Thread

Several vulnerabilities have been discovered in the Linux kernel

576 points · 408 comments · luispa

john_strinlai · 1790902914 · focus · HN ↗
note that _any_ bugfix is assigned a cve, which makes for big numbers.
>“Due to the layer at which the Linux kernel is in a system, almost any bug might be exploitable to compromise the security of the kernel… Because of this, the CVE assignment team is overly cautious and assign CVE numbers to any bugfix that they identify.”
<a href="https://docs.kernel.org/process/cve.html" rel="nofollow">https://docs.kernel.org/process/cve.html
"number of cves" is a useless metric, especially when it comes to the kernel.
1. mbreese · 1790907391 · focus · HN ↗
  > note that _any_ bugfix is assigned a cve
  I do find it interesting though, that in the interest of transparency, every bugfix gets a CVE. Which ends up being a huge number… which will ultimately yield a more insecure environment as we’re getting conditioned to ignore/discount CVEs by the volume.
  Over-reporting in this case seems to risk being counterproductive.
  1. Gigachad · 1790907992 · focus · HN ↗
    Depends on the end consumers stance on security. I've watched it shift from "Only update if we can prove we are impacted" to "Update everything immediately just in case".
    The frequency and severity of cyber attacks has increased to the point a much more cautious approach has become common. It's also easier to sell this work to management when you can point at the security tab on some tool and say "Look we need to patch these CVEs"
    cesarb · 1790967785 · focus · HN ↗
    > I've watched it shift from "Only update if we can prove we are impacted" to "Update everything immediately just in case".
    > [...] a much more cautious approach has become common.
    I'd argue that this is a less cautious approach, not more. It takes time to carefully evaluate, review, and test each change.

Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.