Merge ~cypressyew/ubuntu-cve-tracker:intel-5.13 into ubuntu-cve-tracker:master

[Po-Hsu Lin]

Add tracking for focal/linux-intel-5.13 kernel

Add tracking for F-intel-5.13 based on 14f96c290581

[Steve Beattie (sbeattie)]

Thanks, I've merged this despite linux-intel-5.13 not having left focal-proposed, which makes it a little annoying on our side to track (for security team members, it meant I had to add the kernel to the unpublished list in check-syntax). I did have to fix up the boilerplate to as it had incorrectly marked bionic as the release and not focal.

or entirely new kernel variants like linux-intel, there are a couple of other tools that have to be touched up that I fixed in a followup commit.

Thanks again for the merge request, I do appreciate getting notified of newly added kernel variants that we should be tracking.

review: Approve

diff --git a/active/00boilerplate.linux b/active/00boilerplate.linux
index fd27057..cfae84a 100644
--- a/active/00boilerplate.linux
+++ b/active/00boilerplate.linux
@@ -396,6 +396,16 @@ focal_linux-gkeop-5.4: DNE
 hirsute_linux-gkeop-5.4: DNE
 devel_linux-gkeop-5.4: DNE
 
+Patches_linux-intel-5.13:
+upstream_linux-intel-5.13: needs-triage
+trusty_linux-intel-5.13: DNE
+trusty/esm_linux-intel-5.13: DNE
+xenial_linux-intel-5.13: DNE
+bionic_linux-intel-5.13: needs-triage
+focal_linux-intel-5.13: DNE
+hirsute_linux-intel-5.13: DNE
+devel_linux-intel-5.13: DNE
+
 Patches_linux-oracle:
 upstream_linux-oracle: needs-triage
 trusty_linux-oracle: DNE
diff --git a/active/CVE-2021-3653 b/active/CVE-2021-3653
index 3d5a703..951ed1d 100644
--- a/active/CVE-2021-3653
+++ b/active/CVE-2021-3653
@@ -25,6 +25,7 @@ Ubuntu-Description:
  enabling AVIC in nested guest VMs. An attacker in a guest VM could use this
  to write to portions of the host's physical memory.
 Notes:
+ cascardo> trusty libvirt/qemu does not create nested capable VMs by default
 Mitigation:
  Disable nested virtualisation when loading the KVM AMD module:
     modprobe kvm_amd nested=0
@@ -38,7 +39,7 @@ Patches_linux:
  break-fix: 3d6368ef580a4dff012960834bba4e28d3c1430c 0f923e07124df069ba68d8bb12324398f4b6b709|local-CVE-2021-3653-fix
 upstream_linux: released (5.14~rc7)
 trusty_linux: ignored (out of standard support)
-trusty/esm_linux: needed
+trusty/esm_linux: ignored (ESM criteria, not a high on 3.13)
 xenial_linux: ignored (was needs-triage now end-of-life)
 esm-infra/xenial_linux: released (4.4.0-214.246)
 bionic_linux: released (4.15.0-156.163)
diff --git a/active/CVE-2021-40490 b/active/CVE-2021-40490
index b7c20dd..9b162aa 100644
--- a/active/CVE-2021-40490
+++ b/active/CVE-2021-40490
@@ -18,6 +18,7 @@ CVSS:
  nvd: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
 
 Patches_linux:
+ break-fix: f19d5870cbf72d4cb2a8e1f749dff97af99b071e a54c4613dac1500b40e4ab55199f7c51f028e848
 upstream_linux: needs-triage
 trusty_linux: ignored (out of standard support)
 trusty/esm_linux: ignored (was needs-triage ESM criteria)
diff --git a/meta_lists/package_info_overrides.json b/meta_lists/package_info_overrides.json
index 34cfb10..d0abd6b 100644
--- a/meta_lists/package_info_overrides.json
+++ b/meta_lists/package_info_overrides.json
@@ -1239,6 +1239,10 @@
         "description": "Linux hardware enablement (HWE) testing kernel",
         "title": "Linux kernel (HWE)"
     },
+    "linux-intel-5.13": {
+        "description": "Linux kernel for Intel IOTG",
+        "title": "Linux kernel (Intel IOTG)"
+    },
     "linux-joule": {
         "description": "Linux kernel for Intel Joule systems",
         "title": "Linux kernel (Intel Joule)"
diff --git a/scripts/cve_lib.py b/scripts/cve_lib.py
index c706a61..0ef60ad 100755
--- a/scripts/cve_lib.py
+++ b/scripts/cve_lib.py
@@ -221,6 +221,7 @@ kernel_srcs = set(['linux',
                    'linux-gke-5.4',
                    'linux-gkeop',
                    'linux-gkeop-5.4',
+                   'linux-intel-5.13',
                    'linux-kvm',
                    'linux-oem',
                    'linux-oem-5.4',
diff --git a/scripts/kernel_lib.py b/scripts/kernel_lib.py
index b9bfa18..d299236 100755
--- a/scripts/kernel_lib.py
+++ b/scripts/kernel_lib.py
@@ -195,6 +195,7 @@ meta_kernels.add_new_kernel('focal', ['linux-raspi2'], '-5.4.0', signed=False)
 meta_kernels.add_new_kernel('focal', ['linux-oem-5.6'], '-5.6.0')
 meta_kernels.add_new_kernel('focal', ['linux-oem-5.10'], '-5.10.0')
 meta_kernels.add_new_kernel('focal', ['linux-oem-5.13'], '-5.13.0')
+meta_kernels.add_new_kernel('focal', ['linux-intel-5.13'], '-5.13.0')
 meta_kernels.add_new_kernel('focal', ['linux-aws'], '-5.4.0', signed=False)
 meta_kernels.add_new_kernel('focal', ['linux-aws-5.8'], '-5.8.0', signed=False)
 meta_kernels.add_new_kernel('focal', ['linux-aws-5.11'], '-5.11.0', signed=False)
@@ -556,6 +557,11 @@ kernel_glitches = {
             '~': '5.13.0-1011.15',  # initial publication
         },
     },
+    'linux-intel-5.13': {
+        'focal': {
+            '~': '5.13.0-1004.4',  # initial publication
+        },
+    },
     'linux-oracle': {
         'xenial': {
             '~': '4.15.0-1008.10~16.04.1',