Merge ~rodrigo-zaiden/ubuntu-cve-tracker:kernel_cna_cves_usn into ubuntu-cve-tracker:master

[Rodrigo Figueiredo Zaiden]

scripts: kernel: add automation to generate kernel USN

 adding a new parameter: '--kernel-cna-cves' that, when used, will automatically
 find which CVEs where published by the Kernel CNA and will generate a standard
 paragraph for the USN based on the affected subsystems in the Linux kernel based
 on the fix commits for each CVE.

When the Kernel CNA started to publish Linux Kernel CVEs, we noticed that a
big amount of new CVEs are coming each day. With that, it is much harder to
keep track of the USN descriptions as we were used to.

So, the idea with this series of commits, is that, when we want to generate
a Kernel USN with the script 'prepare-kenel-usn.py' we can now use the
argument '--kernel-cna-cves' that will go over the CVEs that would be included
in the Kernel USN and will check which were published by the Kernel CNA and will
add a standard paragraph will the affected subsystems.
It sounds like:

   Several security issues were discovered in the Linux kernel.
   An attacker could possibly use these to compromise the system.
   This update corrects flaws in the following subsystems:
      - Architecture specifics;
      - Block layer;
      - ACPI drivers;
      ....

A few more detailed information on how it works in this proposal:
- It starts with passing '--kernel-cna-cves' to 'prepare-kenel-usn.py', like:
    ./scripts/prepare-kernel-usn.py -d -n -p Proposed --kernel-cna-cves jammy jammy/linux-oem-6.1: 6.1.0-1035.3

- It them invokes the 'sis-generate-usn' script passing along the argument
  --kernel-cna-cves, that will do the most importants checks:
  1) it check which CVEs that were found being fixed in this kernel release
     were published by the Kernel CNA by trying to verify if the CVE file exists
     in the https://git.kernel.org/pub/scm/linux/security/vulns.git/ repository.
     It checks locally if the repository is cloned (more information on that
     was added to README.linux) and if it does not find it locally it checks
     on the repository online: the local repository could be outdated, or it
     really does not exist. This is implemented in cve_lib.py in the method
     is_kernel_cna_cve().

  2) it them checks which are the fix commits for the CVEs, implemented in
     cve_lib.py in method get_kernel_break_fix()

  3) it finally look for the affected subsystems based on the fix commit on a
     kernel repository local tree. If the repo is not found, it returns an error.
     This is in cve_lib.py in method get_affected_subsystems().

  With the affected subsystems in hand, it generated the paragraph with the
  template above. In get_affected_subsystems() there is a mapping for the
  subsystem paths based on the kernel hierarchy that translates the directory
  into human readable/understandable topics.

A way to run this for current kernels is:
./scripts/prepare-kernel-usn.py -d -n -p Security --ignore-released-cves-in-changelog --kernel-cna-cves jammy jammy/linux-oem-6.1: 6.1.0-1035.35 --add CVE-2023-46838 --add CVE-2023-50431 --add CVE-2023-52436 --add CVE-2023-52438 --add CVE-2023-52439 --add CVE-2023-52443 --add CVE-2023-52444 --add CVE-2023-52445 --add CVE-2023-52447 --add CVE-2023-52448 --add CVE-2023-52449 --add CVE-2023-52451 --add CVE-2023-52454 --add CVE-2023-52456 --add CVE-2023-52457 --add CVE-2023-52458 --add CVE-2023-52462 --add CVE-2023-52463 --add CVE-2023-52464 --add CVE-2023-52467 --add CVE-2023-52469 --add CVE-2023-52470 --add CVE-2023-5633 --add CVE-2023-6610 --add CVE-2024-0340 --add CVE-2024-1085 --add CVE-2024-1086 --add CVE-2024-23849 --add CVE-2024-24860 --add CVE-2024-26581 --add CVE-2024-26588 --add CVE-2024-26589 --add CVE-2024-26591 --add CVE-2024-26592 --add CVE-2024-26594 --add CVE-2024-26597 --add CVE-2024-26598 --add CVE-2024-26599 --add CVE-2024-26600 --add CVE-2024-26601 --bypass-usn-check

or, check the pastebins to see how the script is outputing in stdout and in the USN bash for the above command:
prepare-kernel-usn log: https://pastebin.canonical.com/p/WxS4TqdXQx/
USN bash script: https://pastebin.canonical.com/p/5dhcf83xCx/

[Alex Murray (alexmurray)]

This sounds like a great quality-of-life improvement for doing kernel USNs - I wonder though if instead of hard-coding the mapping of subsystem paths to descriptions, whether you could use the contents of MAINTAINERS (via ./scripts/get_maintainer.pl --subsystem -f $path) and then fallback to this if needed?

