Thread

Several vulnerabilities have been discovered in the Linux kernel

576 points · 408 comments · luispa

john_strinlai · 1790902914 · focus · HN ↗
note that _any_ bugfix is assigned a cve, which makes for big numbers.
>“Due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel… Because of this, the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify.”
<a href="https://docs.kernel.org/process/cve.html" rel="nofollow">https://docs.kernel.org/process/cve.html
"number of cves" is a useless metric, especially when it comes to the kernel.
1. SAI_Peregrinus · 1790903533 · focus · HN ↗
  Tautologically every bug can legitimately be assigned a CVE, since every bug prevents some feature from working as intended. It's therefore a denial of service, which by the definition of the CVE system using CVSS means every bug is at least a 1/Low level vulnerability to CVSS v4.0.
  If you're willing to stretch, missing but planned features also deny the use of said features since they haven't been added yet, and so are CVSS 1/Low vulnerabilities.
  Resume-driven development for security researchers has never been easier!
  1. viraptor · 1790906802 · focus · HN ↗
    > It's therefore a denial of service
    That doesn't follow. In the extremely simple example, an adding service returning 1+1=3 has a bug, but it's not a possible DoS situation at all.
    > missing but planned features also deny the use of said features
    That's not what DoS is.
    This whole situation with CVE assigning comes from the whole process being far from ideal. But it doesn't mean it's completely useless and doesn't follow any rules at all.
    goodmythical · 1790949188 · focus · HN ↗
    >hash of supplied password does not match hash of stored password, access denied
    Resulting from miscalc of either stored or supplied would indeed create DoS.
    If the off by one is in a graphical driver that causes an overflow leading to no output, that's DoS.
    If the off by one is in the memory mapping of input devices leading to no available input, that's DoS.
    Simple math is kind of everywhere in the kernel and userland apps. If the math is wrong and results in memory mapping wrong such that kernel panics or is unuseable, that's a breaking bug regardless of simplicity.
    viraptor · 1791019080 · focus · HN ↗
    <a href="https://news.ycombinator.com/item?id=49929389">https://news.ycombinator.com/item?id=49929389
    I'm using specific words and it's been explained and linked twice already. Come on!

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.