Re: [yocto] linux-yocto CVEs in need of triage

[Randy MacLeod <randy.macleod@windriver.com>]

[-- Attachment #1: Type: text/plain, Size: 2458 bytes --]

On 2026-06-29 15:33, Paul Barker via lists.yoctoproject.org wrote:
> Hi all,
>
> We would appreciate help triaging the following CVEs filed against the
> Linux Kernel, which therefore affect linux-yocto.
>
> Each of these is missing an upstream fix version in the CVE data, so
> they show as unresolved in our CVE metrics. However, they may well be
> fixed already in the kernel versions that we ship. So we need some help
> to determine the appropriate upstream fix versions.
>
> For each CVE, at a minimum we need to know if they are resolved in the
> mainline kernel, and if so then which release they were resolved in. A
> pointer to the exact upstream commit resolving the issue would be
> preferred. This may involve a bit of investigation, so please share the
> information you find that proves that a CVE is resolved in a particular
> kernel version.
>
> Once you've investigated a particular CVE, if it is resolved upstream
> then please send a patch to update the linux-yocto cve-exclusion.inc
> file with the appropriate information. See recent commits to this file
> for examples of what we need, e.g:
>      https://git.openembedded.org/openembedded-core/commit/?id=ded28ca69b326e51ac5cf363f06c6f0931a9c1bd
>
> Once we've got patches merged into the master branch, we can look at
> backporting to wrynose & scarthgap as appropriate.
>
> The open linux-yocto CVEs lacking an upstream fix version and not
> currently tracked in cve-exclusion.inc are:
>
> - CVE-2019-14899
> - CVE-2021-3714
> - CVE-2021-3864
> - CVE-2022-0400
> - CVE-2022-1247
> - CVE-2022-4543
> - CVE-2023-3397
> - CVE-2023-3640
> - CVE-2023-4010
> - CVE-2023-6238
> - CVE-2023-6240

Venkata, who goes by Adhitya, has looked into all of these issues.

He's found one CVEs:
    CVE-2023-3640 - x86 cpu_entry_area KASLR bypass.
that we can backport via linux-stable.

He has notes on the rest of the CVEs and will reply himself shortly.

../Randy


>
> Best regards,
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#66616):https://lists.yoctoproject.org/g/yocto/message/66616
> Mute This Topic:https://lists.yoctoproject.org/mt/120036383/3616765
> Group Owner:yocto+owner@lists.yoctoproject.org
> Unsubscribe:https://lists.yoctoproject.org/g/yocto/unsub [randy.macleod@windriver.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>

-- 
# Randy MacLeod
# Wind River Linux

[-- Attachment #2: Type: text/html, Size: 3848 bytes --]