diff mbox series

[mickledore,06/20] linux/generate-cve-exclusions: fix mishandling of boundary values

Message ID a0cafa6587acf2b41f0e832d06de884ffe62fd4b.1696982312.git.steve@sakoman.com
State New
Headers show
Series [mickledore,01/20] gstreamer: upgrade 1.22.5 -> 1.22.6 | expand

Commit Message

Steve Sakoman Oct. 11, 2023, 12:01 a.m. UTC 
From: Yuta Hayama <hayama@lineo.co.jp>

affected_versions in kernel_cves.json does not mean "first affected version
to last affected version" but actually "first affected version to fixed
version". Therefore, the variable names, conditional expressions, and
CVE_STATUS descriptions should be fixed.

For example, when the script was run against v6.1, if affected_versions was
"xxx to 6.1", the output was "cpe-stable-backport: Backported in 6.1", but
this should be "fixed-version: Fixed from version 6.1".

Signed-off-by: Yuta Hayama <hayama@lineo.co.jp>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
(cherry picked from commit 2064b2f9b92e2dff45dab633598b5ed37145d0b6)
Signed-off-by: Steve Sakoman <steve@sakoman.com>
---
 .../linux/generate-cve-exclusions.py               | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)
diff mbox series

Patch

diff --git a/meta/recipes-kernel/linux/generate-cve-exclusions.py b/meta/recipes-kernel/linux/generate-cve-exclusions.py
index ef47f39c1b..b52c75c18c 100755
--- a/meta/recipes-kernel/linux/generate-cve-exclusions.py
+++ b/meta/recipes-kernel/linux/generate-cve-exclusions.py
@@ -62,18 +62,18 @@  do_cve_check[prefuncs] += "check_kernel_cve_status_version"
             continue
 
         affected = data["affected_versions"]
-        first_affected, last_affected = re.search(r"(.+) to (.+)", affected).groups()
+        first_affected, fixed = re.search(r"(.+) to (.+)", affected).groups()
         first_affected = parse_version(first_affected)
-        last_affected = parse_version(last_affected)
+        fixed = parse_version(fixed)
 
         handled = False
-        if not last_affected:
+        if not fixed:
             print(f"# {cve} has no known resolution")
         elif first_affected and version < first_affected:
             print(f"# fixed-version: only affects {first_affected} onwards")
             handled = True
-        elif last_affected < version:
-            print(f"# fixed-version: Fixed after version {last_affected}")
+        elif fixed <= version:
+            print(f"# fixed-version: Fixed from version {fixed}")
             handled = True
         else:
             if cve in stream_data:
@@ -87,9 +87,9 @@  do_cve_check[prefuncs] += "check_kernel_cve_status_version"
                         # TODO print a note that the kernel needs bumping
                         print(f"# {cve} needs backporting (fixed from {backport_ver})")
                 else:
-                    print(f"# {cve} needs backporting (fixed from {last_affected})")
+                    print(f"# {cve} needs backporting (fixed from {fixed})")
             else:
-                print(f"# {cve} needs backporting (fixed from {last_affected})")
+                print(f"# {cve} needs backporting (fixed from {fixed})")
 
         if handled:
             print(f'CVE_CHECK_IGNORE += "{cve}"')