daniel:// stenberg://Sep 8, 2025

The other day me and @gregkh shot down a draft proposal to add a new role in the CVE ecosystem (SADP: "supplier ADP") that would append data to CVEs with details about dependencies and how they are or are not vulnerable to each particular CVE.

Imagine the amount of dependencies that use curl or the Linux kernel etc. These sweet innocent proposal makers thought in the terms of 5-10 dependencies per CVE. Not tens or hundreds of thousands which is far from unthinkable.

Show threadJacques ChesterSep 8, 2025
@bagder @gregkh isn’t this what VEX is meant for?
Show threaddaniel:// stenberg://Sep 8, 2025
@jacques @gregkh possibly sure, but that's not info inserted into the CVE records like this proposal does.
Show threadJacques ChesterSep 8, 2025

@bagder @gregkh got it. Sounds like some is trying to create the Universal Asset Graph by accident rather than on purpose.

(Relevant self-post: https://theoryof.predictable.software/articles/some-requirements-for-a-universal-asset-graph/ )

Some Requirements for a Universal Asset Graph :: Theory of Predictable Software

Show threadMatt "msw" WilsonSep 9, 2025
@jacques @bagder @gregkh btw… how is it going, making the Universal Asset Graph on purpose?
Show threadJacques ChesterSep 9, 2025

@msw @bagder @gregkh I haven’t seen anything that fits the criteria, but there are partial things like Mercator, GUAC (the DB) and osv.dev (the data).

In fairness I’ve been out of this space for quite a while.

Show threadMatt "msw" Wilson

@jacques @bagder @gregkh I'd really love to have some public database that would help us all collectively make more efficient resource allocation decisions.

Let's take CVE-2025-38352 for example. CISA added it to the KEV because Google said that there is evidence of exploitation in the context of Android.

If you use CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y the fix is not needed.

Linux distros aren't affected but release "fixes" anyway. https://forums.rockylinux.org/t/rocky-8-10-cve-2025-38352/19590/3

#PatchAllTheThings! #InfoSec

Rocky 8.10 - CVE-2025-38352

OK, I’m busy waiting. Regarding Rocky 9: We also use a machine with kernel 5.14.0-570.37.1.el9. On this machine, the kernel parameter CONFIG_POSIX_CPU_TIMERS_TASK_WORK=y is effective. If I understand correctly, this means that the problem does not occur. Regards

Rocky Linux Forum
Sep 10, 2025 at 5:49pmWeb
Show threadGreg K-HSep 11, 2025
@msw @jacques @bagder I have no problem adding additional data like "This config option means you will not be vulnerable" to our records today, if people want to submit that information to us. We take patches and additions to the kernel cve.org records on a weekly basis from vendors that work to narrow down affected kernel ranges and add additional references.

So we could do what you want today, no changes to anything that cve.org does right now would be needed, just send us a patch! But that was not what was being proposed at all, unfortunately.
CVE Website