Re: Resources for glibc CNA

On Thu, Aug 10, 2023 at 01:17:02PM -0400, Siddhesh Poyarekar wrote:
> Hello,
> 
> I recently proposed setting up a CNA for glibc and it looks like there's
> general consensus on us doing this.  As part of this set up we would need an
> email address (preferably one that can accept encrypted submissions from
> issue reporters) to reach the glibc security team and web pages to publish
> security advisories.

I am not familiar with "CNA" in this context, but I assume it's some kind of
Numbering Authority similar to a CVE?

> I wanted to know if this is something we could/should set up on LF
> infrastructure or if I should try and get something up on sourceware.
> Konstantin, does LF already have some infrastructure for this that we can
> share?

Yes and no. We do have infrastructure for encrypted communication called
"remail" where hardware vendors discuss vulnerabilities that are likely to
affect millions of high-profile devices. For example, it was used for
collaborating on the patches fixing the recent speculative execution
vulnerabilities. The setup is described in this document:
https://korg.docs.kernel.org/remail.html

However, this may be an overkill for what you need and also introduces
multiple levels of complexity that you may not want. The alternative is to set
up a private PGP keypair and share the decryption and signing subkeys among
members who are duty bound to respond to vulnerability reports.

For the publication, I usually strongly advise a simple static site that can
withstand very high traffic. I believe there is general consensus that
"toolchain.dev" is the domain to be used for CTI purposes, so something could
be published on advisories.toolchain.dev or similar.

-K