2d50af1... by Rodrigo Figueiredo Zaiden on 2024-03-15

scripts/cve_lib.py: make use of read_uct_config

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

35a5c02... by Rodrigo Figueiredo Zaiden on 2024-03-15

scripts/cve_lib.py: improve get_kernel_break_fix

 break-fix commits can be in a variety of formats that were not being
 considered, besides not filtering out '-' that is used when there is
 no specific commit for either the break or fix commit.

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

[Rodrigo Figueiredo Zaiden (rodrigo-zaiden)]

Hi Alex,

> This sounds like a great quality-of-life improvement for doing kernel USNs - I
> wonder though if instead of hard-coding the mapping of subsystem paths to
> descriptions, whether you could use the contents of MAINTAINERS (via
> ./scripts/get_maintainer.pl --subsystem -f $path) and then fallback to this if
> needed?

I really like your idea, I think that we could get ride of the hard-coding style
and move to a better way. I've tried a few things outside of this tree in order
to find a way of using the get_maintainer.pl that I'd like to ask your review,
if possible, please.

The suggestion is in this standalone python file that can be ran outside of
the tree without any inputs:
https://pastebin.canonical.com/p/jyKc8mVw3q/

The output for it is at:
https://pastebin.canonical.com/p/jBc5vVvQQX/

Mainly, I'm running the get_maintainer as:
 ./scripts/get_maintainer.pl --subsystem --sections -f $file_path
and filtering out every line that is not a subsystem

What is not really nice:
- It is not yet ordered by kernel tree hierarchy;
- We have a few "subsystems" that are not really useful like "BPF", "NETWORKING"
  that are part of the output because I'm getting everything from the
  'get_maintainer' besides "THE REST"
- It is a bit slow;

Do you like this output style or/and have other suggestions, please?
Really appreciate it.
Thank you very much!

fa7076b... by Rodrigo Figueiredo Zaiden on 2024-03-26

scripts/cve_lib.py: move linux_kernel_path verification

 the linux_kernel_path config verification was inside the interation
 when I was trying to implement a second stage verification that would
 check for the commit online, but as this approach was dropped we can
 check it once before running through the commits.

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

b265fe6... by Rodrigo Figueiredo Zaiden on 2024-03-26

scripts/cve_lib.py: handle git command errors

 make use of the cmd() method defined in cve_lib and add handle for
 possible git errors.

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

bb96afc... by Rodrigo Figueiredo Zaiden on 2024-04-02

scripts/cve_lib.py: add more subsystems

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

[Mark Esler (eslerm)]

This looks great.

The points you raised about an ordered hierarchy and useful subsystem would be nice. Maybe those could be solved together?

Personally, I'm trying to move code out of cve_lib.py. Perhaps that's not called for here or others on the team want to extend cve_lib. A kernel_cve.py or similarly named script might be an easier way to maintain helper functions for parsing kernel cve data.

[Steve Beattie (sbeattie)]

Apologies, I haven't look at the details of the merge proposal very closely.

Using get_maintainer.pl would be ideal, and perhaps you'd wnat to use something like following to simplify parsing the output:

  ./scripts/get_maintainer.pl --separator ':' --subsystem [...]

so that the subsystems are all on one line, and then pulling out the first entry, to get the most specific subsystem.

My concern with this approach is that it might turn out to be like how we end up writing descriptions for source pacakges in our USNs via the package_info_overrides.json file, because the description summaryies in the debian pacakges are not always ina state usable for general public consumption. My experiments with some sample files are okay, but there are things like:

$ ./scripts/get_maintainer.pl --separator ':' --subsystem drivers/md/dm-ioctl.c | tail -1
DEVICE-MAPPER (LVM):THE REST

and

$ ./scripts/get_maintainer.pl --separator \; --subsystem -f drivers/net/dsa/vitesse-vsc73xx-core.c | tail -1
NETWORKING [DSA];NETWORKING DRIVERS;THE REST

so at a minimum, we might want an override mechanism anyway.

