On Mon, Apr 07, 2025 at 12:59:18PM +0200, Christian Brauner wrote:
On Sun, Apr 06, 2025 at 07:07:57PM +0300, Cengiz Can wrote:
On 24-03-25 11:53:51, Greg KH wrote:
On Mon, Mar 24, 2025 at 09:43:18PM +0300, Cengiz Can wrote:
In the meantime, can we get this fix applied?
Please work with the filesystem maintainers to do so.
Hello Christian, hello Alexander
Can you help us with this?
Thanks in advance!
Filesystem bugs due to corrupt images are not considered a CVE for any filesystem that is only mountable by CAP_SYS_ADMIN in the initial user namespace. That includes delegated mounting.
Thank you for the concise summary of this. We (i.e. the kernel CVE team) will try to not assign CVEs going forward that can only be triggered in this way.
The blogpost is aware that the VFS maintainers don't accept CVEs like this. Yet a CVE was still filed against the upstream kernel. IOW, someone abused the fact that a distro chose to allow mounting arbitrary filesystems including orphaned ones by unprivileged user as an argument to gain a kernel CVE.
Yes, Canonical abused their role as a CNA and created this CVE without going through the proper processes. kernel.org is now in charge of this CVE, and:
Revoke that CVE against the upstream kernel. This is a CVE against a distro. There's zero reason for us to hurry with any fix.
I will go reject this now.
Note, there might be some older CVEs that we have accidentally assigned that can only be triggered by hand-crafted filesystem images. If anyone wants to dig through the 5000+ different ones we have, we will be glad to reject them as well.
thanks,
greg k-h