From patchwork Wed Aug 12 07:28:34 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 94981 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id DAF6DC5AD5A for ; Wed, 12 Aug 2026 05:31:00 +0000 (UTC) Received: from out-180.mta1.migadu.com (out-180.mta1.migadu.com [95.215.58.180]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.1525.1786512660422921983 for ; Tue, 11 Aug 2026 22:31:00 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@linux.dev header.s=key1 header.b=Lb+LUIMB; spf=pass (domain: linux.dev, ip: 95.215.58.180, mailfrom: junjie.cao@linux.dev) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1786512657; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=D4g14Uo/dPdwN6YIoVIbHNrsskUGuv+VgxvJH0L5raU=; b=Lb+LUIMBEo2KAEsag9c596YTXwPCw2vAahSvlNQFZ6+QKCERHY2dz2itpAwRMLwcQj5B4g gYBsxdDRsALtY7FYTfIpAoT80qo0I25V5KmMAFyoNlilW4/4PrCbR/fDbaR3l0cOG/yhoM UirDDczZgV/FmuC/yuGQtKbXd/T7ZNw= From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev Subject: [OE-core][PATCH v3 1/9] cve-exclusions: set status for CVE-2019-14899 Date: Wed, 12 Aug 2026 02:28:34 -0500 Message-ID: <20260812072842.1176341-2-junjie.cao@linux.dev> In-Reply-To: <20260812072842.1176341-1-junjie.cao@linux.dev> References: <20260812072842.1176341-1-junjie.cao@linux.dev> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 12 Aug 2026 05:31:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243226 A network-adjacent attacker can send packets addressed to a host's VPN tunnel address over the physical interface. Because Linux uses the weak host model by default, the host replies, which lets the attacker infer the tunnel address, confirm active connections and eventually inject into the tunneled TCP stream. No upstream kernel fix exists. The disclosure notes that reverse path filtering is not a complete solution because the attack also works over IPv6, which has no rp_filter; the mitigation that shipped was a firewall rule added to wg-quick(8) in userspace: https://www.openwall.com/lists/oss-security/2019/12/05/1 https://lore.kernel.org/all/20191205191318.GA44156@zx2c4.com/ Distribution trackers record the same state: Ubuntu has it deferred since 2019-12-13, Debian does not track it against the kernel, and Red Hat scopes it to openvpn: https://ubuntu.com/security/CVE-2019-14899 https://security-tracker.debian.org/tracker/CVE-2019-14899 Record it unpatched so it stays visible rather than excluded. CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- v3: - use "unpatched" instead of "upstream-wontfix": there is no upstream statement, only distribution and disclosure sources v2: https://lore.kernel.org/openembedded-core/20260803084827.1348810-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index d27d764..5ed4a00 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -192,3 +192,10 @@ CVE_STATUS[CVE-2025-68195] = "fixed-version: Fixed from 6.18" # Fix https://git.kernel.org/stable/c/b4b64fda4d30a83a7f00e92a0c8a1d47699609f3 # Backport https://git.kernel.org/stable/c/75c5d9bce072abbbc09b701a49869ac23c34a906 CVE_STATUS[CVE-2025-71145] = "cpe-stable-backport: Fixed from v6.18.3" + +# Consequence of the default weak host model, not a specific defect; +# mitigation is firewall configuration only (rp_filter for IPv4, a +# strong host model rule such as wg-quick(8)'s, which also covers IPv6). +# https://ubuntu.com/security/CVE-2019-14899 +CVE_STATUS[CVE-2019-14899] = "unpatched: consequence of the default weak \ +host model, no upstream kernel fix, mitigated by firewall configuration" From patchwork Wed Aug 12 07:28:35 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 94982 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D94FCC5AD5A for ; Wed, 12 Aug 2026 05:31:10 +0000 (UTC) Received: from out-182.mta0.migadu.com (out-182.mta0.migadu.com [91.218.175.182]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.1484.1786512667785297652 for ; Tue, 11 Aug 2026 22:31:08 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@linux.dev header.s=key1 header.b=ki1S7Bsn; spf=pass (domain: linux.dev, ip: 91.218.175.182, mailfrom: junjie.cao@linux.dev) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1786512664; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=uXm2Zfq1jroUKOSU13LxSSr7kqd4FwK3NEbkH7bvMas=; b=ki1S7BsnmKFmzcPYX7Oz0QTG/TCPI2Put00yPwJaBd1pf9pewfj2ImluzS3qTPsJOK17fP