| Message ID | 20250723104923.1204089-1-Deepesh.Varatharajan@windriver.com |
|---|---|
| State | New |
| Headers | show |
| Series | rust: set CVE_STATUS for CVE-2025-5791 | expand |
On Wed, 2025-07-23 at 03:49 -0700, Varatharajan, Deepesh via lists.openembedded.org wrote: > From: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> > > As per NVD, this CVE only affects users crate > https://nvd.nist.gov/vuln/detail/CVE-2025-5791 > > The CVE-2025-5791 affects the users crate, which is not used > in Poky build. Instead, we rely on the sysinfo crate, which > provides similar functionality. As confirmed in Red Hat Bugzilla > https://bugzilla.redhat.com/show_bug.cgi?id=2370001#c0 > > The upstream Rust also does not depend on the vulnerable crate > instead they also dependent on sysinfo crate. Therefore, > this CVE is not applicable to our poky sources. > > Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> > --- > meta/recipes-devtools/rust/rust-source.inc | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/meta/recipes-devtools/rust/rust-source.inc b/meta/recipes-devtools/rust/rust-source.inc > index ed15d9c763..7e100b73d9 100644 > --- a/meta/recipes-devtools/rust/rust-source.inc > +++ b/meta/recipes-devtools/rust/rust-source.inc > @@ -20,3 +20,4 @@ UPSTREAM_CHECK_REGEX = "rustc-(?P<pver>\d+(\.\d+)+)-src" > > CVE_STATUS[CVE-2024-24576] = "not-applicable-platform: Issue only applies on Windows" > CVE_STATUS[CVE-2024-43402] = "not-applicable-platform: Issue only applies on Windows" > +CVE_STATUS[CVE-2025-5791] = "not-applicable: Issue affects only users crate (We are not using users crate instead we use sysinfo crate)" > This threw a lot of warnings on the autobuilder, e.g.: https://autobuilder.yoctoproject.org/valkyrie/#/builders/43/builds/2098 Cheers, Richard
> -----Original Message----- > From: openembedded-core@lists.openembedded.org <openembedded- > core@lists.openembedded.org> On Behalf Of Richard Purdie via > lists.openembedded.org > Sent: Wednesday, July 23, 2025 17:35 > To: deepesh.varatharajan@windriver.com; openembedded- > core@lists.openembedded.org > Cc: Sundeep.Kokkonda@windriver.com > Subject: Re: [OE-core] [PATCH] rust: set CVE_STATUS for CVE-2025-5791 > > On Wed, 2025-07-23 at 03:49 -0700, Varatharajan, Deepesh via > lists.openembedded.org wrote: > > From: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> > > > > As per NVD, this CVE only affects users crate > > https://nvd.nist.gov/vuln/detail/CVE-2025-5791 > > > > The CVE-2025-5791 affects the users crate, which is not used > > in Poky build. Instead, we rely on the sysinfo crate, which > > provides similar functionality. As confirmed in Red Hat Bugzilla > > https://bugzilla.redhat.com/show_bug.cgi?id=2370001#c0 > > > > The upstream Rust also does not depend on the vulnerable crate > > instead they also dependent on sysinfo crate. Therefore, > > this CVE is not applicable to our poky sources. > > > > Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> > > --- > > meta/recipes-devtools/rust/rust-source.inc | 1 + > > 1 file changed, 1 insertion(+) > > > > diff --git a/meta/recipes-devtools/rust/rust-source.inc b/meta/recipes- > devtools/rust/rust-source.inc > > index ed15d9c763..7e100b73d9 100644 > > --- a/meta/recipes-devtools/rust/rust-source.inc > > +++ b/meta/recipes-devtools/rust/rust-source.inc > > @@ -20,3 +20,4 @@ UPSTREAM_CHECK_REGEX = "rustc- > (?P<pver>\d+(\.\d+)+)-src" > > > > CVE_STATUS[CVE-2024-24576] = "not-applicable-platform: Issue only applies > on Windows" > > CVE_STATUS[CVE-2024-43402] = "not-applicable-platform: Issue only applies > on Windows" > > +CVE_STATUS[CVE-2025-5791] = "not-applicable: Issue affects only users > crate (We are not using users crate instead we use sysinfo crate)" > > > > > This threw a lot of warnings on the autobuilder, e.g.: > > https://autobuilder.yoctoproject.org/valkyrie/#/builders/43/builds/2098 Correct would probably be "cpe-incorrect" for this case. However since cpes for this CVE do not include rust, this would also be wrong. https://github.com/CVEProject/cvelistV5/blob/main/cves/2025/5xxx/CVE-2025-5791.json So setting CVE_STATUS for this CVE does not make sense. Peter > > Cheers, > > Richard