[Steve Beattie (sbeattie)]

(sorry, in my examples, I switched up the separators due to experimenting with different ones in my shell history.)

629b8cc... by Rodrigo Figueiredo Zaiden on 2024-04-05

scripts/cve_lib.py: make load json file overrides more generic

 with the idea of using the method with other json files, this commit
 renames 'load_package_info_overrides' to 'load_json_file_overrides'

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

a375e3f... by Rodrigo Figueiredo Zaiden on 2024-04-05

scripts/cve_lib.py: move hardcode mapping to json file

 instead of using a hardcode mapping, it seems better to use a json
 file with the overrides, like we do for package names and titles,
 seems easier to view and cleaner to maintain.

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

a461e5f... by Rodrigo Figueiredo Zaiden on 2024-04-05

scripts/cve_lib.py: trust that linux_cna_tracker is updated

 for the sake of performance, instead of falling back to a online search
 every time a CVE is not found in the kernel cna repo tracker, only
 fallback if the repository itself is not found.
 we will trust that the local repository is updated.

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

[Rodrigo Figueiredo Zaiden (rodrigo-zaiden)]

Hi Mark,
> This looks great.
>
> The points you raised about an ordered hierarchy and useful subsystem would be
> nice. Maybe those could be solved together?
>

I'm having a few issues with the get_maintainer approach that I'll share and
propose a solution in another comment.

> Personally, I'm trying to move code out of cve_lib.py. Perhaps that's not
> called for here or others on the team want to extend cve_lib. A kernel_cve.py
> or similarly named script might be an easier way to maintain helper functions
> for parsing kernel cve data.

This is actually a good idea, I started working with 'kernel_lib.py' but decided
to move to 'cve_lib.py' as 'kernel_lib.py' is not really for CVEs but more for
kernel versions. but I didn't think of using a new 'kernel_cve.py' where we
could keep kernel CVE related matters. I'll just finish this round of updates
and will try this suggestion, thanks for it.

[Rodrigo Figueiredo Zaiden (rodrigo-zaiden)]

General Notes:
I'm personally inclined to vote for us to move out of the usage of
get_maintainer.pl to generate the list of affected subsystem for two reasons:

1) performance: this would be the main reason. unless, we can find a different
approach on how to run the 'get_maintainer.pl' script, it is proving to be
too much slow to get the subsystem information for each file on each commit.
I have examples of time constrains below.

2) quality of text: don't really know how to name this, but I'm not in favor of
having something like "EDAC-CAVIUM THUNDERX" and "EDAC-CORE" (as the result of
get_maintainer.pl for "drivers/edac/thunderx_edac.c") where we could instead
have "EDAC drivers" (for "drivers/edac/").

So, in the end, I personally don't think maintaining the hardcode bits is that
big of an issue. Considering that, from now on the idea is that the Kernel CNA
will be assigning most of the kernel CVEs, we would be moving from writing USN
descriptions to writing hierarch descriptions...

One thing that I'm proposing with the next commits is to move from a hardcode
mapping to a json meta file as a result of an input from Steve's comment
earlier.

Testing:
I've put together a better scenario for testing both approaches:

# move to my branch:
 $ git remote add rodrigo-zaiden git+ssh://<email address hidden>/~rodrigo-zaiden/ubuntu-cve-tracker
 $ git checkout rodrigo-zaiden/kernel_cna_cves_usn

# standalone script using get_maintainer.pl with:
 ./scripts/get_maintainer.pl --separator ':' --subsystem -f <file path>
https://pastebin.canonical.com/p/sGTN76wDN3/

 $ time python3 test-kernel_cna.py
 ...
  - ARM/FREESCALE IMX / MXC ARM ARCHITECTURE;
  - ARM64 PORT (AARCH64 ARCHITECTURE);
  - BLOCK LAYER;
  - BLUETOOTH SUBSYSTEM;
  - BPF JIT for LOONGARCH;
  - BPF [CORE];
  - BPF [GENERAL] (Safe Dynamic Programs and Tools);
 ...
 real 0m36,722s
 user 0m33,750s
 sys 0m2,888s

full results: https://pastebin.canonical.com/p/bprVtW7gb5/

# standalone script using json meta file:
https://pastebin.canonical.com/p/KFQRFpNdXG/

 $ time python3 test_kernel-cna-overrides.py
 ...
   - EDAC drivers;
   - GPU drivers;
   - Media drivers;
   - Multifunction device drivers;
   - MTD block device drivers;
 ...
 real 0m0,963s
 user 0m0,849s
 sys 0m0,113s

full results: https://pastebin.canonical.com/p/BV2qYc66tr/

[Alex Murray (alexmurray)]

