linux/poky.git/meta/conf/distro/include/cve-extra-exclusions.inc, branch nanbield

cve-exclusion: review the last of the historical kernel CVEs

2023-09-07T13:42:37+00:00

Review the last of the historical kernel CVEs. Issues which are specific to other platforms or distributions are ignored in the kernel recipe itself, whereas general security concerns like "ICMP leaks information" and "USB has flaws" are ignored with more details in the extra-exclusions file as before. (From OE-Core rev: fe1c0b9725f88d15ba48b02b5fef01f2cf2e9d78) Signed-off-by: Ross Burton Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

linux: review some historic CVE_STATUS

2023-09-06T16:52:45+00:00

Do manual review and disposition these CVEs as appropriate. (From OE-Core rev: a8db0735e228465715cf885d3b889fddfd68efc6) Signed-off-by: Ross Burton Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

cve-extra-exclusions: remove BlueZ issues

2023-09-05T07:09:13+00:00

These BlueZ issues were mislabelled as Linux issues, but now that the CPE data is accurate this ignore can be removed. (From OE-Core rev: 7f354aed364b17259a642cc97e30a0a2b8218134) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cve-extra-exclusions: remove historic kernel CVEs which are handled now

2023-09-05T07:09:13+00:00

The bulk of the historic kernel CVEs in this file are now handled by the include files generated by linux/generate-cve-exclusions.py, so remove them. Those that remain date from 2017 or earlier, so rename the group to 'historic' and update the comment. (From OE-Core rev: b46930641b9b5b38997b41ba8036e99387ed4225) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cve-extra-exclusions: fix syntax error

2023-07-25T14:27:33+00:00

CVE_STATUS conversion for CVE-2020-18974 dad a syntax error by not adding continuation backslash. (From OE-Core rev: 64d2f868485c32b459df80c5aafdff14cce70f26) Signed-off-by: Peter Marko Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

cve_check: convert CVE_CHECK_IGNORE to CVE_STATUS

2023-07-21T10:52:26+00:00

- Try to add convert and apply statuses for old CVEs - Drop some obsolete ignores, while they are not relevant for current version (From OE-Core rev: 1634ed4048cf56788cd5c2c1bdc979b70afcdcd7) Signed-off-by: Andrej Valek Reviewed-by: Peter Marko Signed-off-by: Alexandre Belloni Signed-off-by: Richard Purdie

linux-yocto/cve-exclusion: move entries from cve-extra-exclusions

2023-07-10T10:36:34+00:00

We've a slew of CVE_CHECK_IGNOREs in cve-extra-exclusions which are to mark a CVE as not valid with the current default kernel. However, this file is kernel agnostic so if someone decides to build a 6.0 kernel then these ignores are no longer valid. Move the ignores which are to simply reflect backports to cve-exclusions_6.1.inc so that they're version-specific. As the kernel is upgraded these exclusions should be made redundant and removed from the file. (From OE-Core rev: 157f7b62e271df5dfd8a3bc4d3821bf806fde51e) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cve-extra-exclusions: CVE-2023-3141 was backported in Linux 6.1.30

2023-06-20T22:24:26+00:00

(From OE-Core rev: 845e5fa021f5e5addeee4f4f7a035dcc62742cf1) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cve-extra-exclusions: call out an Ubuntu-specific issue explicitly

2023-06-20T22:24:26+00:00

(From OE-Core rev: 8e8157926f3b20f3308db0a951a94f58e7ede1f5) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie

cve-extra-exclusions: remove 2019 blanket ignores

2023-06-13T21:16:31+00:00

Remove the blanket ignore and handle the CVEs individually. CVE-2019-14899 is related to network interface configuration across multiple operating systems, so leave this as unresolved. -3016, -3819 and -3887 are pending CPE updates, so ignore them. The others have accurate CPE information now so are handled correctly. (From OE-Core rev: e46bd62a278ec0bb9da995cab9350f1c363131d1) Signed-off-by: Ross Burton Signed-off-by: Richard Purdie