8 ms·
13 CVEs so far this year afaik
by raggi 2y ago
13 CVEs so far this year afaik
- bonzini 2y agoCVE numbers from the Linux CNA are bollocks.
- JoshTriplett 2y agoThis conversation would be a good one to point them to to show that their policy is not just harmless point-proving, but in fact does cause harm. For context, to the best of my knowledge the current approach of the Linux CNA is, in keeping with long-standing Linux security policy of "every single fix might be a security fix", to assign CVEs regardless of whether something has any security impact or not.
- di4na 2y agoI would not call it harm. The use of uring in higher level languages is definitely prone to errors, bugs and security problems
- JoshTriplett 2y agoSee the context I added to that comment; this is not about security issues, it's about the Linux CNA's absurd approach to CVE assignment for things that aren't CVEs.
- tialaramex 2y agoI don't agree that it's absurd. I would say it reflects a proper understanding of their situation. You've doubtless heard Tony Hoare's "There are two ways to write code: write code so simple there are obviously no bugs in it, or write code so complex that there are no obvious bugs in it.". Linux is definitely in the latter category, it's now such a sprawling system that determining whether a bug "really" has security implications is no long a reasonable task compared to just fixing the bug. The other reason is that Linux is so widely used that almost no assumption made to simplify that above task is definitely correct.
- JoshTriplett 2y agoThat's fine, except that it is thus no longer meaningful to compare CVE count.
- hifromwork 2y agoI like CVEs, I think Linux approach to CVEs is stupid, but also it was never meaningful to compare CVE count. But I guess it's hard to make people stop doing that, and that's the reason Linux does the thing it does out of spite.
- kuschku 2y agoCVE assignment != security issue CVE numbers are just a way to ensure everyone is talking about the same bug. Not every security issue has a CVE, not every CVE is a security issue. Often, a regular bug turns out years later to have been a security issue, or a security issue turns out to have no security impact at all. If you want a central authority to tell you what to think, just use CVSS instead of the binary "does it have a CVE" metric.
- skywhopper 2y agoThat’s definitely not the understanding that literally anyone outside the Linux team has for what a CVE is, including the people who came up with them and run the database. Overloading a well-established mechanism of communicating security issues to just be a registry of Linux bugs is an abuse of an important shared resource. Sure “anything could be a security issue” but in practice, most bugs aren’t, and putting meaningless bugs into the international security issue database is just a waste of everyone’s time and energy to make a very stupid point.
- kuschku 2y ago> including the people who came up with them How do you figure that? The original definition of CVE is exactly the same as how Linux approaches it. Sure, in recent years security consultants have been overloading CVE to mean something else, but that's something to fix, not to keep.
- deleted 2y ago[deleted]
- immibis 2y agoAs I understand it, they adopted this policy because the other policy was also causing harm. They are right, by the way. When CVEs were used for things like Heartbleed they made sense - you could point to Heartbleed's CVE number and query various information systems about vulnerable systems. When every single possible security fix gets one, AND automated systems are checking the you've patched every single one or else you fail the audit (even ones completely irrelevant to the system, like RCE on an embedded device with no internet access) the system is not doing anything useful - it's deleting value from the world and must be repaired or destroyed.
- hifromwork 2y agoThe problem here are the automated systems and braindead auditors, not the CVE system itself.
- immibis 2y agoWell, the CVE system itself is only about assigning identifiers, and assigning identifiers unnecessarily couldn't possibly hurt anyone, who isn't misusing the system, unless they're running out of identifiers.
- raggi 2y agothis is a bit of a distraction, sure the leaks and some of the deadlocks are fairly uninteresting, but the toctou, overflows, uid race/confusion and so on are real issues that shouldn't be dismissed as if they don't exist.