RANbbqlZlw7QVR70ZCIZSgLDfAXRZMA0VEAshvUevx/JGDWSQdWxDfyo1O/AYoxWcSu0Ad 5D4TM8ayyNfZMPyqMU8onY7YXQ3HKM0= From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev Subject: [OE-core][PATCH v3 2/9] cve-exclusions: set status for CVE-2021-3714 Date: Wed, 12 Aug 2026 02:28:35 -0500 Message-ID: <20260812072842.1176341-3-junjie.cao@linux.dev> In-Reply-To: <20260812072842.1176341-1-junjie.cao@linux.dev> References: <20260812072842.1176341-1-junjie.cao@linux.dev> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 12 Aug 2026 05:31:10 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243227 KSM merges identical anonymous pages across processes. An attacker who can place chosen page-sized content in a victim's memory can detect the merge through the timing of the resulting copy-on-write fault, and so leak memory contents. There is no upstream fix; removing the side channel means removing deduplication. Distribution trackers describe it the same way - Debian marks src:linux unfixed with "Inherent design limitation, can be avoided by not using KSM", Red Hat closed its bug WONTFIX, and Ubuntu records no upstream fix as of 2024-06-17: https://security-tracker.debian.org/tracker/CVE-2021-3714 https://bugzilla.redhat.com/show_bug.cgi?id=1931327 https://ubuntu.com/security/CVE-2021-3714 Exposure requires two runtime opt-ins: ksmd must be started by the administrator (ksm_run defaults to KSM_RUN_STOP in mm/ksm.c) and memory is only eligible when a process asks with madvise(MADV_MERGEABLE) or prctl(PR_SET_MEMORY_MERGE). CONFIG_KSM=y is set in yocto-kernel-cache (bsp/intel-x86 and the paravirt_kvm fragments), so this is not a configuration exclusion. CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- v3: - use "unpatched" instead of "upstream-wontfix": the WONTFIX is a distribution position, not an upstream one v2: https://lore.kernel.org/openembedded-core/20260803084827.1348810-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index 5ed4a00..af3576d 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -199,3 +199,10 @@ CVE_STATUS[CVE-2025-71145] = "cpe-stable-backport: Fixed from v6.18.3" # https://ubuntu.com/security/CVE-2019-14899 CVE_STATUS[CVE-2019-14899] = "unpatched: consequence of the default weak \ host model, no upstream kernel fix, mitigated by firewall configuration" + +# Timing side channel inherent to KSM page deduplication. Reachable only +# when ksmd is started (/sys/kernel/mm/ksm/run defaults to 0) and the +# workload opts in via MADV_MERGEABLE or prctl(PR_SET_MEMORY_MERGE). +# https://security-tracker.debian.org/tracker/CVE-2021-3714 +CVE_STATUS[CVE-2021-3714] = "unpatched: timing side channel inherent to \ +KSM page deduplication, only reachable when KSM is enabled and opted into" From patchwork Wed Aug 12 07:28:36 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 94983 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D8074C5B567 for ; Wed, 12 Aug 2026 05:31:20 +0000 (UTC) Received: from out-184.mta0.migadu.com (out-184.mta0.migadu.com [91.218.175.184]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.1485.1786512676406312614 for ; Tue, 11 Aug 2026 22:31:16 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@linux.dev header.s=key1 header.b=GLSbJOpq; spf=pass (domain: linux.dev, ip: 91.218.175.184, mailfrom: junjie.cao@linux.dev) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1786512674; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=dBigX+C9Xl0TSpeUaiP/o1MlVCCpMycITKrQwl9RVb8=; b=GLSbJOpqRtJsEBJTkedd7y5T6gsey6PAtA3HoDXTFQmpWYPvCuPBvV/WlhLtkMomoVG21O rGuW/OF8/yjDuucQkWeW2kXHNKyRHnFXMiTCL6gZlSPrFMn1kiaqP5GdFiW2oGvTcjmn/V EF5EbwMv13P2yUSoX+ONxQL3ACWn92c= From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev Subject: [OE-core][PATCH v3 3/9] cve-exclusions: set status for CVE-2021-3864 Date: Wed, 12 Aug 2026 02:28:36 -0500 Message-ID: <20260812072842.1176341-4-junjie.cao@linux.dev> In-Reply-To: <20260812072842.1176341-1-junjie.cao@linux.dev> References: <20260812072842.1176341-1-junjie.cao@linux.dev> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 12 Aug 2026 