This is a note to let you know that I've just added the patch titled
Documentation: security-bugs.rst: clarify CVE handling
to the 5.4-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
documentation-security-bugs.rst-clarify-cve-handling.patch
and it can be found in the queue-5.4 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 3c1897ae4b6bc7cc586eda2feaa2cd68325ec29c Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
Date: Fri, 30 Jun 2023 09:14:21 +0200
Subject: Documentation: security-bugs.rst: clarify CVE handling
From: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
commit 3c1897ae4b6bc7cc586eda2feaa2cd68325ec29c upstream.
The kernel security team does NOT assign CVEs, so document that properly
and provide the "if you want one, ask MITRE for it" response that we
give on a weekly basis in the document, so we don't have to constantly
say it to everyone who asks.
Link: https://lore.kernel.org/r/2023063022-retouch-kerosene-7e4a@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
Documentation/admin-guide/security-bugs.rst | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
--- a/Documentation/admin-guide/security-bugs.rst
+++ b/Documentation/admin-guide/security-bugs.rst
@@ -72,13 +72,12 @@ not contribute to actually fixing any po
CVE assignment
--------------
-The security team does not normally assign CVEs, nor do we require them
-for reports or fixes, as this can needlessly complicate the process and
-may delay the bug handling. If a reporter wishes to have a CVE identifier
-assigned ahead of public disclosure, they will need to contact the private
-linux-distros list, described above. When such a CVE identifier is known
-before a patch is provided, it is desirable to mention it in the commit
-message if the reporter agrees.
+The security team does not assign CVEs, nor do we require them for
+reports or fixes, as this can needlessly complicate the process and may
+delay the bug handling. If a reporter wishes to have a CVE identifier
+assigned, they should find one by themselves, for example by contacting
+MITRE directly. However under no circumstances will a patch inclusion
+be delayed to wait for a CVE identifier to arrive.
Non-disclosure agreements
-------------------------
Patches currently in stable-queue which might be from gregkh@xxxxxxxxxxxxxxxxxxx are
queue-5.4/documentation-security-bugs.rst-clarify-cve-handling.patch
queue-5.4/hwmon-nct7802-fix-for-temp6-peci1-processed-even-if-peci1-disabled.patch
queue-5.4/documentation-security-bugs.rst-update-preferences-when-dealing-with-the-linux-distros-group.patch
queue-5.4/tpm_tis-explicitly-check-for-error-code.patch
queue-5.4/staging-ks7010-potential-buffer-overflow-in-ks_wlan_set_encode_ext.patch
queue-5.4/usb-serial-option-support-quectel-em060k_128.patch
queue-5.4/usb-ohci-at91-fix-the-unhandle-interrupt-when-resume.patch
queue-5.4/serial-8250_dw-preserve-original-value-of-dlf-register.patch
queue-5.4/revert-usb-dwc3-core-enable-autoretry-feature-in-the-controller.patch
queue-5.4/revert-usb-xhci-tegra-fix-error-check.patch
queue-5.4/usb-dwc3-don-t-reset-device-side-if-dwc3-was-configured-as-host-only.patch
queue-5.4/serial-sifive-fix-sifive_serial_console_setup-section.patch
queue-5.4/alsa-hda-realtek-support-asus-g713pv-laptop.patch
queue-5.4/can-gs_usb-gs_can_close-add-missing-set-of-can-state-to-can_state_stopped.patch
queue-5.4/usb-quirks-add-quirk-for-focusrite-scarlett.patch
queue-5.4/usb-serial-simple-add-kaufmann-rks-can-vcp.patch
queue-5.4/usb-serial-option-add-quectel-ec200a-module-support.patch
queue-5.4/btrfs-check-for-commit-error-at-btrfs_attach_transaction_barrier.patch
queue-5.4/usb-serial-simple-sort-driver-entries.patch
queue-5.4/usb-dwc3-pci-skip-byt-gpio-lookup-table-for-hardwired-phy.patch
queue-5.4/usb-xhci-mtk-set-the-dma-max_seg_size.patch
