Re: Linux kernel CVEs not mentioned on oss-security

[Greg KH <greg () kroah com>]

On Thu, Sep 28, 2017 at 05:37:21PM -0400, Brad Spengler wrote:
> > > CVE-2017-0605:
> > > --------------
> > > https://security-tracker.debian.org/tracker/CVE-2017-0605
> > > upstream: (4.12-rc1) [e09e28671cda63e6308b31798b997639120e2a21]
> > >
> > > is e.g. includedin 3.16.44 (a1141b19b23a0605d46f3fab63fd2d76207096c4),
> > > 3.2.89 (e39e64193a8a611d11d4c62579a7246c1af70d1c) but not in 4.9.
> > >
> > > (afaics not Cc'ed to stable).
> >
> > Ouch, thanks for letting me know, that's not good, we don't want to get
> > the trees out of sync for obvious reasons.
>
> The above CVE shouldn't exist; the patch doesn't fix any vulnerability
> as the upstream commit message itself notes, and didn't need to be
> backported to any of the kernels it was backported to.  Not only that, the
> above advisory marked it as a remote vulnerability with critical severity.
> It looks like Debian and Ubuntu released updated kernels, while Red Hat and
> SuSE marked it as WONTFIX and unaffected, respectively.  I am not sure why
> neither simply rejected the CVE.

Yeah, this one keeps trying to get re-introduced as a "fix", when it
really isn't (see the archives of the stable@vger mailing list for
details.

I don't know how you can "reject" a CVE, is there a proceedure
somewhere?  There's lots of CVEs out there that people create against
the kernel that just aren't issues at all, but I've been ignoring them
as it makes people happy to assign and track them for no reason.

Is there some way a project can get them rejected?

thanks,

greg k-h