05:31:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243228 begin_new_exec() resets dumpability to owner-dumpable whenever the real and effective ids match at exec time. A binary exec'd by a setuid program that has already called setuid(0) therefore becomes dumpable as root, and with a relative core_pattern plus an attacker-controlled working directory the resulting core file can be dropped into a privileged directory such as /etc/logrotate.d. Full report with proof of concept: https://www.openwall.com/lists/oss-security/2021/10/20/2 Two fixes were proposed and neither was merged. Waiman Long's patch was judged an ineffective mitigation by Eric W. Biederman and the discussion went quiet in early 2022; Wander Lairson Costa's RFC v2 received design feedback and no v3 followed: https://lore.kernel.org/all/20211221021744.864115-1-longman@redhat.com/ https://lore.kernel.org/all/20211228170910.623156-1-wander@redhat.com/ The flagged logic is unchanged: fs/exec.c still selects TASK_DUMPABLE_OWNER in that case, and fs/coredump.c only applies the suid-safe restriction when dumpable is TASK_DUMPABLE_ROOT, so the dumpable==1 case this CVE describes is not covered. Images that set an absolute path, a pipe or a socket core_pattern are not exploitable. CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- v3: - use "unpatched" instead of "upstream-wontfix"; a NAK of one mitigation is not an upstream wontfix of the issue - drop the "NAKed" wording: the discussion went quiet, it was not formally rejected v2: https://lore.kernel.org/openembedded-core/20260803084827.1348810-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index af3576d..ba8e467 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -206,3 +206,11 @@ host model, no upstream kernel fix, mitigated by firewall configuration" # https://security-tracker.debian.org/tracker/CVE-2021-3714 CVE_STATUS[CVE-2021-3714] = "unpatched: timing side channel inherent to \ KSM page deduplication, only reachable when KSM is enabled and opted into" + +# Two mitigation attempts, neither merged; the fs/exec.c logic is +# unchanged. An absolute, piped or socket kernel.core_pattern (for +# example systemd-coredump) prevents exploitation. +# https://www.openwall.com/lists/oss-security/2021/10/20/2 +# https://ubuntu.com/security/CVE-2021-3864 +CVE_STATUS[CVE-2021-3864] = "unpatched: no accepted mainline fix, \ +exploitation requires a relative kernel.core_pattern" From patchwork Wed Aug 12 07:28:37 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 94984 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D8162C5AD5A for ; Wed, 12 Aug 2026 05:31:40 +0000 (UTC) Received: from out-174.mta1.migadu.com (out-174.mta1.migadu.com [95.215.58.174]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.1487.1786512692838663411 for ; Tue, 11 Aug 2026 22:31:33 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@linux.dev header.s=key1 header.b=EwG4Z++Y; spf=pass (domain: linux.dev, ip: 95.215.58.174, mailfrom: junjie.cao@linux.dev) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1786512690; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=zKfKBCv3o9Oto7IZ7zpliOaqBAa5+DMucV6rSkbsGAY=; b=EwG4Z++Y6FWLssQjffgkJBIoSI9Lw1Y1K6VnHh0rmUGCRqn/ve57HSV7w4kRt2CQvZL0TO n51CBzEPegE7dQOJalxaCGIxL1C6aenMFzcIWSUSpOz+8cnr5lYaeEEwuBqi1yMIQKtY0J sQXtxKIhvyfRoI97S6WA/VmFUePccgI= From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev Subject: [OE-core][PATCH v3 4/9] cve-exclusions: set status for CVE-2022-0400 Date: Wed, 12 Aug 2026 02:28:37 -0500 Message-ID: <20260812072842.1176341-5-junjie.cao@linux.dev> In-Reply-To: <20260812072842.1176341-1-junjie.cao@linux.dev> References: <20260812072842.1176341-1-junjie.cao@linux.dev> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 12 Aug 2026 05:31:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243229 The CVE describes an out-of-bounds read in the SMC protocol stack, but no vulnerable code was ever identified. The MITRE record lists the affected version as "Not Known" and references only two Red Hat bugzillas, the originating one of which was never made public. The public bugzilla is closed as NOTABUG, with the statement "There was no shipped kernel version that