[2/2] cve-extra-exclusion: ignore disputed CVE-2023-23005

Message ID	20230406141923.419980-2-yoann.congal@smile.fr
State	Accepted, archived
Commit	39274240b7756f498507b229d5f3461c207f1823
Headers	show Return-Path: <yoann.congal@smile.fr> ip: 209.85.128.48, mailfrom: yoann.congal@smile.fr) From: Yoann Congal <yoann.congal@smile.fr> To: openembedded-core@lists.openembedded.org Cc: Yoann Congal <yoann.congal@smile.fr>, Frank WOLFF <frank.wolff@smile.fr> Subject: [PATCH 2/2] cve-extra-exclusion: ignore disputed CVE-2023-23005 Date: Thu, 6 Apr 2023 16:19:23 +0200 Message-Id: <20230406141923.419980-2-yoann.congal@smile.fr> In-Reply-To: <20230406141923.419980-1-yoann.congal@smile.fr> References: <20230406141923.419980-1-yoann.congal@smile.fr> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit
Series	[1/2] cve-exclusions_6.1: ignore patched CVE-2022-38457 & CVE-2022-40133 \| expand [1/2] cve-exclusions_6.1: ignore patched CVE-2022-38457 & CVE-2022-40133 [2/2] cve-extra-exclusion: ignore disputed CVE-2023-23005

Message ID

20230406141923.419980-2-yoann.congal@smile.fr

State

Accepted, archived

Commit

39274240b7756f498507b229d5f3461c207f1823

Headers

From: Yoann Congal <yoann.congal@smile.fr>
To: openembedded-core@lists.openembedded.org
Cc: Yoann Congal <yoann.congal@smile.fr>,
	Frank WOLFF <frank.wolff@smile.fr>
Subject: [PATCH 2/2] cve-extra-exclusion: ignore disputed CVE-2023-23005
Date: Thu,  6 Apr 2023 16:19:23 +0200
Message-Id: <20230406141923.419980-2-yoann.congal@smile.fr>
In-Reply-To: <20230406141923.419980-1-yoann.congal@smile.fr>
References: <20230406141923.419980-1-yoann.congal@smile.fr>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Series

[1/2] cve-exclusions_6.1: ignore patched CVE-2022-38457 & CVE-2022-40133 | expand

Commit Message

Yoann Congal April 6, 2023, 2:19 p.m. UTC

Signed-off-by: Yoann Congal <yoann.congal@smile.fr>
Reviewed-by: Frank WOLFF <frank.wolff@smile.fr>
---
 meta/conf/distro/include/cve-extra-exclusions.inc | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/meta/conf/distro/include/cve-extra-exclusions.inc b/meta/conf/distro/include/cve-extra-exclusions.inc
index 0b89598501..439d569f7d 100644
--- a/meta/conf/distro/include/cve-extra-exclusions.inc
+++ b/meta/conf/distro/include/cve-extra-exclusions.inc
@@ -485,6 +485,16 @@  CVE_CHECK_IGNORE += "CVE-2023-1281"
 # Backported in version v6.1.13 747ca7c8a0c7bce004709143d1cd6596b79b1deb
 CVE_CHECK_IGNORE += "CVE-2023-1513"
 
+# https://nvd.nist.gov/vuln/detail/CVE-2023-23005
+# Introduced in version v6.1 7b88bda3761b95856cf97822efe8281c8100067b
+# Patched in kernel since v6.2 4a625ceee8a0ab0273534cb6b432ce6b331db5ee
+# But, the CVE is disputed:
+# > NOTE: this is disputed by third parties because there are no realistic cases
+# > in which a user can cause the alloc_memory_type error case to be reached.
+# See: https://bugzilla.suse.com/show_bug.cgi?id=1208844#c2
+# We can safely ignore it.
+CVE_CHECK_IGNORE += "CVE-2023-23005"
+
 # https://nvd.nist.gov/vuln/detail/CVE-2023-28466
 # Introduced in version v4.13 3c4d7559159bfe1e3b94df3a657b2cda3a34e218
 # Patched in kernel since v6.3-rc2 49c47cc21b5b7a3d8deb18fc57b0aa2ab1286962