7.5% of kernel “CVEs” rejected on further examination

Reading this article (which seems to be an insider “please understand what we’re doing” post so presumably using the most favourable numbers), I was struck by the contrast between these two quotes:

“since we started this endeavor back in February, it has only resulted in 863 allocations out of the 16,514 commits”

“If the team agrees with the evaluation, the CVE assignment will be promptly rejected. Since the start of this endeavor, 65 such instances have occurred.”

65 / 863 is 7.5%. So even just counting the period where third parties tried to stem the tide of noise “CVEs” just asking “are you sure” in a convincing manner caused the kernel “CVE” team to concede 7.5% of their “CVEs” shouldn’t have been issued :-/ (Up thread some seem to have realised it’s a lot of work for little result to challenge these “CVE”s and stopped trying to do so.)

I get that analysing bugs for security risks is a lot of work. But the switch from “someone else should do this analysis on all bugs” (no kernel originated CVEs) to “someone else should do this analysis on all bugs that could possibly be a security risk” (many kernel originated “CVEs) doesn’t seem all that different to me. It’s still passing most of the difficult work off to “someone else”. (It’s worth noting at least one of the kernel “CVE” team is paid by the Linux Foundation to work on the kernel for the broader community good. And is still choosing to insist “someone else” should do the work of analysing the real risk, while they just keep adding to the “to do” list.)

Ewen