was seen affected by this problem": https://bugzilla.redhat.com/show_bug.cgi?id=2044575 https://access.redhat.com/security/cve/CVE-2022-0400 SUSE reached the same conclusion independently, closing bsc#1195329 as RESOLVED / INVALID: https://www.suse.com/security/cve/CVE-2022-0400.html So did Debian, which marks it unimportant with the note "non issue, no security impact": https://security-tracker.debian.org/tracker/CVE-2022-0400 There is no commit in mainline referencing this CVE. The net/smc out-of-bounds fixes that landed in v5.18 (b1871fd48efc, 0558226cebee) are in local, privileged paths and are not linked to this CVE by any tracker. CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- v3: no functional change since v2 v2: https://lore.kernel.org/openembedded-core/20260803084827.1348810-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index ba8e467..be74672 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -214,3 +214,10 @@ KSM page deduplication, only reachable when KSM is enabled and opted into" # https://ubuntu.com/security/CVE-2021-3864 CVE_STATUS[CVE-2021-3864] = "unpatched: no accepted mainline fix, \ exploitation requires a relative kernel.core_pattern" + +# Never substantiated: no affected version, reproducer or commit was ever +# identified. Closed NOTABUG by Red Hat, INVALID by SUSE (bsc#1195329) and +# "non issue, no security impact" by Debian. +# https://bugzilla.redhat.com/show_bug.cgi?id=2044575 +CVE_STATUS[CVE-2022-0400] = "disputed: the reported net/smc out-of-bounds read \ +was never substantiated and was closed as not-a-bug by Red Hat, SUSE and Debian" From patchwork Wed Aug 12 07:28:38 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 94985 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D6BC6C5B567 for ; Wed, 12 Aug 2026 05:31:50 +0000 (UTC) Received: from out-184.mta0.migadu.com (out-184.mta0.migadu.com [91.218.175.184]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.1489.1786512702501115657 for ; Tue, 11 Aug 2026 22:31:42 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@linux.dev header.s=key1 header.b=bWHi30eg; spf=pass (domain: linux.dev, ip: 91.218.175.184, mailfrom: junjie.cao@linux.dev) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1786512700; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=veoR9S/qyMeG68COmJgvTTE8pNstaGApfTEA+b/9o4A=; b=bWHi30egpJ7GhkXHk05FIZKsA6Aar8od47Y7jGm9wFKSvEKOIapxTiCvdcezPHyH5H6626 s8dpfpZ/adkMSggDc0CkHK0zP1g0H6+2er3ZcxroL/XygSygJWRgba7E9fzWPMXjtIHQih y1syj6kqEmoNaCr9dkLPexYHpNv9a+8= From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev Subject: [OE-core][PATCH v3 5/9] cve-exclusions: set status for CVE-2022-1247 Date: Wed, 12 Aug 2026 02:28:38 -0500 Message-ID: <20260812072842.1176341-6-junjie.cao@linux.dev> In-Reply-To: <20260812072842.1176341-1-junjie.cao@linux.dev> References: <20260812072842.1176341-1-junjie.cao@linux.dev> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 12 Aug 2026 05:31:50 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243230 The CVE describes a race between rose_connect() and the code that frees a rose_neigh once its count and use fields reach zero. net/rose, and rose_connect() with it, was removed entirely in v7.1: https://git.kernel.org/linus/dd8d4bc28ad7252610d8e79c1313a2d1e3499a51 ("net: remove ax25 and amateur radio (hamradio) subsystem", v7.1) The linux-yocto kernel on master is 6.18, which still carries net/rose. There the race is closed by Takamitsu Iwai's August 2025 refcount conversion, which converts the 'use' field to refcount_t and removes the unlocked rose->neighbour->use++ in rose_connect() that the CVE describes: https://git.kernel.org/linus/d860d1faa6b2ce3becfdb8b0c2b048ad31800061 ("net: rose: convert 'use' field to refcount_t", v6.17) https://git.kernel.org/linus/da9c9c877597170b929a6121a68dcd3dd9a80f45 ("net: rose: include node references in rose_neigh refcount", v6.17) Both are in v6.17 and were backported to 6.1.y, 6.6.y, 6.12.y and 6.16.y in the 2025-09-02 stable round. Upstream assigned these two commits their own identifiers, CVE-2025-39826 and CVE-2025-39827 (both fixed in v6.17-rc4), so the identification does not rest on this reading of the diff alone. The Red Hat