diff mbox series

[scarthgap] improve_kernel_cve_report: fix crash on entries without detail

Message ID 20260901-fix-kernel-cve-scarthgap-v1-1-405f5d7a8957@baylibre.com
State New
Headers show
Series [scarthgap] improve_kernel_cve_report: fix crash on entries without detail | expand

Commit Message

Hiago De Franco Sept. 1, 2026, 7:42 p.m. UTC 
When the CNA reports Unpatched and the scan reports Patched, cve_update()
reads cve_data[cve]['detail'] unguarded. cve-check only writes 'detail'
for CVEs carrying a CVE_STATUS varflag, so an entry marked Patched by an
NVD version comparison has no such key and the script aborts with
KeyError: 'detail' on ordinary cve-check output. The unhandled-update
warning below makes the same assumption.

Use .get() in both places. A missing detail falls through to the CNA
verdict, and only an explicit CVE_STATUS = "backported-patch" outranks
it, which is what the guard was added for.

Tested by calling cve_update() with a Patched entry carrying no detail:
before it raises KeyError, after it takes the CNA's Unpatched verdict,
while an entry with detail = "backported-patch" stays Patched either way.

AI-Generated: Uses Claude (claude-opus-5)
Fixes: d317e2a52bd2 ("improve_kernel_cve_report: do not override backported-patch")
Signed-off-by: Hiago De Franco <hfranco@baylibre.com>
---
 scripts/contrib/improve_kernel_cve_report.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)


---
base-commit: 310eec2cb646d7d1a3ca99bad7e37495bb418a0d
change-id: 20260901-fix-kernel-cve-scarthgap-4b2042336e49

Best regards,
--  
Hiago
diff mbox series

Patch

diff --git a/scripts/contrib/improve_kernel_cve_report.py b/scripts/contrib/improve_kernel_cve_report.py
index 3a15b1ed26..dd59d93146 100755
--- a/scripts/contrib/improve_kernel_cve_report.py
+++ b/scripts/contrib/improve_kernel_cve_report.py
@@ -362,7 +362,7 @@  def cve_update(cve_data, cve, entry):
     if entry['status'] == "Unpatched" and cve_data[cve]['status'] == "Patched":
         # Backported-patch (e.g. vendor kernel repo with cherry-picked CVE patch)
         # has priority over unpatch from CNA
-        if cve_data[cve]['detail'] == "backported-patch":
+        if cve_data[cve].get('detail') == "backported-patch":
             return
         logging.warning("CVE entry %s update from Patched to Unpatched from the scan result", cve)
         cve_data[cve] = copy_data(cve_data[cve], entry)
@@ -381,7 +381,7 @@  def cve_update(cve_data, cve, entry):
         logging.debug("CVE entry %s updated from Unpatched to Ignored", cve)
         return
     logging.warning("Unhandled CVE entry update for %s %s from %s %s to %s",
-        cve, cve_data[cve]['status'], cve_data[cve]['detail'],  entry['status'], entry['detail'])
+        cve, cve_data[cve]['status'], cve_data[cve].get('detail'),  entry['status'], entry['detail'])
 
 def main():
     parser = argparse.ArgumentParser(