This is not a linux-yocto CVE yet it shows up in the reports as:
linux-yocto-custom CVE-2023-3079 0.0 8.8 Unpatched https://nvd.nist.gov/vuln/detail/CVE-2023-3079
For reference, the CPE says:
Affects cpe:2.3⭕linux:linux_kernel:-:*:*:*:*:*:*:*
So affects all Linux systems,
Running on/with cpe:2.3🅰️google:chrome:*:*:*:*:*:*:*:*
[ YOCTO #15780 ]
(From OE-Core rev: 22ef4d2d116afb9d603a05fb107dd9da0e74558b)
Signed-off-by: Randy MacLeod <Randy.MacLeod@windriver.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
In commit 8a7af09feb the CVE_STATUS was copy from the old data
for 6.6 kernel, which had backport information.
Correcting status to when the fix was introduced and adding
references to the fixes.
Fixes: 8a7af09febc28477094de0999ab6321d910811b2
Reported-by: Peter Marko <Peter.Marko@siemens.com>
(From OE-Core rev: fc3e32bc4cf79ddce0eb9fa409656de4dc0e00ea)
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Execute new script generate-cve-exclusions.py
./generate-cve-exclusions.py ~/cvelistV5/ 6.12.19 > cve-exclusion_6.12.inc
After using the database from CVEproject, some old
CVEs did not have correct metadata, therefore moving missing ones
from old cve-exclusions_6.12.inc into cve-exclusion.inc
Comparing output from cve_check before and after, two CVEs are removed:
CVE-2023-52904 and CVE-2024-38381
(From OE-Core rev: 8a7af09febc28477094de0999ab6321d910811b2)
Signed-off-by: Daniel Turull <daniel.turull@ericsson.com>
Signed-off-by: Mathieu Dubois-Briand <mathieu.dubois-briand@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Review the last of the historical kernel CVEs. Issues which are
specific to other platforms or distributions are ignored in the kernel
recipe itself, whereas general security concerns like "ICMP leaks
information" and "USB has flaws" are ignored with more details in the
extra-exclusions file as before.
(From OE-Core rev: fe1c0b9725f88d15ba48b02b5fef01f2cf2e9d78)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Do manual review and disposition these CVEs as appropriate.
(From OE-Core rev: a8db0735e228465715cf885d3b889fddfd68efc6)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
Some of the CVE_STATUS assignments are not specific to the version, so
move them to an unversioned file and include it in the recipes.
For example: some CVEs are disputed, or are specific to other
distributions.
(From OE-Core rev: d8656d9d4dfcaef6b492f5bf4cb003f16d7a3a4b)
Signed-off-by: Ross Burton <ross.burton@arm.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