record for CVE-2022-1247 still shows it open and lists no fix. CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- v3: - lead with the v7.1 removal of net/rose per review; keep the v6.17 commits, which are what covers the 6.18 kernel on master - cite the upstream CVE-2025-39826 / CVE-2025-39827 assignments for the two fixing commits instead of relying on the diff match alone v2: https://lore.kernel.org/openembedded-core/20260803084827.1348810-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index be74672..b08eaa1 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -221,3 +221,11 @@ exploitation requires a relative kernel.core_pattern" # https://bugzilla.redhat.com/show_bug.cgi?id=2044575 CVE_STATUS[CVE-2022-0400] = "disputed: the reported net/smc out-of-bounds read \ was never substantiated and was closed as not-a-bug by Red Hat, SUSE and Debian" + +# net/rose and rose_connect() were removed entirely in v7.1 (dd8d4bc28ad7). +# The 6.18 kernel on master still carries net/rose; there the race is +# closed by the v6.17 refcount conversion, which upstream tracks as +# CVE-2025-39826 / CVE-2025-39827. +# Fix https://git.kernel.org/linus/d860d1faa6b2ce3becfdb8b0c2b048ad31800061 +# Fix https://git.kernel.org/linus/da9c9c877597170b929a6121a68dcd3dd9a80f45 +CVE_STATUS[CVE-2022-1247] = "fixed-version: Fixed from version 6.17" From patchwork Wed Aug 12 07:28:39 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 94986 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D8852C5B567 for ; Wed, 12 Aug 2026 05:32:00 +0000 (UTC) Received: from out-179.mta0.migadu.com (out-179.mta0.migadu.com [91.218.175.179]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.1531.1786512716552142226 for ; Tue, 11 Aug 2026 22:31:56 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@linux.dev header.s=key1 header.b=aBkVNGM2; spf=pass (domain: linux.dev, ip: 91.218.175.179, mailfrom: junjie.cao@linux.dev) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1786512714; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=xNAXrbYx7bdElRyOIEnNH3bfS48FtYGtJQBYXY6bDsc=; b=aBkVNGM2CiYzZr0eR5kmptri5rz+TGDOSrdRpftQEiWWWjo8suoVtUx+5Cv+yjJeBTyQE1 cyWqflekIc3O/kyHe1dmkGjrW0t+EQyrqqVtCvsNKy3VCqI3J7vZoWF+65e7nc1a/Y2IjH cpHf3SzntHDFCiWQtwjuLvQsI7tl0fQ= From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev Subject: [OE-core][PATCH v3 6/9] cve-exclusions: set status for CVE-2022-4543 Date: Wed, 12 Aug 2026 02:28:39 -0500 Message-ID: <20260812072842.1176341-7-junjie.cao@linux.dev> In-Reply-To: <20260812072842.1176341-1-junjie.cao@linux.dev> References: <20260812072842.1176341-1-junjie.cao@linux.dev> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 12 Aug 2026 05:32:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243231 KPTI clones the kernel entry text into the user page tables at its KASLR-slid address and, on CPUs with PGE, sets the global bit on those PTEs. The mapping survives the CR3 write on kernel exit, and a local attacker can time prefetch instructions across the kernel range to recover the KASLR base in well under a second. Disclosure and write-up: https://www.openwall.com/lists/oss-security/2022/12/16/3 https://www.willsroot.io/2022/12/entrybleed.html The disclosure states that after discussion with security@kernel.org and linux-distros "a fix for this is currently not available", and none has appeared since; arch/x86/mm/pti.c still clones the entry text and sets _PAGE_GLOBAL on the cloned PTEs. This is an unfixed issue, not a stated wontfix - Debian notes "Ignored upstream and KASLR is not expected to be resistant to local attacks", Ubuntu has it deferred since 2023-01-10: https://security-tracker.debian.org/tracker/CVE-2022-4543 https://ubuntu.com/security/CVE-2022-4543 97e3d26b5e5f ("x86/mm: Randomize per-cpu entry area", v6.2) randomizes the separate cpu_entry_area; it predates this disclosure and does not change the offset of entry_SYSCALL_64 from the KASLR base. CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- v3: - use "unpatched" instead of "upstream-wontfix": the security-team discussion produced no clear wontfix decision v2: https://lore.kernel.org/openembedded-core/20260803084827.1348810-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index