Hi, On Wed, Mar 01, 2023 at 02:11:19PM +0000, Richard Purdie wrote: > On Mon, 2023-02-27 at 12:00 +0100, Geoffrey GIRY wrote: > > Multiple CVE are patched in kernel but appears as active because the NVD > > database is not up to date. > > > > CVE are ignored if and only if all versions of kernel used by master are > > patched. > > > > Also ignore CVEs with wrong CPE (applied to kernel but actually are for > > another package) > > > > Signed-off-by: Geoffrey GIRY <[email protected]> > > Reviewed-by: Yoann Congal <[email protected]> > > --- > > .../distro/include/cve-extra-exclusions.inc | 296 ++++++++++++++++++ > > 1 file changed, 296 insertions(+) > > FWIW, with this applied, the list reported by our tooling was reduced > to: > > https://autobuilder.yocto.io/pub/non-release/patchmetrics/cve-status-master.txt
I presume this is with 6.1.9 kernel. The data looks better but should also be compared with https://github.com/nluedtke/linux_kernel_cves/blob/master/data/6.1/6.1_security.txt which shows that: * CVE-2022-27672 was not found but would be fixed in 6.1.12 * CVE-2023-26545 was not found but would be fixed in 6.1.13 * CVE-2022-2196 was found and would be fixed in 6.1.14 For the rest, few were not found in linux_kernel_cves at all for 6.1 kernels, and a few were found with unclear status. Situation is messy overall, but that is by no means caused by the yocto side CVE tooling. The CVE database for linux kernel issues is simply not uptodate for all branches and point releases, and frankly same is true for the linux_kernel_cves data. "Update to lastest kernel.org LTS branch release" would be the way to go though... Cheers, -Mikko
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#177889): https://lists.openembedded.org/g/openembedded-core/message/177889 Mute This Topic: https://lists.openembedded.org/mt/97263529/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
