diff options
| author | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-02-17 13:55:31 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2024-02-17 14:46:39 +0100 |
| commit | 5928d411557ec5d53832cdd39fc443704a3e5b77 (patch) | |
| tree | 2ee745c10f4e535af35dbc70b538b0c99a309003 /Documentation/process/security-bugs.rst | |
| parent | 3ca8fbabcceb8bfe44f7f50640092fd8f1de375c (diff) | |
| download | lwn-5928d411557ec5d53832cdd39fc443704a3e5b77.tar.gz lwn-5928d411557ec5d53832cdd39fc443704a3e5b77.zip | |
Documentation: Document the Linux Kernel CVE process
The Linux kernel project now has the ability to assign CVEs to fixed
issues, so document the process and how individual developers can get a
CVE if one is not automatically assigned for their fixes.
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Konstantin Ryabitsev <konstantin@linuxfoundation.org>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Lee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/2024021731-essence-sadness-28fd@gregkh
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'Documentation/process/security-bugs.rst')
| -rw-r--r-- | Documentation/process/security-bugs.rst | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/Documentation/process/security-bugs.rst b/Documentation/process/security-bugs.rst index 692a3ba56cca..56c560a00b37 100644 --- a/Documentation/process/security-bugs.rst +++ b/Documentation/process/security-bugs.rst @@ -99,9 +99,8 @@ CVE assignment The security team does not assign CVEs, nor do we require them for reports or fixes, as this can needlessly complicate the process and may delay the bug handling. If a reporter wishes to have a CVE identifier -assigned, they should find one by themselves, for example by contacting -MITRE directly. However under no circumstances will a patch inclusion -be delayed to wait for a CVE identifier to arrive. +assigned for a confirmed issue, they can contact the :doc:`kernel CVE +assignment team<../process/cve>` to obtain one. Non-disclosure agreements ------------------------- |