b08eaa1..a909aef 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -229,3 +229,11 @@ was never substantiated and was closed as not-a-bug by Red Hat, SUSE and Debian" # Fix https://git.kernel.org/linus/d860d1faa6b2ce3becfdb8b0c2b048ad31800061 # Fix https://git.kernel.org/linus/da9c9c877597170b929a6121a68dcd3dd9a80f45 CVE_STATUS[CVE-2022-1247] = "fixed-version: Fixed from version 6.17" + +# "EntryBleed": KPTI maps the entry text into the user page tables with +# the global bit set, leaking the KASLR base by prefetch timing. Discussed +# with the kernel security team; no fix, KASLR is not treated as a boundary +# against local attackers. Distinct from CVE-2023-3640 (cpu_entry_area). +# https://www.willsroot.io/2022/12/entrybleed.html +CVE_STATUS[CVE-2022-4543] = "unpatched: no upstream fix, KASLR is not \ +treated as a defence against local attackers" From patchwork Wed Aug 12 07:28:40 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 94987 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id E2AF8C5AD5A for ; Wed, 12 Aug 2026 05:32:40 +0000 (UTC) Received: from out-189.mta0.migadu.com (out-189.mta0.migadu.com [91.218.175.189]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.1498.1786512752336042813 for ; Tue, 11 Aug 2026 22:32:32 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@linux.dev header.s=key1 header.b=C2UDwne+; spf=pass (domain: linux.dev, ip: 91.218.175.189, mailfrom: junjie.cao@linux.dev) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1786512749; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=J/avDrfhvRyVuXGHRI1Id3GP2tBu2CDoVeiyVqmKRdE=; b=C2UDwne+gBM9NawxO2B2bFQEfvDFpRdPDL1BCU32tsvgjkvsdvH5m36Y1R+6wrDxq8qZzT aL5obaZZbRm0QMS/VaR8LbqmogPw54AGT6EX/+YHg5PTof3698XaGNxWh7vKriV7vo7bLf Ar24038GnXJswavuG9VbtLbGsjTGOQ4= From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev Subject: [OE-core][PATCH v3 7/9] cve-exclusions: set status for CVE-2023-3397 Date: Wed, 12 Aug 2026 02:28:40 -0500 Message-ID: <20260812072842.1176341-8-junjie.cao@linux.dev> In-Reply-To: <20260812072842.1176341-1-junjie.cao@linux.dev> References: <20260812072842.1176341-1-junjie.cao@linux.dev> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 12 Aug 2026 05:32:40 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243232 txEnd() in fs/jfs/jfs_txnmgr.c reads the log pointer from the superblock info, drops TXN_LOCK and then takes log->gclock, while lmLogClose() can free that log during umount. No fix has been merged. The 2023 proposal was withdrawn by its author ("I think my fix method is not a good solution"), and the 2026 proposals for the same unmount race are unreviewed: https://lore.kernel.org/all/20230515095956.17898-1-zyytlz.wz@163.com/ https://lore.kernel.org/all/20260505123330.2822833-1-tristmd@gmail.com/ https://lore.kernel.org/all/20260603171620.2532527-1-jie.wang@intel.com/ The txEnd() sequence is unchanged in linux-next 20260727, and the use-after-free was reported again in June 2026 against 7.0-rc1, with the free stack in lmLogClose() via jfs_umount(); syzbot still lists it open: https://lore.kernel.org/all/6a3eedfa.fd822575.2d6b21.e180@mx.google.com/ https://syzkaller.appspot.com/bug?extid=ea7ed3bb2f444cb4dfeb CONFIG_JFS_FS=n in both ktypes/standard and ktypes/preempt-rt in yocto-kernel-cache, and no fragment enables it. CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- v3: - correct the claim that only one fix was proposed and withdrawn: further fixes were posted in 2026 but none is merged - add the syzbot dashboard and the June 2026 report as evidence the race is still live in mainline v2: https://lore.kernel.org/openembedded-core/20260803084827.1348810-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index a909aef..c4a9dea 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -237,3 +237,10 @@ CVE_STATUS[CVE-2022-1247] = "fixed-version: Fixed from version 6.17" # https://www.willsroot.io/2022/12/entrybleed.html CVE_STATUS[CVE-2022-4543] = "unpatched: no upstream fix, KASLR is not \ treated as a defence against local attackers" + +# JFS txEnd()/lmLogClose() use-after-free on unmount. No fix merged: the +# 2023 proposal was withdrawn, the 2026 proposals are unreviewed, and