linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* Re: CVE-2023-52496: mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters
       [not found] <20240229155245.1571576-37-lee@kernel.org>
@ 2024-03-08 10:08 ` Michal Hocko
  2024-03-08 10:27   ` Greg KH
  2024-03-08 10:26 ` Robert Frohl
  1 sibling, 1 reply; 4+ messages in thread
From: Michal Hocko @ 2024-03-08 10:08 UTC (permalink / raw)
  To: cve, linux-kernel; +Cc: Lee Jones

On Thu 29-02-24 15:52:56, Lee Jones wrote:
> Description
> ===========
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters
> 
> While switching to ref counters for track mtd devices use, the vmu-flash
> driver was forgotten. The reason for reading the ref counter seems
> debatable, but let's just fix the build for now.

Do we really consider build fixes as CVE? 
-- 
Michal Hocko
SUSE Labs

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: CVE-2023-52496: mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters
       [not found] <20240229155245.1571576-37-lee@kernel.org>
  2024-03-08 10:08 ` CVE-2023-52496: mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters Michal Hocko
@ 2024-03-08 10:26 ` Robert Frohl
  2024-03-08 16:02   ` Greg KH
  1 sibling, 1 reply; 4+ messages in thread
From: Robert Frohl @ 2024-03-08 10:26 UTC (permalink / raw)
  To: cve, linux-kernel, linux-cve-announce; +Cc: Lee Jones


[-- Attachment #1.1.1: Type: text/plain, Size: 2552 bytes --]

Hi all,

 > but let's just fix the build for now.

Reads like it is only a build fix, does it really need a CVE ?

Thanks,
Robert

On 29.02.24 16:52, Lee Jones wrote:
> Description
> ===========
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters
> 
> While switching to ref counters for track mtd devices use, the vmu-flash
> driver was forgotten. The reason for reading the ref counter seems
> debatable, but let's just fix the build for now.
> 
> The Linux kernel CVE team has assigned CVE-2023-52496 to this issue.
> 
> 
> Affected and fixed versions
> ===========================
> 
> 	Issue introduced in 6.6 with commit 19bfa9ebebb5 and fixed in 6.6.15 with commit 38c12f10990a
> 	Issue introduced in 6.6 with commit 19bfa9ebebb5 and fixed in 6.7.3 with commit 1168d6b79d2f
> 	Issue introduced in 6.6 with commit 19bfa9ebebb5 and fixed in 6.8-rc1 with commit a7d84a2e7663
> 
> Please see https://www.kernel.org or a full list of currently supported
> kernel versions by the kernel community.
> 
> Unaffected versions might change over time as fixes are backported to
> older supported kernel versions.  The official CVE entry at
> 	https://cve.org/CVERecord/?id=CVE-2023-52496
> will be updated if fixes are backported, please check that for the most
> up to date information about this issue.
> 
> 
> Affected files
> ==============
> 
> The file(s) affected by this issue are:
> 	drivers/mtd/maps/vmu-flash.c
> 
> 
> Mitigation
> ==========
> 
> The Linux kernel CVE team recommends that you update to the latest
> stable kernel version for this, and many other bugfixes.  Individual
> changes are never tested alone, but rather are part of a larger kernel
> release.  Cherry-picking individual commits is not recommended or
> supported by the Linux kernel community at all.  If however, updating to
> the latest release is impossible, the individual changes to resolve this
> issue can be found at these commits:
> 	https://git.kernel.org/stable/c/38c12f10990ad6e63ddef2f20c1b066e5e4d34fd
> 	https://git.kernel.org/stable/c/1168d6b79d2fafb41299fbc1b528e20644c562a5
> 	https://git.kernel.org/stable/c/a7d84a2e7663bbe12394cc771107e04668ea313a
> 

-- 
Security Engineer, SUSE Software Solutions Germany GmbH, Frankenstraße 
146, 90461 Nürnberg, Germany, GF: Ivo Totev, Andrew McDonald, Werner 
Knoblich (HRB 36809, AG Nürnberg)
GPG: D29F 82AA 9FD5 9D6E 74B1  6370 089E DB3D 230A 2404

[-- Attachment #1.1.2: OpenPGP public key --]
[-- Type: application/pgp-keys, Size: 12035 bytes --]

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 840 bytes --]

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: CVE-2023-52496: mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters
  2024-03-08 10:08 ` CVE-2023-52496: mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters Michal Hocko
@ 2024-03-08 10:27   ` Greg KH
  0 siblings, 0 replies; 4+ messages in thread
From: Greg KH @ 2024-03-08 10:27 UTC (permalink / raw)
  To: Michal Hocko; +Cc: cve, linux-kernel, Lee Jones

On Fri, Mar 08, 2024 at 11:08:51AM +0100, Michal Hocko wrote:
> On Thu 29-02-24 15:52:56, Lee Jones wrote:
> > Description
> > ===========
> > 
> > In the Linux kernel, the following vulnerability has been resolved:
> > 
> > mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters
> > 
> > While switching to ref counters for track mtd devices use, the vmu-flash
> > driver was forgotten. The reason for reading the ref counter seems
> > debatable, but let's just fix the build for now.
> 
> Do we really consider build fixes as CVE? 

Nope, good catch!  We reviewed this one wrong, now revoked, thanks for
the review.

greg k-h

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: CVE-2023-52496: mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters
  2024-03-08 10:26 ` Robert Frohl
@ 2024-03-08 16:02   ` Greg KH
  0 siblings, 0 replies; 4+ messages in thread
From: Greg KH @ 2024-03-08 16:02 UTC (permalink / raw)
  To: Robert Frohl; +Cc: cve, linux-kernel, linux-cve-announce, Lee Jones

On Fri, Mar 08, 2024 at 11:26:54AM +0100, Robert Frohl wrote:
> Hi all,
> 
> > but let's just fix the build for now.
> 
> Reads like it is only a build fix, does it really need a CVE ?

You're a bit late:
	https://lore.kernel.org/all/2024030813-subscribe-smasher-aeca@gregkh/
:)

Already revoked, thanks for the review!

greg k-h

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, other threads:[~2024-03-08 16:02 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
     [not found] <20240229155245.1571576-37-lee@kernel.org>
2024-03-08 10:08 ` CVE-2023-52496: mtd: maps: vmu-flash: Fix the (mtd core) switch to ref counters Michal Hocko
2024-03-08 10:27   ` Greg KH
2024-03-08 10:26 ` Robert Frohl
2024-03-08 16:02   ` Greg KH

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).