linux-kernel - Re: [PATCH] Add vulnerable commits for few CVEs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2045efe8-9e32-4a38-a7a7-799cca1dca89@oracle.com>
Date: Mon, 10 Mar 2025 14:18:02 +0530
From: Harshit Mogalapalli <harshit.m.mogalapalli@...cle.com>
To: Greg KH <gregkh@...uxfoundation.org>
Cc: cve@...nel.org, andypma@...cent.com, Jesse.Zhang@....com, forst@....gy,
        adobriyan@...il.com, vegard.nossum@...cle.com,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] Add vulnerable commits for few CVEs

Hi Greg,

On 10/03/25 13:07, Greg KH wrote:
...
>> CVE-2024-46861 kernel: usbnet: ipheth: do not stop RX on failing RX callback
>>   — Fixes: a2d274c62e44 ("usbnet: ipheth: add CDC NCM support")
>> Reason: dev->rcvbulk_callback() was added in the broken commit, and the
>> CVE fix is to remove the return statement on failure.
>> Note: The CVE fix is preventing driver to stop on non-critical failures
>> -- I think this shouldn't be a CVE
> 
> It's it a denial of service if the driver does not work for normal
> issues that can be triggered?
> 

Ah yes, I agree, thanks for explaining.

...
>> Signed-off-by: Harshit Mogalapalli <harshit.m.mogalapalli@...cle.com>
> 
> Thanks for all of these, I'll go apply this now and update the database
> entries.
>

Thanks a lot!


Regards,
Harshit

> greg k-h