Received-SPF: pass (google.com: domain of linux-kernel+bounces-92217-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Date: Tue, 5 Mar 2024 11:08:09 +0000
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Robert Frohl <rfrohl@suse.com>
Cc: cve@kernel.org, linux-kernel@vger.kernel.org
Subject: Re: CVE-2023-52572: cifs: Fix UAF in cifs_demultiplex_thread()
Message-ID: <2024030513-unburned-eggplant-a218@gregkh>
References: <2024030256-CVE-2023-52572-2b92@gregkh>
 <ae3d431d-d93f-4fe4-99c9-7157bebaff79@suse.com>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <ae3d431d-d93f-4fe4-99c9-7157bebaff79@suse.com>

On Tue, Mar 05, 2024 at 11:38:49AM +0100, Robert Frohl wrote:
> Hi all,
> 
> this seems to be a duplicate of CVE-2023-1192 [0], even though NVD lists
> another, wrong patch. The RH bug has more details [1].
> 
> Cheers,
> Robert
> 
> 
> [0] https://nvd.nist.gov/vuln/detail/CVE-2023-1192
> [1] https://bugzilla.redhat.com/show_bug.cgi?id=2154178#c28

That's a mess.  Please have RH update the json entry with CVE with the
correct git commit id and then I'll be glad to revoke this.  The
information in NVD is not "real" from the point of view of the CVE
database, so I can't take information there as being correct, or not.
As you know, NVD is just an add-on for CVE entries, one of many created
by many different groups/governments.

Until it's fixed in the CVE database, this CVE should stand as it refers
to the correct fix that people need to know about, not the incorrect one
in the RH-assigned CVE.

thanks,

greg k-h