On 23-07-2025 21:27, Marko, Peter wrote: > CAUTION: This email comes from a non Wind River email account! > Do not click links or open attachments unless you recognize the sender and know the content is safe. > >> -----Original Message----- >> From: openembedded-core@lists.openembedded.org <openembedded- >> core@lists.openembedded.org> On Behalf Of Richard Purdie via >> lists.openembedded.org >> Sent: Wednesday, July 23, 2025 17:35 >> To: deepesh.varatharajan@windriver.com; openembedded- >> core@lists.openembedded.org >> Cc: Sundeep.Kokkonda@windriver.com >> Subject: Re: [OE-core] [PATCH] rust: set CVE_STATUS for CVE-2025-5791 >> >> On Wed, 2025-07-23 at 03:49 -0700, Varatharajan, Deepesh via >> lists.openembedded.org wrote: >>> From: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> >>> >>> As per NVD, this CVE only affects users crate >>> https://nvd.nist.gov/vuln/detail/CVE-2025-5791 >>> >>> The CVE-2025-5791 affects the users crate, which is not used >>> in Poky build. Instead, we rely on the sysinfo crate, which >>> provides similar functionality. As confirmed in Red Hat Bugzilla >>> https://bugzilla.redhat.com/show_bug.cgi?id=2370001#c0 >>> >>> The upstream Rust also does not depend on the vulnerable crate >>> instead they also dependent on sysinfo crate. Therefore, >>> this CVE is not applicable to our poky sources. >>> >>> Signed-off-by: Deepesh Varatharajan <Deepesh.Varatharajan@windriver.com> >>> --- >>> meta/recipes-devtools/rust/rust-source.inc | 1 + >>> 1 file changed, 1 insertion(+) >>> >>> diff --git a/meta/recipes-devtools/rust/rust-source.inc b/meta/recipes- >> devtools/rust/rust-source.inc >>> index ed15d9c763..7e100b73d9 100644 >>> --- a/meta/recipes-devtools/rust/rust-source.inc >>> +++ b/meta/recipes-devtools/rust/rust-source.inc >>> @@ -20,3 +20,4 @@ UPSTREAM_CHECK_REGEX = "rustc- >> (?P<pver>\d+(\.\d+)+)-src" >>> CVE_STATUS[CVE-2024-24576] = "not-applicable-platform: Issue only applies >> on Windows" >>> CVE_STATUS[CVE-2024-43402] = "not-applicable-platform: Issue only applies >> on Windows" >>> +CVE_STATUS[CVE-2025-5791] = "not-applicable: Issue affects only users >> crate (We are not using users crate instead we use sysinfo crate)" >> >> This threw a lot of warnings on the autobuilder, e.g.: >> >> https://autobuilder.yoctoproject.org/valkyrie/#/builders/43/builds/2098 > Correct would probably be "cpe-incorrect" for this case. > However since cpes for this CVE do not include rust, this would also be wrong. > https://github.com/CVEProject/cvelistV5/blob/main/cves/2025/5xxx/CVE-2025-5791.json > So setting CVE_STATUS for this CVE does not make sense. > > Peter Sure Peter, thanks for the feedback . Will ignore this CVE. Regards, Deepesh >> Cheers, >> >> Richard
diff --git a/meta/recipes-devtools/rust/rust-source.inc b/meta/recipes-devtools/rust/rust-source.inc index ed15d9c763..7e100b73d9 100644 --- a/meta/recipes-devtools/rust/rust-source.inc +++ b/meta/recipes-devtools/rust/rust-source.inc @@ -20,3 +20,4 @@ UPSTREAM_CHECK_REGEX = "rustc-(?P<pver>\d+(\.\d+)+)-src" CVE_STATUS[CVE-2024-24576] = "not-applicable-platform: Issue only applies on Windows" CVE_STATUS[CVE-2024-43402] = "not-applicable-platform: Issue only applies on Windows" +CVE_STATUS[CVE-2025-5791] = "not-applicable: Issue affects only users crate (We are not using users crate instead we use sysinfo crate)"