msm_be.bb: Add CVE_PRODUCT and CVE_VERSION variables - #153
markyang92 wants to merge 1 commit into
Conversation
e8513b5 to
a50ffd5
Compare
|
|
||
| RPROVIDES:${PN} += "virtual/libgbm" | ||
|
|
||
| CVE_PRODUCT = "mesa" |
There was a problem hiding this comment.
It uses Mesa, but it's not Mesa itself. Vulnerabilities (or the lack of them) from Mesa don't apply the the msm backend.
There was a problem hiding this comment.
Thanks for the review!
If I understand the recipe correctly, it builds mesa-24.0.7 itself rather than just using it
SRC_URI fetches the upstream mesa.freedesktop.org tarball, and the libgbm.so / msm_gbm.so
installed on target are built from that source tree. Please let me know if I'm missing something.
There was a problem hiding this comment.
Indeed. I confused it with the recipe from the later branch. Then please define 24.0.7 as a variable at the top, use it throuh the code and then here.
There was a problem hiding this comment.
Thanks for taking another look! Defined MESA_VERSION at the top and used it for SRC_URI, S and CVE_VERSION. Please let me know if there's anything else you'd like changed.
Since msm uses mesa version 24.0.7, add CVE_PRODUCT and CVE_VERSION
variables to facilitate vulnerability management.
Previously, CVE_PRODUCT was recognized as msm and the version as be in
cpe, which caused false positives in sbom-cve-check as follows:
{
"id": "CVE-2023-33284",
"status": "Patched",
"link": "https://nvd.nist.gov/vuln/detail/CVE-2023-33284",
"summary": "Marval MSM through 14.19.0.12476 and 15.0 has a Remote Code Execution vulnerability. A remote attacker authenticated as any user is able to execute code in context of the web server.",
"scorev2": "0.0",
"scorev3": "8.8",
"scorev4": "0.0",
"modified": "2026-06-17T06:01:29.000",
"vector": "NETWORK",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"detail": "version-not-in-range: Only affects 15.0 onwards"
}
],
"cpes": [
"cpe:2.3:*:*:msm:be:*:*:*:*:*:*:*"
]
Signed-off-by: mark.yang <mark.yang@lge.com>
a50ffd5 to
13fbe34
Compare
2 participants
Since msm uses mesa version 24.0.7, add CVE_PRODUCT and CVE_VERSION variables to facilitate vulnerability management.
Previously, CVE_PRODUCT was recognized as msm and the version as be in cpe, which caused false positives in sbom-cve-check as follows:
{
"id": "CVE-2023-33284",
"status": "Patched",
"link": "https://nvd.nist.gov/vuln/detail/CVE-2023-33284",
"summary": "Marval MSM through 14.19.0.12476 and 15.0 has a Remote Code Execution vulnerability. A remote attacker authenticated as any user is able to execute code in context of the web server.",
"scorev2": "0.0",
"scorev3": "8.8",
"scorev4": "0.0",
"modified": "2026-06-17T06:01:29.000",
"vector": "NETWORK",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"detail": "version-not-in-range: Only affects 15.0 onwards"
}
],
"cpes": [
"cpe:2.3:::msm:be:::::::*"
]