Re: [OE-core][PATCH v3 0/9] cve-exclusions: triage nine kernel CVEs lacking upstream fix data

[Junjie Cao <junjie.cao@linux.dev>]

> I have spent some time validating the status of all the issues and I
> think we're nearly there. I've suggested changes to the commit
> messages, comments and CVE_STATUS wordings, with those addressed I
> think 8/9 of these will be ready to merge.

Will send v4 with those eight using your wordings, with one deviation:
for CVE-2023-6238 the fix was backed out by the nvme maintainer rather
than withdrawn by its author, so the status reads "Proposed fix was not
merged" to match the comment above it.

> CVE-2022-0400 still bothers me. There was clearly something reported,
> there's a non-public Red Hat bugzilla entry referenced by Debian [1].
> It looks like it was closed by Red Hat, SUSE and Debian as they don't
> build the affected code, not because it was an invalid report. We
> should ask Red Hat to release more details.

Agreed - dropped from v4; with no CVE_STATUS entry it stays visible as
Unpatched in cve-check reports. I've asked on the public bug 2044575
and via secalert@redhat.com for bug 2040604 to be opened or the
affected files named, and will follow up here when Red Hat responds.

All other comments will be addressed in v4 as suggested.

Thanks a lot for your time and help.