Thanks for investigating the get_maintainer.pl approach - it's a shame it was so unwieldy in practice and IMO day-to-day usability trumps maintainership - ie. so the json overrides approach sounds like the better option. LGTM!

review: Approve

3a5fdde... by Rodrigo Figueiredo Zaiden on 2024-04-12

meta_lists/kernel_paths_overrides.json: add more subsystems

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

831742f... by Rodrigo Figueiredo Zaiden on 2024-04-16

scripts/kernel: move kernel-cna-cves methods to kernel_lib

 after a reconsideration, it would be better to start moving the kernel
 related methods to kernel_lib instead of over populating cve_lib.
 there is a few other methods related to kernel in cve_lib that should
 be moved later, for now, moving only the ones related to the new
 argument, --kernel-cna-cves.

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

5d86515... by Rodrigo Figueiredo Zaiden on 2024-04-16

scripts/test_kernel_lib.py: add tests for kernel cna cves methods

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

2a1444a... by Rodrigo Figueiredo Zaiden on 2024-04-16

scripts/kernel_lib.py: add directory fallback

 while running the tests, noticed that the subsequent tests after
 the kernel ones were failing because the directory was being moved
 elsewhere. added a chdir to go back to the previous and added a test
 for the failure code path.

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

8031869... by Rodrigo Figueiredo Zaiden on 2024-04-16

scripts/test_kernel_lib.py: add condition to skip test

 if there is not configuration for the linux kernel tree, we should
 skip testing. that would be the case mainly for the servers, or,
 having the linux kernel tree would be the case only for local runs.
 not sure if that is something we could mock, don't really think so.

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

Unmerged commits

8031869... by Rodrigo Figueiredo Zaiden on 2024-04-16

scripts/test_kernel_lib.py: add condition to skip test

 if there is not configuration for the linux kernel tree, we should
 skip testing. that would be the case mainly for the servers, or,
 having the linux kernel tree would be the case only for local runs.
 not sure if that is something we could mock, don't really think so.

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

	unit-tests:0 (build)
	check-cves:0 (build)

1 → 2 of 2 results

First • Previous • Next • Last

2a1444a... by Rodrigo Figueiredo Zaiden on 2024-04-16

scripts/kernel_lib.py: add directory fallback

 while running the tests, noticed that the subsequent tests after
 the kernel ones were failing because the directory was being moved
 elsewhere. added a chdir to go back to the previous and added a test
 for the failure code path.

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

5d86515... by Rodrigo Figueiredo Zaiden on 2024-04-16

scripts/test_kernel_lib.py: add tests for kernel cna cves methods

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

831742f... by Rodrigo Figueiredo Zaiden on 2024-04-16

scripts/kernel: move kernel-cna-cves methods to kernel_lib

 after a reconsideration, it would be better to start moving the kernel
 related methods to kernel_lib instead of over populating cve_lib.
 there is a few other methods related to kernel in cve_lib that should
 be moved later, for now, moving only the ones related to the new
 argument, --kernel-cna-cves.

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

3a5fdde... by Rodrigo Figueiredo Zaiden on 2024-04-12

meta_lists/kernel_paths_overrides.json: add more subsystems

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

a461e5f... by Rodrigo Figueiredo Zaiden on 2024-04-05

scripts/cve_lib.py: trust that linux_cna_tracker is updated

 for the sake of performance, instead of falling back to a online search
 every time a CVE is not found in the kernel cna repo tracker, only
 fallback if the repository itself is not found.
 we will trust that the local repository is updated.

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

a375e3f... by Rodrigo Figueiredo Zaiden on 2024-04-05

scripts/cve_lib.py: move hardcode mapping to json file

 instead of using a hardcode mapping, it seems better to use a json
 file with the overrides, like we do for package names and titles,
 seems easier to view and cleaner to maintain.

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

629b8cc... by Rodrigo Figueiredo Zaiden on 2024-04-05

scripts/cve_lib.py: make load json file overrides more generic

 with the idea of using the method with other json files, this commit
 renames 'load_package_info_overrides' to 'load_json_file_overrides'

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

bb96afc... by Rodrigo Figueiredo Zaiden on 2024-04-02

scripts/cve_lib.py: add more subsystems

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

b265fe6... by Rodrigo Figueiredo Zaiden on 2024-03-26

scripts/cve_lib.py: handle git command errors

 make use of the cmd() method defined in cve_lib and add handle for
 possible git errors.

