapping them to CVE, which is the de-facto
standard for security vulnerabilities tracking.
Solar Designer's suggestion of per-subsystem SPLITs is an intriguing,
approximate solution to CVE's "version" problem in widely-shared code
like the Linux kernel. It seems likely that many subsystems are
introduced in different upstream kernel versions, and probably
updated in different versions. Some subsystems might be enabled or
disabled by sysadmins. By using the directory structure of the
source code tree, subsystems might be reasonably inferred on a
consistent basis. It is by no means perfect, but it should be fairly
Considering the Krause kernel info-leaks as an example, this might
suggest about 11 CVEs for crypto, xfrm_user, net (including net/tun),
ipvs, dccp, llc, l2tp, Bluetooth, atm, udf, and isofs. There might
be additional SPLITs based on bug type.
What do people think? To the distro maintainers: given that CVE
cannot support per-bug IDs for the reasons I've already described,
are per-subsystem SPLITs workable?
I'm just wondering what would happen if Mathias sent one email per issue
and possibly with some arbitrary delay. My guess is that all of the
issues would get separate CVE.
Now Mathias sent them as a batch -- should the way of informing the CNA
affect the way CVEs are assigned?
Other than the inconsistency, I think per-subsystem SPLITs for batch
submissions are workable.
Petr Matousek / Red Hat Security Response Team