Received-SPF: pass (google.com: domain of oss-security-return-30107-linux.lists.archive=gmail.com@lists.openwall.com designates 193.110.157.125 as permitted sender) client-ip=193.110.157.125;
Mailing-List: contact oss-security-help@lists.openwall.com; run by ezmlm
Precedence: bulk
Reply-To: oss-security@lists.openwall.com
Message-ID: <2661c15d-52d3-41b7-a725-cc66c2094ba4@oracle.com>
Date: Wed, 1 May 2024 13:27:06 -0700
User-Agent: Mozilla Thunderbird
From: Alan Coopersmith <alan.coopersmith@oracle.com>
To: oss-security@lists.openwall.com
References: <7e78b8d8-860c-47f5-bbec-a967c277d539@oracle.com>
Content-Language: en-US
Autocrypt: addr=alan.coopersmith@oracle.com; keydata=
 xsDiBEab+moRBACDH5yKqS3wcc5bdxY7PBNuwKvF5TKMfagmSvuRDtZjjIIWaA/nZ1KboV9G
 q5g7kP7+Kfu+Qgd8u65eVsWwmPW10fXvj3aCU53glx2EdGdrHcgiyH2gEQfPiyBw+trIppWF
 RV0IDXSLMA1FNC92t2nSG/VFHaPTVwcgkIRSfcXDvwCglGdEa6f4uLqoNHP+m4yYnzapFuMD
 /R4+2AJDAvEWKDdYCGZzlawjAmmWyXrmT7/C/mx98qUR473l4buXjHgDkkXXlHqdzil1vK85
 PhrKzNJDCCmlHUJNz+QwiAMOLwpD+kwVPb57RG7y+a5JQ5+jtVw4RlUxZIk/wj2An9YBO3A5
 vR7PdjM32ZJCN2+aM4dYfNzQxQKTA/47icvBaBVTl9rztjg2pd2Aqpc1P/GsIYLGj7XjnnJv
 GAENBHSH1QjpZMJGCTS9oJ+B0/wrIr+pA+MdFgYAb6ojMQJOO6UChjWWSGjMFcs/CeXhxlLB
 ido3DtAETbNTwO6OEfAvdosvTdhJFnwvZlJ+zZGGy5CrF2Fd9PUe9tmASc0uQWxhbiBDb29w
 ZXJzbWl0aCA8YWxhbi5jb29wZXJzbWl0aEBvcmFjbGUuY29tPsKCBBMRCgBCAhsDBgsJCAcD
 AgYVCAIJCgsEFgIDAQIeAQIXgAIZARYhBEoZPAbTXnxnD6TvC6L7nggfLRMOBQJkQs2eBQkn
 DNS0AAoJEKL7nggfLRMO1esAnR4FVD60BpDY/bJp5RC1VXhOVlo4AKCJgsQeVeGLxDlMuhAm
 bcCkOjafqc7BTQRGm/pvEAgAmnlpSWGjmtSGlLqKTuymwBAU9G7Jw8ow27QngXS/86g/PTzm
 yhXzK0uPgeoIaTZlqaHWNKCWJnC6T2btXtaDHH6cElrClYNf94os5sSt8PBDh184W+NtctAy
 Y2dA1pQYhYs8/eXwa4E4cyrrQG75M+CHrbu9Se0vlERARCpNcjNYLpTXRCwNuUvAi905VJ0Y
 XnGX83WbJfNIq+uxnBa2gVzwb2/2FwKOG03Wyb1vs6NznWJle9x61y8/LlEDoBRbfIQTFp51
 R0ue8gX2yMVgh8lYVViHYCBq+cat7p8X41Xa/fN/HfBFPsf3/+bhggNgmaBmDJBxxd6BPB8Y
 EireiwADBgf/UWIxQwwRLkiXPacOoh34MJYQIBTrCC8gVFxetlbEPEH5mueZMJegAPTF52l8
 6REenxdNVz/0xT7BD6VlHHY5DowlbRca4W8eb3gpkX/wfNYDYCHtTifT7ewumTrNZx5mrbNk
 0XTJVOPAP3z7E0rVD2w/xo4p22DzIwfeGKwpHqt1b6Z9fmrRDwaiXaFmwUf+rIiGc/OFcOSe
 46HwTmIyTOt6NVdQSf75jOPbdeM/n1I5svOdWTLEj6QEj2q9UQ98UEPJuMdaotyBFwKlcDOO
 LMSL793fWINrYSskdXhHjaht5wWqI+egO2JfciI/vP1+bEzhpY9llGq+r7WG3nCSf8JJBBgR
 AgAJBQJGm/pvAhsMAAoJEKL7nggfLRMOgugAoIdhGnD9d/IS6fDVgv+4xnOXvyohAJ0VVxc1
 uoPzepWFbgvLuHIMvyjRog==
In-Reply-To: <7e78b8d8-860c-47f5-bbec-a967c277d539@oracle.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?utf-8?B?RVZWUUlvWFR0VHNqaTRnZXJVSkhRZDRKcjJDTEw5R2RQaFl2cDArOU1HSTEr?=
 =?utf-8?B?di80c0IydE4zOEM5ajY1WjFBdVpmM254aDJxcXZGMStWcWswdTIwWTNsellF?=
 =?utf-8?B?dXZHaTVvclpTRGFTRDF4YjhJemx5ZUQyUXFkcUNtRmYrSVpsQTRYc2tKVUlW?=
