再保险:硬件/软件vulns - gpu的一个例子

最新的脆弱性的定义将以下来自CNA规则附录A。http://cve.mitre.org/cve/cna/CNA_Rules_v1.1.pdf“脆弱性CVE的程序的上下文中定义的计算规则,列在附录c。一般来说,一个漏洞的定义是一个弱点在计算逻辑(例如,代码)中发现的软件和硬件组件,当利用,导致保密造成负面影响,完整性,或可用性。缓解在这种情况下通常涉及修改代码的漏洞,但也可能包括规范变化甚至规范不支持(例如,删除受影响的协议或功能全部)”。If we decide to move forward, it would appear that this definition covers us for hardware-specific vulnerabilities. Does anyone think differently or believe that it needs significant changes? The counting rules themselves would likely need some tweaks as we refer to code and software in a few places. For example, CNT2.2A refers to the above definition and would not need to be changed, but CNT2.2B states "software" specifically. We also would need to change the Inclusion decisions to either tweak INC3 in regards to customer-controlled software, or add a new decision that would be inclusive of hardware. Regards, Chris -----Original Message----- From: owner-cve-editorial-board-list@lists.mitre.org [mailto: owner-cve-editorial-board-list@lists.mitre.org马尼恩的艺术代表发送:周四,7月13日2017 11:57点到:米勒,托马斯< Thomas.Millar@hq.dhs.gov >;kseifried@redhat.com;肯特Landfield < bitwatcher@gmail.com > Cc: Kurt Seifried < kurt@seifried.org >;cve-editorial-board-list < cve-editorial-board-list@lists.mitre.org >主题:Re:硬件/软件的一个例子vulns - gpu 7/13/17福音11:24,米勒,托马斯写道:>我认为我的主要目标在一个类别的硬件漏洞>覆盖了CVE只会是确保制造或设计>问题不能解决完全有信心通过列举>软件>改变安全团队可以知道他们有>问题需要装货发票妥善解决,所以>说话。是的,如果我必须更换硬件/硅完全移除一个漏洞,这应该得到一个CVE ID。或者,而不是取代我保持(严格)脆弱的硬件,但应用微码/固件,减轻了脆弱性——CVE ID。我相信当前计数规则允许,库尔特,你不同意吗?我们需要改变计数规则吗?——艺术