the +# racy code is unchanged; syzbot still reproduces it. +# https://syzkaller.appspot.com/bug?extid=ea7ed3bb2f444cb4dfeb +CVE_STATUS[CVE-2023-3397] = "unpatched: no upstream fix merged, the \ +affected fs/jfs txEnd()/lmLogClose() unmount race is unchanged" From patchwork Wed Aug 12 07:28:41 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 94988 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D8A6EC5AD5A for ; Wed, 12 Aug 2026 05:33:00 +0000 (UTC) Received: from out-172.mta1.migadu.com (out-172.mta1.migadu.com [95.215.58.172]) by mx.groups.io with SMTP id smtpd.msgproc01-g2.1542.1786512772891509297 for ; Tue, 11 Aug 2026 22:32:53 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@linux.dev header.s=key1 header.b=dqsh7Kra; spf=pass (domain: linux.dev, ip: 95.215.58.172, mailfrom: junjie.cao@linux.dev) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1786512770; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Uk8kE8hCP4h/8U9BHqGYaHv/NB2VwE7wOHv3ES/NABc=; b=dqsh7KraVH3E8JiZiMB+c9uvthxOD8M4P1U+xwQcwd+DZ+OUNbGtMi7e/hpsFzth2BPvRp SocHctek4+uyjPPGequ1WfBnBJS7BdCx9K75l8SFf6V8piHHkavDaayk1p6TNhVVU2UWjE hjO0UnJgIFndC1m2wS9Yqzljur9OVkA= From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev Subject: [OE-core][PATCH v3 8/9] cve-exclusions: set status for CVE-2023-6238 Date: Wed, 12 Aug 2026 02:28:41 -0500 Message-ID: <20260812072842.1176341-9-junjie.cao@linux.dev> In-Reply-To: <20260812072842.1176341-1-junjie.cao@linux.dev> References: <20260812072842.1176341-1-junjie.cao@linux.dev> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 12 Aug 2026 05:33:00 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243233 NVME_IOCTL_IO_CMD and the io_uring passthrough path accept a metadata length from userspace without checking it against the number of blocks and the namespace metadata size that the device uses to size the transfer, so the device can DMA past the end of the buffer. Kanchan Joshi posted a stopgap removing unprivileged passthrough, reviewed by Christoph Hellwig and applied for nvme-6.6: https://lore.kernel.org/linux-nvme/20231016060519.231880-1-joshi.k@samsung.com/ It was then backed out. Keith Busch wrote "I believe this large change is a bit too late for 6.6 ... It's backed out now", to which Christoph Hellwig replied "We leave an exploitable hole in, so I don't think waiting any longer is an option". No replacement has been merged: the commits the patch would have reverted are all still present, and nvme_map_user_request() still passes the user-supplied metadata length straight to blk_rq_integrity_map_user() with no cross-check. The exposure was introduced by 855b7717f44b ("nvme: fine-granular CAP_SYS_ADMIN for nvme io commands") in v6.2, so branches carrying older kernels are not affected. Debian reached the same conclusion independently, marking the older suites "Vulnerable code not present": https://security-tracker.debian.org/tracker/CVE-2023-6238 Red Hat rates it Low because the device node is root-only by default: https://access.redhat.com/security/cve/CVE-2023-6238 CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- v3: no functional change since v2 v2: https://lore.kernel.org/openembedded-core/20260803084827.1348810-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index c4a9dea..35e0a66 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -244,3 +244,11 @@ treated as a defence against local attackers" # https://syzkaller.appspot.com/bug?extid=ea7ed3bb2f444cb4dfeb CVE_STATUS[CVE-2023-3397] = "unpatched: no upstream fix merged, the \ affected fs/jfs txEnd()/lmLogClose() unmount race is unchanged" + +# The user metadata length is not checked against the length the device +# derives from the command. The fix was applied to nvme-6.6 and then backed +# out; nothing has landed since. Kernels before v6.2 predate unprivileged +# passthrough (855b7717f44b) and are not affected. +# https://lore.kernel.org/linux-nvme/20231016060519.231880-1-joshi.k@samsung.com/ +CVE_STATUS[CVE-2023-6238] = "unpatched: the proposed fix was applied to \ +nvme-6.6 and then reverted, no upstream fix has landed since" From patchwork Wed Aug 12 07:28:42 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Junjie Cao