 =?utf-8?B?RUZMcmV6eXpPSVh3RnhzY0ZOUGd4dUxacTJxWjE5NFNyakQ5N2dGbTdJL0Ev?=
 =?utf-8?B?RU8wNCtZWHNHUTBaT1ZhbjBQOGloa2NTaFRObDBDb1o5TjBaUityejh4eUtk?=
 =?utf-8?B?eXNYVHpXZEp4OUF2SmFUL1Fid1JaK2paM2pKeEUwV3l6NVpjRHUwYURnQ2VG?=
 =?utf-8?B?T1FDTnB4RVNZNThlUVE2SkIrMmwyVjdWdldFT1NCRzRDd1dzMWlrOVIzOFBY?=
 =?utf-8?B?YzRLQXpQRnRwQU5UTXdRQUNtVEw1dGhvOEkwQTgrTlZIM0ZNY1ozbzMwMHdX?=
 =?utf-8?B?bkFyYmhDZDdtVFp5MnNtL1Y0a2Q1RS9Qd0poaUcvQm5RZkduNW1ybnJJZDRD?=
 =?utf-8?B?MnlIbDlPS2VuNlRyc0FubXg0NUc2K1QzOCt2UVVHNERMeUcvNnVJMXVRakJN?=
 =?utf-8?B?a3F6eDhLVEhJaVRWbTJKbURBL1NKOHZKeGNSK045ajAycEpzTG1vaUFWNXdM?=
 =?utf-8?B?blJFNXRGZXpWdnNXakU3TWpnMDRFbGUvZXJQUHNaUWNWZFMrS09LZTRoZjhB?=
 =?utf-8?B?TDkrZUFYcG9CSFlIMEtKTGJSZXdtMVpuekRJcTdzem8za0VuVnNOaURxZkVK?=
 =?utf-8?B?VkV3S2dWRHJ0OXJkaFdOY01rckwyaGcyaUVFVHlNWEEyb09zOFBXb1NPTXFm?=
 =?utf-8?B?QmpIRGNkcGhVaDhQS3pBUFR0UVhnWVRVNFBVdHJnVVlCZGlKNFJvZGFJNm5D?=
 =?utf-8?B?N25uVVIrK1pDSDJLVitXVEdCTXJHblNFK2h4OW1rMjVmOTRLUGkwTnlxWFVK?=
 =?utf-8?B?WVdCejkvc1pTdlMreWFZSmRTdnU1ZkIrcHovQjdQY1pvellYOTE5aVhJMXRQ?=
 =?utf-8?B?R2ppajRXcUJFbFlSOXVrK1hEdit6QzRhZzA5ZnZOU3ZRb0JycllGRkQ0Z1ZB?=
 =?utf-8?B?bmJDaWJueSsxNHFlL1dvMnNNUnhqWUZCT2xXdnFRY1BIT3JHM1NXQmI0SVNj?=
 =?utf-8?B?L0ZPOU9YKzRGRmdDS3kvSGRHRzRBVjlFVUZxZDZ0cDBzNlJKR29BNVdRWEpK?=
 =?utf-8?B?QytQdFlES0drc21YdUEyMG5lam5SS2ZtaFBaamRHREZFbGdza3JsT3lKSlFs?=
 =?utf-8?B?M2JDalFhYWY1TWNXekFXK0JzdFUxTmppNHBLWjFYMEFVK3Y0M0FHMnQ1Mk9j?=
 =?utf-8?B?WTRTRXcxTTYreXlLSlhyQ0NSU0J2U1NnRGNVdU9tVno1UU8vY1ZBVmEyUWxh?=
 =?utf-8?B?cmxIalpKYmF6SjVid1hsOFhFY2hiamhadzB0c1plTU5lYWRXRFg2VWJYRXlJ?=
 =?utf-8?B?aEJPeXNLeTZDclRhYlY1b1V6bzBUZUVRdjVNMCtralI2RUhwTkMzaThtOU5N?=
 =?utf-8?B?VWg1aXNibnlURCtvN2VSWmtwN0lwT3JVREF0V3M3Q240NWp1OUdJSWxob21y?=
 =?utf-8?B?UWhSNllLMFJHdnpzaFE4Mlp5Y25kT2NSK0EvMzRSNUxwdENmWXNmd3l4a2dY?=
 =?utf-8?B?MEc3cFdOU1QrVkdmRzlGMzdqSHcyMDJkSHdoSTRmMFR6NE42QmlxKzNxalZU?=
 =?utf-8?B?MHRjVFoxcVBhT0NuYk1nMDdibTVWeTZnYVRrSEkzc0QxZFNJeDVXQllITTVG?=
 =?utf-8?B?Y01RVVg3QXoxS3F3cnl3S2tqMFM5ZE5UNGVXSUswK0ZWYXkxZGhPNUJmb0xw?=
 =?utf-8?B?SmxZSytNZmZ0VnFlNkkzaUtQaTZON0RWNk1JOVp6cE9FK0dKejF4Z2tSTStY?=
 =?utf-8?B?WDVsMnNzc1VudGhSbmhvb3k3VmtkT0x0eVR2TXhaOFRoSDdNQnFyTjFVcGxV?=
 =?utf-8?B?b2Rnc1RvaWtyL0FZL1hoSFJKM3RiN0FqQWtEQzJTbjg0a3lIaWh1RUFQL2Nl?=
 =?utf-8?B?VUtWM1lUZjN4WXYrbm4vWlUzTlhBNWROM0NJTW5VOUtlcVQzeExrNmFheFpU?=
 =?utf-8?B?QURJcW5neHRieTI3YVdPd2d3NzBrNDE4L2VXRjNuSFViVGtDODkrRGNxUmd4?=
 =?utf-8?B?dTdLUUgzMGo4alJ0TktSempKZEpWaUh1amlEZUtCRzE5OE4vZWlBVGlXWE1R?=
