On Mon, Jul 15, 2024 at 08:04:21PM +0200, Mickaël Salaün wrote: > Yes, that's why we use WARN_ON_ONCE() to check cases that should never > happen (at the time of writting), but in practice it's useful to check > (with fuzzing) that this assertion is true. However, if a > WARN_ON_ONCE() is reached, this doesn't mean that this is a security > issue, but just an unexpected case that kernel maintainers should be > notified with to fix it.
I leave CVE determinations to the CNA. :) I think the difficulty here is with having no way to trivially see which WARN is security sensitive and which isn't, and since WARNs may panic, all WARNs could be a DoS, and therefore may be a CVE for some deployment somewhere. -- Kees Cook
