15780 2025-03-04 19:55:06 +0000 cve-check.bbclass reports CVE-2023-3079 against kernel 2025-05-20 16:53:32 +0000 1 1 7 Build System, Metadata & Runtime OE-Core core 5.2 x86 Multiple RESOLVED FIXED Medium+ normal 5.3 M1 1 pokylinux randy.macleod meta.mr.watcher meta.watcher randy.macleod ross.burton --- --- Don't know oldest_to_newest 101278 0 pokylinux 2025-03-04 19:55:06 +0000 linux-yocto-custom CVE-2023-3079 0.0 8.8 Unpatched https://nvd.nist.gov/vuln/detail/CVE-2023-3079 https://nvd.nist.gov/vuln/detail/CVE-2023-3079: Description Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) That's Chrome and not kernel. 101302 1 randy.macleod 2025-03-06 15:41:11 +0000 Add to recipe as a skip, not applicable since the very complicated. 101305 2 ross.burton 2025-03-06 15:47:36 +0000 For reference, the CPE says: Affects cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* So affects all Linux systems, Running on/with cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* I can't see a sensible way of handling this as the kernel recipe doesn't know if chrome is being used, and in this specific case it's entirely a chrome issue. You could argue with NVD about that CPE, but the easy fix is to explicitly CVE_STATUS it away. 101969 3 randy.macleod 2025-05-15 19:06:21 +0000 Patch sent: https://lore.kernel.org/openembedded-core/20250515190523.1014417-1-Randy.MacLeod@windriver.com/T/#u 102001 4 randy.macleod 2025-05-20 16:53:32 +0000 Fix merged: https://git.openembedded.org/openembedded-core/commit/?id=22ef4d2d116afb9d603a05fb107dd9da0e74558b