[ubuntu-hardened] Assess vulnerabilities status of HWE kernels

[Francisco]

Hello Diogo,
Thanks so much for your reply, it was really helpful!

Now I have a related question, I'm trying to rely solely on the data
provided by the OVAL files <https://security-metadata.canonical.com/oval/>.
I'm using the CVE ones, and in the Jammy one there is no mention of
"linux-hwe-6.8", even though previous versions like linux-hwe-5.19,
linux-hwe-6.2, and linux-hwe-6.5 are present.

For the same CVE-2024-38541 it shows:
...
<criteria operator="OR">
  <criterion test_ref="oval:com.ubuntu.jammy:tst:201245420000000"
comment="Is kernel linux running?"/>
  <criterion test_ref="oval:com.ubuntu.jammy:tst:201245420000160"
comment="Is kernel linux-hwe-5.19 running?"/>
  <criterion test_ref="oval:com.ubuntu.jammy:tst:201245420000270"
comment="Is kernel linux-hwe-6.2 running?"/>
  <criterion test_ref="oval:com.ubuntu.jammy:tst:201245420000350"
comment="Is kernel linux-hwe-6.5 running?"/>
  <criterion test_ref="oval:com.ubuntu.jammy:tst:201245420000050"
comment="Is kernel linux-kvm running?"/>
  ...

Is that expected?
Shouldn't it have a criterion with a comment like "linux-hwe-6.8 package in
jammy, is related to the CVE in some way and has been fixed (note:
'6.8.0-40.40~22.04.3')." or similar (with the matching test_ref)?
Or am I missing something?

Thanks again for your help! I really appreciate it.

El vie, 7 feb 2025 a las 11:08, Diogo Sousa (<diogo.sousa at canonical.com>)
escribió:

> Hello, Francisco.
>
> In the CVE page we also have entries for the HWE variants. Those will be
> in the form linux-hwe-<version>
>
> Further down you'll see there is an entry for linux-hwe-6.8 indicating
> that it has been fixed for Jammy (Fixed 6.8.0-40.40~22.04.3).
>
> You should look for those specific entries when making a determination.
>
> Thank you for your time,
> ---
> Diogo Sousa
> Engineering Manager - Security Engineering
> UTC+0 🇵🇹
>
>
> On Wed, Feb 5, 2025 at 6:58 PM Francisco <jftuduri at gmail.com> wrote:
>
>> Hi everyone!
>>
>> I'm working on a vulnerability scanner and would like some confirmation
>> on how to handle HWE kernels.
>> I'm using the CVE OVALs as the source of vulnerability information, but I
>> will refer here to the data at https://ubuntu.com/security/cves for
>> simplicity.
>>
>> For example, considering CVE-2024-38541
>> <https://ubuntu.com/security/CVE-2024-38541>, it is listed as:
>> Package: linux
>> - 24.04 LTS noble -> Fixed 6.8.0-40.40
>> - 22.04 LTS jammy -> Vulnerable
>>
>> If I'm assessing a 22.04 system I would assume that the kernel is
>> vulnerable. However, if this system has HWE enabled it would have the
>> kernel 6.8.0-52.53~22.04.1, which is higher than the fixed version shown
>> for 24.04, so I would expect it to include the fix from 6.8.0-40.40.
>> What would be the correct assessment in this case?
>>
>> And in general, when assessing the kernel vulnerability status under HWE
>> should we:
>> - Rely on what’s listed for the specific LTS release (e.g., "vulnerable"
>> for 22.04 in this case), or
>> - Check if a fix exists in a newer release (even if the fix isn’t
>> officially shown for the current LTS release)?
>>
>> Is there some other way to check the vulnerability status of HWE kernels?
>>
>> Thanks in advance!
>>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/ubuntu-hardened/attachments/20250207/d7a58e85/attachment.html>