Kernel Security Guide
1. Public vulnerability bug management
Status whiteboard rules
The status whiteboard in Bugzilla lets us keep track of the category the
bug falls into and its status. It should be following this pattern:
"[kernelline] vulntype: keywords", where:
| Element |
Content |
Example |
| kernelline |
Affected kernel lines (empty means unknown) |
[2.6] |
| vulntype |
The vulnerability type and configuration modifier (empty means
unknown) |
LocalRoot- |
| keywords |
Optional extra keyword(s), as defined below |
needPatch |
Example kernellines:
| Kernel line |
Description |
| [2.6] |
Only 2.6 kernels are affected |
| [2.6 < 2.6.10] |
Only 2.6 kernels before 2.6.10 are affected |
| [2.4 2.6] |
2.4 and 2.6 kernels are affected |
|
No value means affected kernel lines are still unknown |
The following vulnerability types are accepted:
| Type |
Description |
| RemoteRoot |
Remote root compromise |
| RemoteDoS |
Remote denial of service |
| LocalRoot |
Flaw allowing privilege escalation for local unprivileged processes |
| RemoteOther |
Other remote flaws, including memory leaks |
| LocalDoS |
Local user can crash the machine or otherwise deny service to other
users |
| LocalOther |
Other local flaws, including local information leaks |
The following configuration modifiers are allowed:
| Configuration modifier |
Description |
| + |
All configurations (or default configurations) are affected |
| - |
Only specific configurations are affected |
|
No value means configurations affected are still unknown |
The following extra keywords are allowed:
| Keyword |
Description |
| inKiss |
The bug has been entered into the KISS system |
| needPatch |
The bug still misses patches |
| patching |
Maintainers have been called to patch their kernels |
Bug severity depending on vulnerability type
| Severity |
Vulnerability types |
| Blocker |
RemoteRoot+ RemoteRoot- |
| Critical |
RemoteDos+ LocalRoot+ |
| Major |
RemoteDos- LocalRoot- RemoteOther+ |
| Normal |
LocalDoS+ RemoteOther- |
| Minor |
LocalDos- LocalOther+ |
| Trivial |
LocalOther- |
The contents of this document are licensed under the Creative Commons - Attribution / Share Alike license.
|