 =?utf-8?B?RVE9PQ==?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	81xnVhTnEsYvxSWs63El2Kr2oa7iZwiS23tcrgARWGKVA/y73twB5iAUYXwNyv0bIJ7gnk6CKZFXvh2joxd4X9WOvX/GbYloKR6ovjix1vwa8SgTDX2L9Z5HZvs6SmIVnfhpLe03gyS/BUU4icf+x+wpKXM34jUu36oUiuumb9kxuFG1jM8HeuPpnfnbzntbqtKOb/sT9TpJMhITF3AX+u6ycQldTXrOL/yrgD2B3YDimmrKXjL+Gbu/iRx/C7BWuoGmDrcxeferjTS6blgSqDBZtRTq4wJzPfLZm/8TCD8SurL42gPeIO65kXQZMIm35uf6t7IleiJy8KjpAj6XhwyWSeNN4t+WKgckB643wSglQ4DFhNnqHw8Hu0a21PYBpLFaJVk9rvKeN/coXX2zhOrRv2+/Uzl2KaUwJrHNagOTJGNsTjgtJZkjdz65K+qNirj1Q3X1J62fwCIlIooOFDzCJDs3+xYvdbj93PrtqgMGzz/loYSU1HdtAsWgd+NyjdiGNXU4AArwzOstUSuSiex+FRsIlKuDEEFlvAvPXDt+FGxVrs9Ur5adI4/8sU/jzOnWQSWFyJTS2dl98mFHvVIH5G7ZjnbAxM9DOYNPmPI=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 5a9b9015-89fa-4e51-6431-08dc6a1d1447
X-MS-Exchange-CrossTenant-AuthSource: DS7PR10MB5005.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 01 May 2024 20:27:10.8050
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: HJb5G/GCowkB1hzPsfeob2rcVFBXbGg/MIiM28xULCja88zEICcs/ECuP4Fm/al4vyXOi7MtNFwqC8+MjBLhp/zbSMKDOlYAidAQ6KXz0/E=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: MN2PR10MB4255
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.293,Aquarius:18.0.1011,Hydra:6.0.650,FMLib:17.11.176.26
 definitions=2024-05-01_16,2024-04-30_01,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxscore=0 phishscore=0 bulkscore=0
 suspectscore=0 malwarescore=0 spamscore=0 adultscore=0 mlxlogscore=999
 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.12.0-2404010000
 definitions=main-2405010144
X-Proofpoint-GUID: uG09vnphOTOfPnkRTY-2W2tt2kyY1cl_
X-Proofpoint-ORIG-GUID: uG09vnphOTOfPnkRTY-2W2tt2kyY1cl_
Subject: [oss-security] Re: CVEs issued by the Linux kernel CNA

On 2/20/24 15:30, Alan Coopersmith wrote:
> As recently announced [1], kernel.org is now a CNA for the Linux kernel, and
> today issued its first 8 CVEs, as seen in the archives of their mailing list
> at https://lore.kernel.org/linux-cve-announce/ .
> 
> Their documentation [2] warns that we should expect a "seemingly large number
> of CVEs that are issued by the Linux kernel team".

Quantifying this a bit more now - Greg K-H provided some stats so far in:
https://social.kernel.org/notice/AhSCMVs4RofbnTftGS

which says:

> Year Reserved Assigned Rejected Total
> 2019:   47        2        1      50
> 2020:   37       13        0      50
> 2021:   39      304        7     350
> 2022:    7       43        0      50
> 2023:   60      180       10     250
> 2024:  107      435        8     550
> Total: 297      977       26    1300
> 
> 
> Anything older than 2023 is us back-filling in from the GSD database, and we
> still have a long way to go for there. Some 2023 ones are in there too from
> GSD, but mostly not, all of 2024 is since we took over being a CNA. 

-- 
         -Alan Coopersmith-                 alan.coopersmith@oracle.com
          Oracle Solaris Engineering - https://blogs.oracle.com/solaris