diff options
-rw-r--r-- | meta/conf/distro/include/cve-extra-exclusions.inc | 21 | ||||
-rw-r--r-- | meta/recipes-kernel/linux/cve-exclusion.inc | 12 |
2 files changed, 19 insertions, 14 deletions
diff --git a/meta/conf/distro/include/cve-extra-exclusions.inc b/meta/conf/distro/include/cve-extra-exclusions.inc index cfee028e5b..fcef6a14fb 100644 --- a/meta/conf/distro/include/cve-extra-exclusions.inc +++ b/meta/conf/distro/include/cve-extra-exclusions.inc | |||
@@ -53,24 +53,17 @@ CVE-2016-0689 CVE-2016-0692 CVE-2016-0694 CVE-2016-3418 CVE-2020-2981" | |||
53 | CVE_STATUS_DB[status] = "upstream-wontfix: Since Oracle relicensed bdb, the open source community is slowly but surely \ | 53 | CVE_STATUS_DB[status] = "upstream-wontfix: Since Oracle relicensed bdb, the open source community is slowly but surely \ |
54 | replacing bdb with supported and open source friendly alternatives. As a result this CVE is unlikely to ever be fixed." | 54 | replacing bdb with supported and open source friendly alternatives. As a result this CVE is unlikely to ever be fixed." |
55 | 55 | ||
56 | # | 56 | # Kernel CVEs that are generic but can't be added to the kernel's hand-maintained cve-exclusion.inc |
57 | # Kernel CVEs, e.g. linux-yocto* | 57 | # or machine-maintained cve-exclusion_VERSION.inc files, such as issues that describe TCP/IP design |
58 | # flaws or processor-specific exploits that can't be mitigated. | ||
58 | # | 59 | # |
59 | # For OE-Core our policy is to stay as close to the kernel stable releases as we can. This should | 60 | # For OE-Core our policy is to stay as close to the kernel stable releases as we can. This should |
60 | # ensure the bulk of the major kernel CVEs are fixed and we don't dive into each individual issue | 61 | # ensure the bulk of the major kernel CVEs are fixed and we don't dive into each individual issue |
61 | # as the stable maintainers are much more able to do that. | 62 | # as the stable maintainers are much more able to do that. |
62 | # | 63 | CVE_STATUS[CVE-1999-0524] = "ignored: issue is that ICMP exists, can be filewalled if required" |
63 | # We have a script (generate-cve-exclusions.py) to have correct CVE status for backported issues, | 64 | CVE_STATUS[CVE-2008-4609] = "ignored: describes design flaws in TCP" |
64 | # but the data on linuxkernelcves.com isn't 100% complete for the older CVEs. These historical | 65 | CVE_STATUS[CVE-2010-4563] = "ignored: low impact, only enables detection of hosts which are sniffing network traffic" |
65 | # CVEs need review and typically linuxkernelcves.com updated and then removed from here. | 66 | CVE_STATUS[CVE-2011-0640] = "ignored: requires physical access and any mitigation would mean USB is impractical to use" |
66 | # | ||
67 | |||
68 | CVE_STATUS_GROUPS += "CVE_STATUS_KERNEL_HISTORIC" | ||
69 | |||
70 | CVE_STATUS_KERNEL_HISTORIC = "CVE-1999-0524 CVE-1999-0656 CVE-2006-2932 CVE-2007-2764 CVE-2007-4998 \ | ||
71 | CVE-2008-2544 CVE-2008-4609 CVE-2010-0298 CVE-2010-4563 CVE-2011-0640" | ||
72 | CVE_STATUS_KERNEL_HISTORIC[status] = "ignored" | ||
73 | |||
74 | 67 | ||
75 | # qemu:qemu-native:qemu-system-native https://nvd.nist.gov/vuln/detail/CVE-2021-20255 | 68 | # qemu:qemu-native:qemu-system-native https://nvd.nist.gov/vuln/detail/CVE-2021-20255 |
76 | CVE_STATUS[CVE-2021-20255] = "upstream-wontfix: \ | 69 | CVE_STATUS[CVE-2021-20255] = "upstream-wontfix: \ |
diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index 28f9c8ff2b..7857633943 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc | |||
@@ -1,3 +1,15 @@ | |||
1 | CVE_STATUS[CVE-1999-0656] = "not-applicable-config: specific to ugidd, part of the old user-mode NFS server" | ||
2 | |||
3 | CVE_STATUS[CVE-2006-2932] = "not-applicable-platform: specific to RHEL" | ||
4 | |||
5 | CVE_STATUS[CVE-2007-2764] = "not-applicable-platform: specific to Sun/Brocade SilkWorm switches" | ||
6 | |||
7 | CVE_STATUS[CVE-2007-4998] = "cpe-incorrect: a historic cp bug, no longer an issue as per https://bugzilla.redhat.com/show_bug.cgi?id=356471#c5" | ||
8 | |||
9 | CVE_STATUS[CVE-2008-2544] = "disputed: not an issue as per https://bugzilla.redhat.com/show_bug.cgi?id=449089#c22" | ||
10 | |||
11 | CVE_STATUS[CVE-2010-0298] = "fixed-version: 2.6.34 (1871c6)" | ||
12 | |||
1 | CVE_STATUS[CVE-2014-2648] = "cpe-incorrect: not Linux" | 13 | CVE_STATUS[CVE-2014-2648] = "cpe-incorrect: not Linux" |
2 | 14 | ||
3 | CVE_STATUS[CVE-2016-0774] = "ignored: result of incomplete backport" | 15 | CVE_STATUS[CVE-2016-0774] = "ignored: result of incomplete backport" |