Re: [PATCH v3] Documentation: Document the Linux Kernel CVE process

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Wed, Feb 14, 2024 at 09:37:31AM +0100, Vegard Nossum wrote:
> 
> On 14/02/2024 09:00, Greg Kroah-Hartman wrote:
> > diff --git a/Documentation/process/cve.rst b/Documentation/process/cve.rst
> > new file mode 100644
> > index 000000000000..6465e6a79c18
> > --- /dev/null
> > +++ b/Documentation/process/cve.rst
> > @@ -0,0 +1,120 @@
> > +CVEs
> > +====
> 
> Document titles should have ==== above them as well, and then you would
> need to shift all the other headings in this document (i.e. all the ---
> should become ===).
> 
> Info here: https://docs.kernel.org/doc-guide/sphinx.html#specific-guidelines-for-the-kernel-documentation

Really?  I copied this directly from
Documentation/process/security-bugs.rst which is in the format that I
used here.  Which one is incorrect, I'm confused.

> > +The Linux kernel developer team does have the ability to assign CVEs for
> > +potential Linux kernel security issues.  This assignment is independent
> > +of the :doc:`normal Linux kernel security bug reporting
> > +process<../process/security_bugs>`.
> 
> These documents are both under process/ so it should be enough to say:
> 
> :doc:`[...] <security-bugs>`
> 
> In fact, when building the docs with your patch applied, I see:
> 
> Documentation/process/cve.rst:15: WARNING: unknown document:
> ./process/security_bugs
> Documentation/process/cve.rst:42: WARNING: unknown document:
> ./process/security_bugs


Odd, I would have thought that going back a directory and then into it
would work, as that's how filesystems normally are handled :)

In fact, again, security-bugs.rst has this very format, which is why I
used it, is it throwing that same warning?

> Note the hyphen vs. underscore (it should have a hyphen like my line above).

Ah, ick, nevermind, my fault, I thought I built this with it added, I'll
go fix this up and use the hyphen.

> 
> > +Process
> > +-------
> > +
> > +As part of the normal stable release process, kernel changes that are
> > +potentially security issues are identified by the developers responsible
> > +for CVE number assignments and have CVE numbers automatically assigned
> > +to them.  These assignments are published on the linux-cve-announce
> > +mailing list as announcements on a frequent basis.
> > +
> > +Note, due to the layer at which the Linux kernel is in a system, almost
> > +any bug might be exploitable to compromise the security of the kernel,
> > +but the possibility of exploitation is often not evident when the bug is
> > +fixed.  Because of this, the CVE assignment team is overly cautious and
> 
> What is the composition of the CVE assignment team, or is that secret?
> Should this be a MAINTAINERS entry? (s@k.org is one.)

Yeah, it should be a MAINTAINERS entry, I'll add that as part of the
next version of this patch.

As for the composition, it's not a "secret", but I'd prefer not to list
it individually here.  As per the signed-off-by on this patch it's Lee,
Sasha, and I for now, but I anticipate it will change over time, much
like s@k.o has.

> > +If the CVE assignment team misses a specific fix that any user feels
> > +should have a CVE assigned to it, please email them at <cve@kernel.org>
> > +and the team there will work with you on it.  Note that no potential
> > +security issues should be sent to this alias, it is ONLY for assignment
> > +of CVEs for fixes that are already in released kernel trees.  If you
> > +feel you have found an unfixed security issue, please follow the
> > +:doc:`normal Linux kernel security bug reporting
> > +process<../process/security_bugs>`.
> 
> Same

Thanks, will fix.

> > +Disputes of assigned CVEs
> > +-------------------------
> > +
> > +The authority to dispute or modify an assigned CVE for a specific kernel
> > +change lies solely with the maintainers of the relevant subsystem
> > +affected.  This principle ensures a high degree of accuracy and
> > +accountability in vulnerability reporting.  Only those individuals with
> > +deep expertise and intimate knowledge of the subsystem can effectively
> > +assess the validity and scope of a reported vulnerability and determine
> > +its appropriate CVE designation.  Any attempt to modify or dispute a CVE
> > +outside of this designated authority could lead to confusion, inaccurate
> > +reporting, and ultimately, compromised systems.
> 
> Just to clarify, I think "dispute" here is used in the
> Mitre/CVE-technical meaning of the word, correct? I assume people will
> still have the right to say "hey, this doesn't look like a real issue
> [because of X/Y/Z]" on a mailing list.

Yes, mailing list discussion is always good and encouraged and is what
is covered here as well.  There is the MITRE use of "dispute" as well,
and that too is allowed if needed, so this covers both paths.

> 
> > --- a/Documentation/process/security-bugs.rst
> > +++ b/Documentation/process/security-bugs.rst
> > @@ -99,9 +99,8 @@ CVE assignment
> >   The security team does not assign CVEs, nor do we require them for
> >   reports or fixes, as this can needlessly complicate the process and may
> >   delay the bug handling.  If a reporter wishes to have a CVE identifier
> > -assigned, they should find one by themselves, for example by contacting
> > -MITRE directly.  However under no circumstances will a patch inclusion
> > -be delayed to wait for a CVE identifier to arrive.
> > +assigned for a confirmed issue, they can contact the :doc:`kernel CVE
> > +assignment team<../process/cve>` to obtain one.
> 
> Same here, this could be just <cve>.

I'll keep it to match the other references in this file :)

many thanks for the review!

greg k-h