Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-09-20 15:03:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

Documentation: security-bugs.rst: clarify CVE handling

Browse Source 
The kernel security team does NOT assign CVEs, so document that properly
and provide the "if you want one, ask MITRE for it" response that we
give on a weekly basis in the document, so we don't have to constantly
say it to everyone who asks.

Link: https://lore.kernel.org/r/2023063022-retouch-kerosene-7e4a@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Greg Kroah-Hartman 2023-06-30 09:14:21 +02:00
parent 4fee0915e6
commit 3c1897ae4b
1 changed files with 6 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
Documentation/process/security-bugs.rst
View File

@ -79,13 +79,12 @@ not contribute to actually fixing any potential security problems.
CVE assignment CVE assignment
-------------- --------------
The security team does not normally assign CVEs, nor do we require them The security team does not assign CVEs, nor do we require them for
for reports or fixes, as this can needlessly complicate the process and reports or fixes, as this can needlessly complicate the process and may
may delay the bug handling. If a reporter wishes to have a CVE identifier delay the bug handling. If a reporter wishes to have a CVE identifier
assigned ahead of public disclosure, they will need to contact the private assigned, they should find one by themselves, for example by contacting
linux-distros list, described above. When such a CVE identifier is known MITRE directly. However under no circumstances will a patch inclusion
before a patch is provided, it is desirable to mention it in the commit be delayed to wait for a CVE identifier to arrive.
message if the reporter agrees.
Non-disclosure agreements Non-disclosure agreements
------------------------- -------------------------