Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
MIME-Version: 1.0
References: <20210823140844.q3kx6ruedho7jen5@pali> <18c5a8be-66d7-0dd8-b158-0931335f7ac5@candelatech.com>
In-Reply-To: <18c5a8be-66d7-0dd8-b158-0931335f7ac5@candelatech.com>
From:   Julian Calaby <julian.calaby@gmail.com>
Date:   Tue, 24 Aug 2021 00:54:18 +1000
Message-ID: <CAGRGNgUMioB8NRrJQjFYRPdEt4OzF50kU6_CJ4nDvqsuq+U6nw@mail.gmail.com>
Subject: Re: Drivers for Qualcomm wifi chips (ath*k) and security issues
To:     Ben Greear <greearb@candelatech.com>
Cc:     =?UTF-8?Q?Pali_Roh=C3=A1r?= <pali@kernel.org>,
        Sasha Levin <sashal@kernel.org>,
        Greg KH <gregkh@linuxfoundation.org>, stable@vger.kernel.org,
        linux-wireless <linux-wireless@vger.kernel.org>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

Hi Ben,

On Tue, Aug 24, 2021 at 12:37 AM Ben Greear <greearb@candelatech.com> wrote=
:
>
> On 8/23/21 7:08 AM, Pali Roh=C3=A1r wrote:
> > Hello Sasha and Greg!
> >
> > Last week I sent request for backporting ath9k wifi fixes for security
> > issue CVE-2020-3702 into stable LTS kernels because Qualcomm/maintainer=
s
> > did not it for more months... details are in email:
> > https://lore.kernel.org/stable/20210818084859.vcs4vs3yd6zetmyt@pali/t/#=
u
>
> For one thing, almost everyone using these radios is using openwrt or
> similar which has its own patch sets.

For reference, according to Debian's own security tracker, only
CVE-2020-26139 is patched on all but the most ancient tracked release:

https://security-tracker.debian.org/tracker/CVE-2020-26139 (fixed in
all but the most ancient release)
https://security-tracker.debian.org/tracker/CVE-2020-3702 (all tracked
kernels are vulnerable)
https://security-tracker.debian.org/tracker/CVE-2020-26145 (only
testing/unstable is fixed)
https://security-tracker.debian.org/tracker/CVE-2020-26141 (only
testing/unstable is fixed)

Debian Buster has a 4.19 kernel and they only released Bullseye, it's
successor, a couple of weeks ago, so there's probably a
not-insignificant number of PCs out there still running kernels that
old, and I understand that they'll be supporting Buster with security
fixes for approximately another year:
https://www.debian.org/security/faq#lifespan

Thanks,

--=20
Julian Calaby

Email: julian.calaby@gmail.com
Profile: http://www.google.com/profiles/julian.calaby/