Signed-off-by: Rodrigo Figueiredo Zaiden <email address hidden>

diff --git a/README.linux b/README.linux
index 48dae64..ca1ec75 100644
--- a/README.linux
+++ b/README.linux
@@ -58,12 +58,16 @@ common ones are the
 - [Debian's kernel security tracker][debian-kernel]
 - Nicholas Leudtke's [linux github tracker][linux-github]
 
-The latter two can be configured as references in
+The three of them can be configured as references in
 `~/.ubuntu-cve-tracker.conf` for use with tools, via the
-`debian_kernel_cve_tracker` and `linux_kernel_cve_tracker` variables
-respectively. An example:
+`linux_cna_tracker`, `debian_kernel_cve_tracker` and
+`linux_kernel_cve_tracker` variables respectively. An example:
 
 ```
+# path to a copy of the upstream kernel CNA tracker from
+# https://git.kernel.org/pub/scm/linux/security/vulns.git/
+linux_cna_tracker='/path/to/git/cve_trackers/linux-cna/'
+
 # path to a copy of the linux kernel cve tracker from
 # https://github.com/nluedtke/linux_kernel_cves.git
 linux_kernel_cve_tracker='/path/to/git/cve_trackers/linux_kernel_cves/'
diff --git a/meta_lists/kernel_paths_overrides.json b/meta_lists/kernel_paths_overrides.json
new file mode 100644
index 0000000..86fde02
--- /dev/null
+++ b/meta_lists/kernel_paths_overrides.json
@@ -0,0 +1,40 @@
+{
+    "arch/": "Architecture specifics",
+    "block/": "Block layer",
+    "crypto/": "Cryptographic API",
+    "drivers/acpi": "ACPI drivers",
+    "drivers/android/": "Android drivers",
+    "drivers/edac/": "EDAC drivers",
+    "drivers/gpu/": "GPU drivers",
+    "drivers/i2c/": "I2C subsystem",
+    "drivers/infiniband/": "InfiniBand drivers",
+    "drivers/media/": "Media drivers",
+    "drivers/mfd/": "Multifunction device drivers",
+    "drivers/mtd/": "MTD block device drivers",
+    "drivers/net/": "Network drivers",
+    "drivers/nvme/": "NVME drivers",
+    "drivers/phy/": "PHY drivers",
+    "drivers/pwm/": "PWM drivers",
+    "drivers/scsi/": "SCSI drivers",
+    "drivers/spmi/": "SPMI drivers",
+    "drivers/tty/": "TTY drivers",
+    "drivers/uio/": "Userspace I/O drivers",
+    "fs/ceph/": "Ceph distributed file system",
+    "fs/efivarfs/": "EFI Variable file system",
+    "fs/ext4/": "Ext4 file system",
+    "fs/f2fs/": "F2FS file system",
+    "fs/gfs2/": "GFS2 file system",
+    "fs/jfs/": "JFS file system",
+    "fs/smb/": "SMB network file system",
+    "kernel/bpf/": "BPF subsystem",
+    "kernel/": "Core kernel",
+    "net/core/": "Networking core",
+    "net/ipv6/": "IPv6 Networking",
+    "net/ipv4/": "IPv4 Networking",
+    "net/llc/": "Logical Link Layer",
+    "net/netfilter/": "Netfilter",
+    "net/openvswitch/": "Open vSwitch",
+    "net/sched/": "Network Traffic Control",
+    "net/unix/": "Unix domain sockets",
+    "security/apparmor/": "AppArmor security module"
+}
diff --git a/scripts/cve_lib.py b/scripts/cve_lib.py
index 2ea85bb..199dc26 100755
--- a/scripts/cve_lib.py
+++ b/scripts/cve_lib.py
@@ -2771,13 +2771,13 @@ def load_boilerplates():
         data[alias]["aliases"] = sorted(list(aliases[alias]))
     return data
 
-# for sanity, try to keep these in alphabetical order in the json file
-def load_package_info_overrides():
-    with open(os.path.join(meta_dir, "package_info_overrides.json"), "r") as fp:
+def load_json_file_overrides(json_file):
+    with open(os.path.join(meta_dir, json_file), "r") as fp:
         data = json.load(fp)
         return data
 
-package_info_overrides = load_package_info_overrides()
+# for sanity, try to keep these in alphabetical order in the json file
+package_info_overrides = load_json_file_overrides("package_info_overrides.json")
 
 def load_package_db():
     pkg_db = load_boilerplates()
@@ -3705,5 +3705,3 @@ def validate_kernel_fixes(break_fixes):
                 validated.append([break_hash, fix_hash])
 
     return validated
-
-
diff --git a/scripts/kernel_lib.py b/scripts/kernel_lib.py
index 3fa7c0c..c963a2a 100755
--- a/scripts/kernel_lib.py
