Re: CVE-2023-52656: io_uring: drop any code related to SCM_RIGHTS

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Fri, May 24, 2024 at 10:57:07AM -0600, Jens Axboe wrote:
> On 5/24/24 10:45 AM, Gabriel Krisman Bertazi wrote:
> > Greg Kroah-Hartman <gregkh@linuxfoundation.org> writes:
> > 
> >> Description
> >> ===========
> >>
> >> In the Linux kernel, the following vulnerability has been resolved:
> >>
> >> io_uring: drop any code related to SCM_RIGHTS
> >>
> >> This is dead code after we dropped support for passing io_uring fds
> >> over SCM_RIGHTS, get rid of it.
> >>
> >> The Linux kernel CVE team has assigned CVE-2023-52656 to this issue.
> > 
> > Hello Greg,
> > 
> > [+Jens in Cc]
> > 
> > This is stable material, but doesn't deserve CVE status.  There is
> > nothing exploitable that is fixed here. Instead, this commit is dropping
> > unreachable code after the removal of a feature, following another CVE
> > report.  Doing the clean up in the original patch would have made the
> > real security fix harder to review.
> > 
> > The real issue was reported as CVE-2023-52654 and handled by a different
> > commit.
> 
> FWIW, the same is true for a number of other commits recently. They are
> nowhere near CVE material, it's just generic bug fixes.

Ok, glad to revoke them if you do not think they are user triggerable
issues.  I'll go reject this one right now, thanks.

greg k-h