mbox series

[scarthgap,0/3] backport the CVE_PRODUCT fixes from master

Message ID 20260902220326.2780674-1-javier@peridio.com
Headers show
Series backport the CVE_PRODUCT fixes from master | expand

Message

Javier Tia Sept. 2, 2026, 10:03 p.m. UTC 
The four CVE_PRODUCT commits from 2026-06-10 never reached the release
branches, so cve-check on scarthgap still scans these recipes under names
that match nothing in NVD. A recipe that matches nothing reports zero
CVEs, which is indistinguishable from a recipe that was scanned and found
clean.

Three of the four apply here; the fourth is scp-firmware, whose shared
meta-arm/recipes-bsp/scp-firmware/scp-firmware.inc does not exist on
scarthgap (only the per-board meta-arm-bsp variants do), so it is sent
for wrynose only.

Measured against the NVD 2.0 API, replaying each CPE version range through
oe.cve_check.Version at the PVs that ship:

  trustedfirmware:trusted_firmware-a   7 records, none reachable today
  arm:arm-trusted-firmware             0 records
  arm:arm_trusted_firmware             0 records

For trusted-firmware-a that turns a silent zero into a real scan: TF-A
2.10 gains one genuine unpatched finding (CVE-2023-31339), while 2.12 and
2.14 gain the scan and no finding.

Note this makes affected recipes start reporting CVEs where they reported
none, which will look like a regression to anyone gating CI on a count.
That is the intended effect rather than a side effect.

Cherry-picked from master with no changes; each patch carries its
(cherry picked from commit ...) line. Found while auditing CVE_PRODUCT
coverage on an i.MX BSP built from scarthgap.

Jon Mason (3):
  arm/optee: modify CVE_PRODUCT
  arm/trusted-firmware-a: modify CVE_PRODUCT
  arm/trusted-firmware-m: add CVE_PRODUCT

 .../recipes-bsp/trusted-firmware-a/trusted-firmware-a.inc     | 3 ++-
 .../recipes-bsp/trusted-firmware-m/trusted-firmware-m.inc     | 2 ++
 meta-arm/recipes-security/optee/optee-os.inc                  | 4 +++-
 3 files changed, 7 insertions(+), 2 deletions(-)