Thread

1. john_strinlai · 1790902914 · focus · HN ↗

   note that _any_ bugfix is assigned a cve, which makes for big numbers.

   >“Due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel… Because of this, the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify.”

   <a href="https:&#x2F;&#x2F;docs.kernel.org&#x2F;process&#x2F;cve.html" rel="nofollow">https:&#x2F;&#x2F;docs.kernel.org&#x2F;process&#x2F;cve.html

   &quot;number of cves&quot; is a useless metric, especially when it comes to the kernel.

   1. mbreese · 1790907391 · focus · HN ↗

      &gt; note that _any_ bugfix is assigned a cve

      I do find it interesting though, that in the interest of transparency, every bugfix gets a CVE. Which ends up being a huge number… which will ultimately yield a more insecure environment as we’re getting conditioned to ignore&#x2F;discount CVEs by the volume.

      Over-reporting in this case seems to risk being counterproductive.

      1. someonebaggy · 1790912826 · focus · HN ↗

         They chose to do it this way, in. part, because CVEs were already like that, and too many people were pretending they weren&#x27;t.

Unofficial Hacker News client; not affiliated with Y Combinator.