6 Nov
2024
6 Nov
'24
4:21 p.m.
On Wed, 2024-11-06 at 15:19 +0000, Chuck Lever III wrote:
This is the first I've heard of this CVE. It would help if the patch authors got some notification when these are filed.
Greg did it; it came from the kernel CNA:
https://www.cve.org/CVERecord?id=CVE-2024-46701
The way it seems to work is that this is simply a wrapper for the upstream commit:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...
Which is what appears as the last stable reference. I assume someone investigated and added the vulnerable kernel details. I think the theory is that since you reviewed the original upstream patch, stable just takes care of the backports and CVE management of the existing fix through the normal stable process.
James