What Greg Kroah-Hartman thinks about cybersecurity
Linux kernel maintainer; runs the stable kernel releases and maintains the USB and driver core subsystems.
Greg Kroah-Hartman did not write this page.
We collected these quotes from things they published elsewhere, and every quote links to where it was said. They have no account here and have not endorsed this site. Quotes are word for word; the short line under each one is our own restatement, not their wording. Their own site. Is this you? Claim it or ask us to remove it. Or tell us what is wrong here.
Filter cybersecurity · Newest first
Only Greg Kroah-Hartman on cybersecurity. See everyone on cybersecurity
7 dated positions, 2018 to 2026, in their own words. Our reading of what Greg Kroah-Hartman has said — not written or endorsed by them.
-
Their wordsPersonally, I think that filesystem corruption or data loss bug fixes should be considered a CVE fix, but until cve.org changes their policy, we can not assign CVEs for those types of fixes.
↗Linux CVE assignment processkroah.com 1st of 3 in this piece
-
Their wordsSo any group that attempts to give a "severity score" to a Linux CVE is lying to you, UNLESS they know exactly your use case.
↗Linux CVE assignment processkroah.com 2nd of 3 in this piece
-
Our readingNIST/NVD's assignment of CVSS scores to vulnerabilities provides a false sense of security.
Their wordsALWAYS ignore any attempt that groups such as NIST/NVD that purport to assign things like CVSS scores to a vulnerability. Those numbers are false and give companies a "fake sense of security".
↗Linux CVE assignment processkroah.com 3rd of 3 in this piece
- 6 weeks earlier
-
Their wordsThis arrangement has allowed the kernel security team to remain independent and continue to operate across the different governments that the members operate in, and it looks to become the normal way project security teams work with the advent of the European Union's new CRA law coming into affect which places requirements on response time of companies that receive notice of potential security issues in their projects.
-
Their wordsAs history has shown us with Spectre and Meltdown, this "no embargo" policy does not always work well when working with problems that cross operating systems and hardware platforms, possibly requiring firmware or microcode updates.
- 4 weeks earlier
-
Their wordsdocument a way that people can track CVE assignments on their own in a format that is, in my opinion, much simpler than attempting to rely on the CVE json format (and don't get me started on NVD...)
- 7 years earlier
-
Their wordsThese kernels are not to be used in any type of "general computing" model where you have untrusted users or virtual machines, as the ability to do some of the recent Spectre-type fixes for older releases is greatly reduced, if present at all in some branches.
↗What Stable Kernel Should I Usekroah.com 2nd of 3 in this piece