Re: [PATCH 2/2] Documentation: security-bugs.rst: clarify CVE handling

[Greg Kroah-Hartman]

On Fri, Jun 30, 2023 at 11:18:37AM -0700, Kees Cook wrote:
> On Fri, Jun 30, 2023 at 09:14:21AM +0200, Greg Kroah-Hartman wrote:
> > The kernel security team does NOT assign CVEs, so document that properly
> > and provide the "if you want one, ask MITRE for it" response that we
> > give on a weekly basis in the document, so we don't have to constantly
> > say it to everyone who asks.
> > 
> > Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
> > ---
> >  Documentation/process/security-bugs.rst | 11 ++++-------
> >  1 file changed, 4 insertions(+), 7 deletions(-)
> > 
> > diff --git a/Documentation/process/security-bugs.rst b/Documentation/process/security-bugs.rst
> > index f12ac2316ce7..8b80e1eb7d79 100644
> > --- a/Documentation/process/security-bugs.rst
> > +++ b/Documentation/process/security-bugs.rst
> > @@ -79,13 +79,10 @@ not contribute to actually fixing any potential security problems.
> >  CVE assignment
> >  --------------
> >  
> > -The security team does not normally assign CVEs, nor do we require them
> > -for reports or fixes, as this can needlessly complicate the process and
> > -may delay the bug handling. If a reporter wishes to have a CVE identifier
> > -assigned ahead of public disclosure, they will need to contact the private
> > -linux-distros list, described above. When such a CVE identifier is known
> > -before a patch is provided, it is desirable to mention it in the commit
> > -message if the reporter agrees.
> > +The security team does not assign CVEs, nor do we require them for
> > +reports or fixes, as this can needlessly complicate the process and may
> > +delay the bug handling.  If a reporter wishes to have a CVE identifier
> > +assigned, they should contact MITRE directly.
> 
> Hmm. The language about "assigned ahead of public disclosure" was added
> intentionally due to trouble we'd had with coordination when a CVE was
> needed, etc. Additionally, it IS preferred to have a CVE in a patch when
> it IS known ahead of time, so I think that should be kept. How about
> this:
> 
> 
> diff --git a/Documentation/process/security-bugs.rst b/Documentation/process/security-bugs.rst
> index 82e29837d589..2f4060d49b31 100644
> --- a/Documentation/process/security-bugs.rst
> +++ b/Documentation/process/security-bugs.rst
> @@ -81,13 +81,12 @@ the email Subject line with "[vs]" as described in the linux-distros wiki:
>  CVE assignment
>  --------------
>  
> -The security team does not normally assign CVEs, nor do we require them
> -for reports or fixes, as this can needlessly complicate the process and
> -may delay the bug handling. If a reporter wishes to have a CVE identifier
> -assigned ahead of public disclosure, they will need to contact the private
> -linux-distros list, described above. When such a CVE identifier is known
> -before a patch is provided, it is desirable to mention it in the commit
> -message if the reporter agrees.
> +The security team does not assign CVEs, nor do we require them for reports
> +or fixes, as this can needlessly complicate the process and may delay
> +the bug handling. If a reporter wishes to have a CVE identifier assigned
> +ahead of public disclosure, they will need to contact MITRE directly.
> +When such a CVE identifier is known before a patch is provided, it is
> +desirable to mention it in the commit message if the reporter agrees.

I can not, in good faith, with the current mess that MITRE is going
through, tell anyone that they should contact MITRE ahead of public
disclosure, sorry.

All I can say is "if you really want one, go ask them for one", as
everyone keeps asking us for one to pad their resume/CV.

Also note that many non-US-based companies are not allowed to contact a
US-government-backed entity for potential security issues for obvious
reasons.

So I don't want to even give a hint that we support or request this at
all, or that it is something that changelog texts should contain for
security issues (for the obvious reason of them being a "hint" one way
or another.)

External groups may wish to play the CVE "game" as it facilitates their
engineering procedures to get changes past managers, but that's not
anything that we should be encouraging at all for all of the various
geopolitical and corporate reasons involved in that mess.

thanks,

greg k-h