X-Patchwork-Id: 94989 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from aws-us-west-2-korg-lkml-1.web.codeaurora.org (localhost.localdomain [127.0.0.1]) by smtp.lore.kernel.org (Postfix) with ESMTP id D900EC5B567 for ; Wed, 12 Aug 2026 05:33:20 +0000 (UTC) Received: from out-182.mta1.migadu.com (out-182.mta1.migadu.com [37.59.57.117]) by mx.groups.io with SMTP id smtpd.msgproc02-g2.1502.1786512798502560219 for ; Tue, 11 Aug 2026 22:33:18 -0700 Authentication-Results: mx.groups.io; dkim=fail reason="dkim: body hash did not verify" header.i=@linux.dev header.s=key1 header.b=N4f/PhB3; spf=pass (domain: linux.dev, ip: 37.59.57.117, mailfrom: junjie.cao@linux.dev) X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1786512796; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=JcyfdIorAxCqa+NrHLQeR+0arq9JpIWM1Vab1fp751o=; b=N4f/PhB3BfRx28Tp+bkIIimy1gu1NYVkjvimJ6oxWgQqeHX+SKwdqpDWPZ8BCM5dJbZzpO 9Oj/RQj4+xPsLTWk4d1SWz1Iiz/uSwQ950FQlyMBguBFOOPiNq1trer6MX7pW6m4Px+KU6 BWJwvCdgxd4vht1+j1MjlKBTEXoTaCA= From: Junjie Cao To: openembedded-core@lists.openembedded.org Cc: paul@pbarker.dev Subject: [OE-core][PATCH v3 9/9] cve-exclusions: set status for CVE-2023-6240 Date: Wed, 12 Aug 2026 02:28:42 -0500 Message-ID: <20260812072842.1176341-10-junjie.cao@linux.dev> In-Reply-To: <20260812072842.1176341-1-junjie.cao@linux.dev> References: <20260812072842.1176341-1-junjie.cao@linux.dev> MIME-Version: 1.0 X-Migadu-Flow: FLOW_OUT List-Id: X-Webhook-Received: from 45-33-107-173.ip.linodeusercontent.com [45.33.107.173] by aws-us-west-2-korg-lkml-1.web.codeaurora.org with HTTPS for ; Wed, 12 Aug 2026 05:33:20 -0000 X-Groupsio-URL: https://lists.openembedded.org/g/openembedded-core/message/243234 "Marvin" is Hubert Kario's Bleichenbacher-style timing oracle research: https://people.redhat.com/~hkario/marvin/ The affected code is the generic software RSA PKCS#1 v1.5 unpadding in crypto/rsa-pkcs1pad.c. pkcs1pad_decrypt_complete() has three secret-dependent early exits (leading zero byte, block type, minimum padding length) and a loop whose trip count depends on the position of the separator, so the time taken reveals padding validity. There is no constant-time unpadding or implicit-rejection fallback in the tree. Red Hat classifies it CWE-203 and has shipped fixes only in RHEL errata (RHSA-2024:2758, RHSA-2024:3618 and others); the bugzilla is still NEW. Ubuntu records it unfixed upstream as of 2024-08-24 and Debian lists src:linux vulnerable in all suites: https://access.redhat.com/security/cve/CVE-2023-6240 https://ubuntu.com/security/CVE-2023-6240 https://security-tracker.debian.org/tracker/CVE-2023-6240 Practical exposure is narrow: kernel PKCS#1 v1.5 use is dominated by signature verification rather than decryption, and an attacker needs a service driving KEYCTL_PKEY_DECRYPT with a long-lived key. The leaky primitive is nevertheless reachable. CC: Paul Barker AI-Generated: Uses Claude (claude-opus-5) Signed-off-by: Junjie Cao --- v3: - drop the Marvell/s390 aside and the unrelated e8829ef1f73f paragraph flagged in review as LLM confusion artifacts v2: https://lore.kernel.org/openembedded-core/20260803084827.1348810-1-junjie.cao@linux.dev/ meta/recipes-kernel/linux/cve-exclusion.inc | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/meta/recipes-kernel/linux/cve-exclusion.inc b/meta/recipes-kernel/linux/cve-exclusion.inc index 35e0a66..637f8b6 100644 --- a/meta/recipes-kernel/linux/cve-exclusion.inc +++ b/meta/recipes-kernel/linux/cve-exclusion.inc @@ -252,3 +252,10 @@ affected fs/jfs txEnd()/lmLogClose() unmount race is unchanged" # https://lore.kernel.org/linux-nvme/20231016060519.231880-1-joshi.k@samsung.com/ CVE_STATUS[CVE-2023-6238] = "unpatched: the proposed fix was applied to \ nvme-6.6 and then reverted, no upstream fix has landed since" + +# "Marvin": the PKCS#1 v1.5 unpadding in crypto/rsa-pkcs1pad.c branches on +# secret-derived data, leaking padding validity by timing. Still present in +# mainline; fixed only in RHEL errata. +# https://people.redhat.com/~hkario/marvin/ +CVE_STATUS[CVE-2023-6240] = "unpatched: Bleichenbacher-style timing oracle in \ +crypto/rsa-pkcs1pad.c is still present in mainline, fixed only downstream in RHEL"