+++ b/scripts/kernel_lib.py
@@ -14,9 +14,14 @@
 from __future__ import print_function
 
 import sys
+import os
+import urllib.error
+import urllib.request
+from uct.config import read_uct_config
 
 # XXX kernel_srcs probably belongs here, too
-from cve_lib import (kernel_srcs, get_esm_name, is_active_esm_release)
+from cve_lib import (kernel_srcs, get_esm_name, is_active_esm_release, \
+                     load_cve, find_cve, load_json_file_overrides, cmd)
 
 
 # search for the kernel SRU cycle for a kernel in the format
@@ -1517,3 +1522,97 @@ def kernel_package_version(version):
 # XXX may need to add an offset exception to the kernel table
 def kernel_meta_abi(version, offset=3):
     return int(version.split('.').pop(offset))
+
+
+def get_kernel_break_fix(cve):
+    '''Return the break-fix commits of a giver kernel CVE'''
+
+    break_commits = []
+    fix_commits = []
+
+    cve_data = load_cve(find_cve(cve))
+    if cve_data and cve_data['patches']['linux']:
+        for (patch_type, break_fix) in cve_data['patches']['linux']:
+            if patch_type == 'break-fix':
+                break_commit, fix_commit = break_fix.split()[:2]
+
+                for entry in break_commit.split('|'):
+                    if entry != '-':
+                        break_commits.append(entry)
+                for entry in fix_commit.split('|'):
+                    if entry != '-':
+                        fix_commits.append(entry)
+
+    return break_commits, fix_commits
+
+
+def is_kernel_cna_cve(cve):
+    '''Check if a given CVE was published by the Kernel CNA'''
+
+    year = cve.split('-')[1]
+
+    config = read_uct_config()
+    if 'linux_cna_tracker' in config:
+        if os.path.exists(os.path.join(config['linux_cna_tracker'], "cve", "published", year, cve)):
+            return True
+        return False
+
+    print("WARNING: Couldn't find linux_cna_tracker repo, will try to verify it online." , file=sys.stderr)
+
+    url = ("https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published/%s/%s" % (year, cve))
+
+    try:
+        with urllib.request.urlopen(url) as response:
+            if response.getcode() == 200:
+                return True
+            else:
+                print("WARNING: Failed to get OK response from URL %s: %s" % (url, response.getcode()), file=sys.stderr)
+                return False
+    except urllib.error.HTTPError as e:
+        print("WARNING: Failed to fetch patch URL %s: %s" % (url, str(e)), file=sys.stderr)
+        return False
+
+
+def get_affected_subsystems(commits):
+    '''Return the kernel subsystems affected by a list of commits'''
+
+    config = read_uct_config()
+    if 'linux_kernel_path' not in config:
+        raise ValueError("linux_kernel_path not configured, please read README.linux")
+
+    subsystems = {}
+    other_files = []
+    kernel_paths_overrides = load_json_file_overrides("kernel_paths_overrides.json")
+
+    pwd = os.getcwd()
+    os.chdir(config['linux_kernel_path'])
+
+    for _commits in commits:
+        for commit in _commits:
+
+            rc, output = cmd(['git', 'show', '--name-only', '--pretty=format:', commit])
+            if rc !=0:
+                os.chdir(pwd)
+                raise ValueError('failed to get file names from commit %s:\n%s' % (commit, output))
+
+            files_changed = output.splitlines()
+            for file_path in files_changed:
+                matched_subsystem = False
+                for kernel_path in kernel_paths_overrides:
+                    if kernel_path in file_path:
+                        if kernel_paths_overrides[kernel_path] not in subsystems:
+                            subsystems[kernel_paths_overrides[kernel_path]] = set()
+                        subsystems[kernel_paths_overrides[kernel_path]].add(file_path)
+                        matched_subsystem = True
+                        break
+                if not matched_subsystem:
