linux-kernel - Re: [PATCH 6.6 00/28] fix CVE-2024-46701

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9e9e54cdd4905b58470f674aefcfd4dabca4108d.camel@HansenPartnership.com>
Date: Wed, 06 Nov 2024 11:21:45 -0500
From: James Bottomley <James.Bottomley@...senPartnership.com>
To: Chuck Lever III <chuck.lever@...cle.com>, Yu Kuai
 <yukuai1@...weicloud.com>
Cc: Greg KH <gregkh@...uxfoundation.org>, linux-stable
 <stable@...r.kernel.org>,  "harry.wentland@....com"
 <harry.wentland@....com>, "sunpeng.li@....com" <sunpeng.li@....com>, 
 "Rodrigo.Siqueira@....com" <Rodrigo.Siqueira@....com>,
 "alexander.deucher@....com" <alexander.deucher@....com>,
 "christian.koenig@....com" <christian.koenig@....com>, "Xinhui.Pan@....com"
 <Xinhui.Pan@....com>,  "airlied@...il.com" <airlied@...il.com>, Daniel
 Vetter <daniel@...ll.ch>, Al Viro <viro@...iv.linux.org.uk>, Christian
 Brauner <brauner@...nel.org>, Liam Howlett <liam.howlett@...cle.com>,
 Andrew Morton <akpm@...ux-foundation.org>, Hugh Dickins <hughd@...gle.com>,
 "Matthew Wilcox (Oracle)" <willy@...radead.org>, Sasha Levin
 <sashal@...nel.org>, "srinivasan.shanmugam@....com"
 <srinivasan.shanmugam@....com>, "chiahsuan.chung@....com"
 <chiahsuan.chung@....com>, "mingo@...nel.org" <mingo@...nel.org>, 
 "mgorman@...hsingularity.net" <mgorman@...hsingularity.net>,
 "yukuai3@...wei.com" <yukuai3@...wei.com>,  "chengming.zhou@...ux.dev"
 <chengming.zhou@...ux.dev>, "zhangpeng.00@...edance.com"
 <zhangpeng.00@...edance.com>, "amd-gfx@...ts.freedesktop.org"
 <amd-gfx@...ts.freedesktop.org>, "dri-devel@...ts.freedesktop.org"
 <dri-devel@...ts.freedesktop.org>, Linux Kernel Mailing List
 <linux-kernel@...r.kernel.org>, Linux FS Devel
 <linux-fsdevel@...r.kernel.org>,  "maple-tree@...ts.infradead.org"
 <maple-tree@...ts.infradead.org>, linux-mm <linux-mm@...ck.org>, 
 "yi.zhang@...wei.com" <yi.zhang@...wei.com>, yangerkun
 <yangerkun@...wei.com>
Subject: Re: [PATCH 6.6 00/28] fix CVE-2024-46701

On Wed, 2024-11-06 at 15:19 +0000, Chuck Lever III wrote:
> This is the first I've heard of this CVE. It
> would help if the patch authors got some
> notification when these are filed.

Greg did it; it came from the kernel CNA:

https://www.cve.org/CVERecord?id=CVE-2024-46701

The way it seems to work is that this is simply a wrapper for the
upstream commit:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=64a7ce76fb901bf9f9c36cf5d681328fc0fd4b5a

Which is what appears as the last stable reference.  I assume someone
investigated and added the vulnerable kernel details.  I think the
theory is that since you reviewed the original upstream patch, stable
just takes care of the backports and CVE management of the existing fix
through the normal stable process.

James