[PATCH] ci: Add job to check if all mentioned CVEs have corresponding git tags
From: Peter Krempa <pkrempa@redhat.com> Introduce a job which will run with the scheduled libvirt pipeline runs which will check if all CVEs mentioned in the git commit messages, NEWS entries and for all libvirt security notices published at https://security.libvirt.org have corresponding git tags. Since git commit messages do sometimes mention CVE not related to libvirt, the '.cve_exceptions' file lists allows to add overrides. Since the upstream repository has signed tags, the tagging is done by Jirka, so it doesn't make sense to run this check inside the checkout or as a regular CI pipeline run, so it's implemented directly in the CI job rather than as a standalone tool. The job also creates an artifact containing all tagged CVEs in the repository. This can later be used e.g. to see which CVEs are missing a libvirt security notice. Signed-off-by: Peter Krempa <pkrempa@redhat.com> --- .cve_exceptions | 46 +++++++++++++++++++++++++++++++++++++++++++++ .gitlab-ci.yml | 50 +++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 96 insertions(+) create mode 100644 .cve_exceptions In order for this to pass the following CVEs need to be tagged (the order of the commit IDs is as 'git log' shows): commitlog CVE-2026-15268 f74495c7a157618e3df6fa61079678084c4cc685 CVE-2026-18917 5a62cbf2907d4590283597b46da9c0f41e7b4d4f CVE-2026-61477 3cfc77963b512d809348fca07f97fe924fac9a05 cb8974b923e3c40cde96f0c7bceaa638f7f9c72b 289ffa796d737a79a4c05d07232ebd75def9a12a d44836a1dc6771ac22f69755fc69bf730f0eec87 CVE-2026-61478 68da70aae766c6271b8d3b466374d3cc7d1a8afb CVE-2026-63622 801160fd414ca2cc402bc01ead09b7ed4c3b8f5b CVE-2026-63623 69335a484768d550854da1133d5490074695e825 News CVE-2021-4147 5c5df5310f72be4878a71ace47074c54e0d1a27d security.libvirt.org CVE-2009-0036 be33b189a5e579509b5025d72b7f283401ef9dc1 CVE-2010-2237 68719c4bddb85fbcc931a5b7d99ac7c8a0af09b0 CVE-2010-2239 187da82fea598aa017bdfc82a1622f9c8d75ee74 CVE-2016-10746 506e9d6c2d4baaf580d489fff0690c0ff2ff588f CVE-2019-20485 d61f95cf6a6fbd564e104c168d325581acd9cd8d 4cc90c2e62df653e909ad31fd810224bf8bcf913 d9605abed68af4b65c4e04386346a2fd372d7ab9 95f5ac9ae52455e9da47afc95fa31c9456ac27ae 1cb8bc52c1035573a0c1a87f724a6c7dfee82f12 0a9893121187c0c3f9807e9164366e1f6977619c a663a860819287e041c3de672aad1d8543098ecc e005c95f56fee9ed780be7f8db103d690bd34cbd CVE-2019-3840 7cfd1fbb1332ae5df678b9f41a62156cb2e88c73 CVE-2020-10703 dfff16a7c261f8d28e3abe60a47165f845fa952f CVE-2020-14301 a5b064bf4b17a9884d7d361733737fb614ad8979 CPU CVE (covered by LSNs) CVE-2017-5715 6d4a3cd42781babed7d29b061e220ebff24dd43e 6b7e7d1cc24a28a9f5ece8626f807189647d14b4 2e3b220a874e558e54678afd7cf49466fe605e09 30b381cfdd5e92e5afa6de09f0fe533353e71d07 203c92e9cc2db854199b39ef3ffcc10406d3c59e 7dd85ff62d7080b52d4d175f53ad5eb11cdcfb9c 7f83eefa9e6940c83579d31941efd07fab1b90c8 49bffcb3cc1850d332b9648c686a7be18de9e708 7bb4ce9761dfbd1620ddffb26fbd6f0ff1fedf3f b2042020c32b74069fa5365b5e966537aaba8cf6 24d504396c3c05eff87d29173a224e2faaeb2637 CVE-2018-3639 9267342206ce17f6933d57a3128cdc504d5945c9 1dbca2eccad58d91a5fd33962854f1a653638182 CVE-2019-11135 f411b7ef68221e82dec0129aaf2f2a26a8987504 07aaced4e6ea6db8b27f44636f51cafa6f1847a8 diff --git a/.cve_exceptions b/.cve_exceptions new file mode 100644 index 0000000000..335085e1bd --- /dev/null +++ b/.cve_exceptions @@ -0,0 +1,46 @@ +This file contains CVE IDs mentioned in either the commit log or the NEWS which +are not actually CVEs in libvirt and is used for the sanity check ensuring that +we have git tags for all CVE patches. + +This file can contain any other text explaining given CVE as it's filtered for +just CVE ids for matching. + +Commit messages mention the following non-libvirt CVEs: + + - CVE-2011-4127: Kernel privilege escalation via SG_IO + + Mentioned as justification to introduce new disk access mode 'lun' + + - CVE-2012-3386: GNU Automake granting world-writable permissions to extraction directory + + Mentioned as justification for fixing a syntax check failure. + + - CVE-2013-0242: Buffer overflow in glibc's regexec code + + gnulib update + + - CVE-2013-4288: race condition in polkit allowing bypass of restrictions + + The libvirt patch references the required pokit fix + + - CVE-2014-6458: unspecified vulnerability in Oracle Java + + mentioned by mistake, same CVE id from 2013 was intended + + - CVE-2022-24765: git for windows safe directory handling + + CI needed to adapt to this fix + +Libvirt adjecent CVEs: + - CVE-2020-15708: libvirtd.sock being configured as world-writable + + This was a packaging/deployment bug in Ubuntu 20.10 allowing anyone access + the system connection as they shipped default socket permissions. Libvirt + later changed the default to harden against this + +The following CVEs mentioned in our NEWS or commitlog are referencing CPU bugs +that libvirt covered but didn't publish a LSN for: + - CVE-2018-12126: Microarchitectural Store Buffer Data Sampling (MSBDS) + - CVE-2018-12127: Microarchitectural Fill Buffer Data Sampling (MFBDS) + - CVE-2018-12130: Microarchitectural Load Port Data Sampling (MLPDS) + - CVE-2019-11091: Microarchitectural Data Sampling Uncacheable Memory (MDSUM) diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 04bfef8ed7..7121248f7b 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -173,3 +173,53 @@ coverity: - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "schedule" && $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH' when: on_success - when: never + +# Check that we have CVE git tags for CVEs mentioned in commit messages and NEWS +# and expose the list of CVE tags +cve_tags: + image: $CI_REGISTRY/$RUN_UPSTREAM_NAMESPACE/libvirt/ci-$NAME:latest + variables: + NAME: almalinux-9 + GIT_STRATEGY: clone + GIT_DEPTH: "" + stage: sanity_checks + needs: + - job: x86_64-almalinux-9-container + optional: true + artifacts: false + rules: + - if: $CI_PIPELINE_SOURCE == "schedule" + when: always + - when: never + script: + # fetch list of git tags and exceptions + - git tag | grep -o 'CVE-[0-9]\+-[0-9]\+' > cve-tags + - grep -o 'CVE-[0-9]\+-[0-9]\+' .cve_exceptions > cve-allowed-exceptions + - sort -u cve-tags cve-allowed-exceptions > cve-allowed + # lookup CVE ids in 'git-log' + - git log | grep -o '[Cc][Vv][Ee]-[0-9]\+-[0-9]\+' | sort -u > cves-found-log + - comm -2 -3 cves-found-log cve-allowed > cves-missing-tags-log + # lookup CVE ids in 'NEWS.rst' + - grep -o '[Cc][Vv][Ee]-[0-9]\+-[0-9]\+' NEWS.rst | sort -u > cves-found-news + - comm -2 -3 cves-found-news cve-allowed > cves-missing-tags-news + # lookup CVE ids in index of security notices + - curl -fsSL https://security.libvirt.org/index.xml | grep -o 'CVE-[0-9]\+-[0-9]\+' | sort -u > cves-found-notices + - comm -2 -3 cves-found-notices cve-allowed > cves-missing-tags-notices + - if [ -s cves-missing-tags-log ] || [ -s cves-missing-tags-news ] || [ -s cves-missing-tags-notices ]; + then + echo "Following CVE's are either missing a git tag or an exception in '.cve_exceptions:"; + echo "Source 'git log'"; + cat cves-missing-tags-log; + echo "Source 'NEWS.rst'"; + cat cves-missing-tags-news; + echo "Source 'security.libvirt.org/index.xml'"; + cat cves-missing-tags-notices; + false; + fi + artifacts: + expose_as: 'CVE tags' + name: 'cve_tags' + when: always + expire_in: 30 days + paths: + - cve-tags -- 2.55.0
On Tue, Aug 25, 2026 at 16:05:39 +0200, Peter Krempa via Devel wrote:
From: Peter Krempa <pkrempa@redhat.com>
Introduce a job which will run with the scheduled libvirt pipeline runs which will check if all CVEs mentioned in the git commit messages, NEWS entries and for all libvirt security notices published at https://security.libvirt.org have corresponding git tags.
Since git commit messages do sometimes mention CVE not related to libvirt, the '.cve_exceptions' file lists allows to add overrides.
Since the upstream repository has signed tags, the tagging is done by Jirka, so it doesn't make sense to run this check inside the checkout or as a regular CI pipeline run, so it's implemented directly in the CI job rather than as a standalone tool.
The job also creates an artifact containing all tagged CVEs in the repository. This can later be used e.g. to see which CVEs are missing a libvirt security notice.
Signed-off-by: Peter Krempa <pkrempa@redhat.com> --- .cve_exceptions | 46 +++++++++++++++++++++++++++++++++++++++++++++ .gitlab-ci.yml | 50 +++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 96 insertions(+) create mode 100644 .cve_exceptions
This is how the pipeline result looks when it picks up something that needs to be tagged: https://gitlab.com/pipo.sk/testlibvirt/-/jobs/16094064680
In order for this to pass the following CVEs need to be tagged (the order of the commit IDs is as 'git log' shows):
And after this list of commits is tagged successful result: https://gitlab.com/pipo.sk/testlibvirt/-/jobs/16094536454
On a Tuesday in 2026, Peter Krempa via Devel wrote:
From: Peter Krempa <pkrempa@redhat.com>
Introduce a job which will run with the scheduled libvirt pipeline runs which will check if all CVEs mentioned in the git commit messages, NEWS entries and for all libvirt security notices published at https://security.libvirt.org have corresponding git tags.
Since git commit messages do sometimes mention CVE not related to libvirt, the '.cve_exceptions' file lists allows to add overrides.
Since the upstream repository has signed tags, the tagging is done by Jirka, so it doesn't make sense to run this check inside the checkout or as a regular CI pipeline run, so it's implemented directly in the CI job rather than as a standalone tool.
The job also creates an artifact containing all tagged CVEs in the repository. This can later be used e.g. to see which CVEs are missing a libvirt security notice.
Signed-off-by: Peter Krempa <pkrempa@redhat.com> --- .cve_exceptions | 46 +++++++++++++++++++++++++++++++++++++++++++++ .gitlab-ci.yml | 50 +++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 96 insertions(+) create mode 100644 .cve_exceptions
Reviewed-by: Ján Tomko <jtomko@redhat.com> Jano
participants (2)
-
Ján Tomko -
Peter Krempa