Re: [cip-dev] Urgent: Regarding Fixing of Security Vulnerabilities

Hi!

> We are planning to migrate our product to the Linux Kernel 4.19.y
>CIP release to benefit from its long-term maintenance and security
>updates.

Would you mind introducing yourself, your company, and your product?

Normally, we would recommend 6.12 kernel branch if you are doing the
migration, anyway.

> We have a few questions regarding security vulnerability tracking for the CIP kernel:
> 
> * Is there any tool, dashboard, or documentation available to determine:
> 
> * The Kernel CVEs applicable to a specific 4.19.y CIP release.
> * Which CVEs have already been fixed till the given CIP release.
> * Which CVEs are still outstanding.

Take a look at
[email protected]:cip-project/cip-kernel/cip-kernel-sec.git .

> * If there are unfixed vulnerabilities that are considered critical
> for our product, what is the recommended approach to address them?

Approach is similar / same to what -stable kernels use.

Best regards,
								Pavel

-----BEGIN PGP SIGNATURE-----

iF0EABECAB0WIQRPfPO7r0eAhk010v0w5/Bqldv68gUCalVT6wAKCRAw5/Bqldv6
8jrgAJ9juOsW90bgLRzn6hshExh3fHEafwCcCofzizbXvPATvpoA+DkFukb4RII=
=1stG
-----END PGP SIGNATURE-----