Received-SPF: pass (google.com: domain of linux-kernel+bounces-67417-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Date: Thu, 15 Feb 2024 18:38:05 +0100 (CET)
From: Jiri Kosina <jikos@kernel.org>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
cc: corbet@lwn.net, workflows@vger.kernel.org, linux-doc@vger.kernel.org, 
    linux-kernel@vger.kernel.org, security@kernel.org, linux@leemhuis.info, 
    Kees Cook <keescook@chromium.org>, 
    Konstantin Ryabitsev <konstantin@linuxfoundation.org>, 
    Krzysztof Kozlowski <krzk@kernel.org>, 
    Lukas Bulwahn <lukas.bulwahn@gmail.com>, Sasha Levin <sashal@kernel.org>, 
    Lee Jones <lee@kernel.org>
Subject: Re: [PATCH v4] Documentation: Document the Linux Kernel CVE
 process
In-Reply-To: <2024021500-laziness-grimace-ed80@gregkh>
Message-ID: <nycvar.YFH.7.76.2402151817440.21798@cbobk.fhfr.pm>
References: <2024021500-laziness-grimace-ed80@gregkh>
User-Agent: Alpine 2.21 (LSU 202 2017-01-01)
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII

On Thu, 15 Feb 2024, Greg Kroah-Hartman wrote:

> The Linux kernel project now has the ability to assign CVEs to fixed
> issues, so document the process and how individual developers can get a
> CVE if one is not automatically assigned for their fixes.

There is still one thing that's not clear to me with this new process, and 
that's how embargos are going to be handled.

Currently, the process is broken as well, but at least understood by 
everybody.

- issues are reported to security@kernel.org. No CVE assigned, 7days 
  embargo, then fix gets pushed out

- at some point (in parallel, before, or after the above), the issue gets 
  reported to linux-distros@. CVE gets assigned, and downstreams start 
  integrating the fix (once available) to their codebase.

- embargo is lifted, fixes are released with proper CVE reference

How is the new process going to look like? Please keep in mind that 
linux-stable is (by far!) *not* the only downstream of Linux Kernel 
project.

We've had this discussion in other contexts already, but I whole-heartedly 
believe that it's in no way in the Linux Kernel project's interest to kill 
those other downstreams (read: Linux distros) (*) ... or is it?

(*) just looking at how much those not-basing-on-stable distros are 
    contributing to mainline

Thanks,

-- 
Jiri Kosina
SUSE Labs