On Wed, 2026-08-12 at 02:28 -0500, Junjie Cao wrote: > The CVE describes an out-of-bounds read in the SMC protocol stack, but > no vulnerable code was ever identified. The MITRE record lists the > affected version as "Not Known" and references only two Red Hat > bugzillas, the originating one of which was never made public. > > The public bugzilla is closed as NOTABUG, with the statement "There was > no shipped kernel version that was seen affected by this problem": > > https://bugzilla.redhat.com/show_bug.cgi?id=2044575 > https://access.redhat.com/security/cve/CVE-2022-0400
The second sentence of the statement in the Red Hat CVE entry is "These files are not built in our source code". The "no shipped kernel version was affected" statement is specific to Red Hat's configuration, and without further info it doesn't really help anyone. Drop the reference to that statement and the second of the two links, it's misleading as it's easy to read it as a universal statement instead of a Red Hat specific statement. Keep the first link as the report being closed NOTABUG is interesting. > > SUSE reached the same conclusion independently, closing bsc#1195329 as > RESOLVED / INVALID: > > https://www.suse.com/security/cve/CVE-2022-0400.html Include a link to https://bugzilla.suse.com/show_bug.cgi?id=1195329. > > So did Debian, which marks it unimportant with the note "non issue, no > security impact": > > https://security-tracker.debian.org/tracker/CVE-2022-0400 I read "non issue..." in the context of "Vulnerable code not present". So the relevant thing is that Debian doesn't build the affected code. As above we should be careful as the way you've referenced this makes it sound like a blanket statement that there was no security impact in any configuration. It's also worth mentioning that Debian links to Red Hat bug #2040604, but that's not public. > > There is no commit in mainline referencing this CVE. The net/smc > out-of-bounds fixes that landed in v5.18 (b1871fd48efc, 0558226cebee) > are in local, privileged paths and are not linked to this CVE by any > tracker. I would drop the references to unrelated commits. > > CC: Paul Barker <[email protected]> > AI-Generated: Uses Claude (claude-opus-5) > Signed-off-by: Junjie Cao <[email protected]> > --- > v3: no functional change since v2 > > v2: > https://lore.kernel.org/openembedded-core/[email protected]/ > > meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++ > 1 file changed, 7 insertions(+) > > diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc > b/meta/recipes-kernel/linux/cve-exclusion.inc > index ba8e467..be74672 100644 > --- a/meta/recipes-kernel/linux/cve-exclusion.inc > +++ b/meta/recipes-kernel/linux/cve-exclusion.inc > @@ -214,3 +214,10 @@ KSM page deduplication, only reachable when KSM is > enabled and opted into" > # https://ubuntu.com/security/CVE-2021-3864 > CVE_STATUS[CVE-2021-3864] = "unpatched: no accepted mainline fix, \ > exploitation requires a relative kernel.core_pattern" > + > +# Never substantiated: no affected version, reproducer or commit was ever > +# identified. Closed NOTABUG by Red Hat, INVALID by SUSE (bsc#1195329) and > +# "non issue, no security impact" by Debian. > +# https://bugzilla.redhat.com/show_bug.cgi?id=2044575 > +CVE_STATUS[CVE-2022-0400] = "disputed: the reported net/smc out-of-bounds > read \ > +was never substantiated and was closed as not-a-bug by Red Hat, SUSE and > Debian" We should try to get Red Hat to release more info before we close this as disputed. Best regards, -- Paul Barker
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#243539): https://lists.openembedded.org/g/openembedded-core/message/243539 Mute This Topic: https://lists.openembedded.org/mt/120714053/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
