Hi all,
> but let's just fix the build for now.
Reads like it is only a build fix, does it really need a CVE ?
Thanks,
Robert
On 29.02.24 16:52, Lee Jones wrote:
> Description
> ===========
>
> In the Linux kernel, the following vulnerability has been resolved:
>
> mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters
>
> While switching to ref counters for track mtd devices use, the vmu-flash
> driver was forgotten. The reason for reading the ref counter seems
> debatable, but let's just fix the build for now.
>
> The Linux kernel CVE team has assigned CVE-2023-52496 to this issue.
>
>
> Affected and fixed versions
> ===========================
>
> Issue introduced in 6.6 with commit 19bfa9ebebb5 and fixed in 6.6.15 with commit 38c12f10990a
> Issue introduced in 6.6 with commit 19bfa9ebebb5 and fixed in 6.7.3 with commit 1168d6b79d2f
> Issue introduced in 6.6 with commit 19bfa9ebebb5 and fixed in 6.8-rc1 with commit a7d84a2e7663
>
> Please see https://www.kernel.org or a full list of currently supported
> kernel versions by the kernel community.
>
> Unaffected versions might change over time as fixes are backported to
> older supported kernel versions. The official CVE entry at
> https://cve.org/CVERecord/?id=CVE-2023-52496
> will be updated if fixes are backported, please check that for the most
> up to date information about this issue.
>
>
> Affected files
> ==============
>
> The file(s) affected by this issue are:
> drivers/mtd/maps/vmu-flash.c
>
>
> Mitigation
> ==========
>
> The Linux kernel CVE team recommends that you update to the latest
> stable kernel version for this, and many other bugfixes. Individual
> changes are never tested alone, but rather are part of a larger kernel
> release. Cherry-picking individual commits is not recommended or
> supported by the Linux kernel community at all. If however, updating to
> the latest release is impossible, the individual changes to resolve this
> issue can be found at these commits:
> https://git.kernel.org/stable/c/38c12f10990ad6e63ddef2f20c1b066e5e4d34fd
> https://git.kernel.org/stable/c/1168d6b79d2fafb41299fbc1b528e20644c562a5
> https://git.kernel.org/stable/c/a7d84a2e7663bbe12394cc771107e04668ea313a
>
--
Security Engineer, SUSE Software Solutions Germany GmbH, Frankenstraße
146, 90461 Nürnberg, Germany, GF: Ivo Totev, Andrew McDonald, Werner
Knoblich (HRB 36809, AG Nürnberg)
GPG: D29F 82AA 9FD5 9D6E 74B1 6370 089E DB3D 230A 2404
On Fri, Mar 08, 2024 at 11:26:54AM +0100, Robert Frohl wrote:
> Hi all,
>
> > but let's just fix the build for now.
>
> Reads like it is only a build fix, does it really need a CVE ?
You're a bit late:
https://lore.kernel.org/all/2024030813-subscribe-smasher-aeca@gregkh/
:)
Already revoked, thanks for the review!
greg k-h