Received-SPF: pass (google.com: domain of linux-kernel+bounces-86894-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Date: Thu, 29 Feb 2024 07:08:06 -0800
From: Kees Cook <kees@kernel.org>
To: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
 Michal Hocko <mhocko@suse.com>
CC: Kees Cook <keescook@chromium.org>, cve@kernel.org,
 linux-kernel@vger.kernel.org
Subject: =?US-ASCII?Q?Re=3A_CVE-2023-52451=3A_powerpc/pseries/mem?= =?US-ASCII?Q?hp=3A_Fix_access_beyond_end_of_drmem_array?=
User-Agent: K-9 Mail for Android
In-Reply-To: <2024022913-borrower-resource-ecc9@gregkh>
References: <2024022257-CVE-2023-52451-7bdb@gregkh> <Zdylmz28rZ-mCeiN@tiehlicka> <2024022639-wronged-grafted-6777@gregkh> <ZdytVTOgfvKBBvtn@tiehlicka> <202402271029.FD67395@keescook> <Zd8hPpP_6q_o8uQW@tiehlicka> <202402280906.D6D5590DB@keescook> <ZeA-281OudkWBhd_@tiehlicka> <2024022915-dissuade-grandson-ebd4@gregkh> <ZeBRZqJd5HAKaOfC@tiehlicka> <2024022913-borrower-resource-ecc9@gregkh>
Message-ID: <D06F40E5-0DBC-4FF2-BAF5-2373BDF3815C@kernel.org>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain;
 charset=utf-8
Content-Transfer-Encoding: quoted-printable


On February 29, 2024 6:18:36 AM PST, Greg Kroah-Hartman <gregkh@linuxfound=
ation=2Eorg> wrote:
>As part of the requirement to be a CNA, we have to announce everything
>that we think is a potential vulnerability, severity not be judged at
> [=2E=2E=2E]
>Again, none of this has anything to do with "severity", it only is an
>identifier that says "this fixes a vulnerability"=2E

The language here can perhaps be improved for better understanding by folk=
s since "CVE" and "vulnerability" can mean different things to different pe=
ople=2E I would say "this fixes a weakness"=2E

CVEs are for anything deemed a "weakness"[1]=2E It doesn't need to rise to=
 the level of what many people would consider a "vulnerability"=2E (Modern =
attacks traditionally chain many weaknesses together to form an exploit, so=
me of which look harmless when examined in isolation=2E)

I find it helps to keep in mind the "CIA" acronym of what makes up a secur=
ity weakness: "negative impact to Confidentiality, Integrity, or Availabili=
ty"=2E (Not to be confused with the US Gov intelligence org with the name a=
cronym, ironically=2E)

-Kees

[1] https://nvd=2Enist=2Egov/vuln

--=20
Kees Cook