+                    if file_path not in other_files:
+                        other_files.append(file_path)
+
+    os.chdir(pwd)
+
+    # sort alphabetically by kernel hierarchy tree
+    sorted_subsystems = {key: sorted(value) for key, value in sorted(subsystems.items(), key=lambda item: sorted(item[1]))}
+    other_files.sort()
+
+    return sorted_subsystems, other_files
diff --git a/scripts/prepare-kernel-usn.py b/scripts/prepare-kernel-usn.py
index ee11cb9..7ec14fd 100755
--- a/scripts/prepare-kernel-usn.py
+++ b/scripts/prepare-kernel-usn.py
@@ -176,6 +176,7 @@ parser.add_argument('--use-changes', action='store', default=None, help='Use pre
 parser.add_argument('--keep-changes', action='store_true', default=False, help='Keep changes files downloaded by sis-changes')
 parser.add_argument("--ignore-released-cves-in-changelog", action='store_true', help="Filter out CVEs already marked as released")
 parser.add_argument("--esm-ppa", action='store', help="Add kernels from ESM PPA if any, can be used when merging ESM with active kernels (sets --include-eol)")
+parser.add_argument("--kernel-cna-cves", action='store_true', help="Check for Kernel CNA CVEs and add a paragraph for that")
 parser.add_argument('release', action='store', nargs=1,  help='Primary release name (e.g. xenial)')
 parser.add_argument('kernel', action=KernelVersionAction, nargs='+',  help='Kernel source package name and versions; e.g. "linux 4.4.0-42.62. Source package can be a release/name pair"')
 args = parser.parse_args()
@@ -214,7 +215,7 @@ for release in cve_lib.release_sort(kernels.keys()):
 
         if not args.embargoed:
             rc = display_pending_cves(release, kernel, last_usn_version, version, args.add)
-            if not rc == 0 and not args.force:
+            if not rc == 0 and not (args.force or args.kernel_cna_cves):
                 print("Incomplete descriptions detected, please fix.")
                 exit(1)
 
@@ -321,9 +322,15 @@ try:
     if args.ignore_released_cves_in_changelog:
         cmd += ['--ignore-released-cves-in-changelog']
 
+    if args.kernel_cna_cves:
+        cmd += ['--kernel-cna-cves']
+
     if args.embargoed:
         cmd += ['--embargoed']
 
+    if args.debug:
+        cmd += ['--debug']
+
     cmd += ['--filter-bins', generate_usn_regex, usn]
     for release in kernels:
         cmd += ['--binaries-json', '%s-binaries.json' % release]
diff --git a/scripts/pull-usn-desc.py b/scripts/pull-usn-desc.py
index 6bb6ce1..71354f9 100755
--- a/scripts/pull-usn-desc.py
+++ b/scripts/pull-usn-desc.py
@@ -42,6 +42,7 @@ opter.add_option("--releases", help="List of releases CVEs affect to be filter u
 opter.add_option("--this-only-affected", help="Makes this only affected feature optional", action='store_true')
 opter.add_option("--src", help="The package source to be check through if --this-only-affected is used", action='append', default=[])
 opter.add_option("--embargoed", help="Use the embargoed tree to look for desctiptions in addition", action='store_true')
+opter.add_option("--kernel-cna-cves", help="List of CVEs from the Kernel CNA", default=None)
 (opt, args) = opter.parse_args()
 
 cves = dict()
@@ -106,6 +107,13 @@ for cve in opt.cve + args:
         chunks = cves[cve]
 
         desc = chunks['Ubuntu-Description'].strip()
+
+        # we don't want to include the empty description CVEs that are part of
+        # the list from the Kernel CNA but we still may want to follow the
+        # normal process for those that have a description.
+        if len(desc) == 0 and cve in opt.kernel_cna_cves:
+            continue
+
         if len(desc) == 0:
             rc = 1
             disc = chunks.get('Discovered-by', '').strip()
diff --git a/scripts/sis-generate-usn b/scripts/sis-generate-usn
index 9ae7a8b..a5c7b26 100755
--- a/scripts/sis-generate-usn
+++ b/scripts/sis-generate-usn
@@ -22,7 +22,11 @@ import re
 import subprocess
 import sys
 import tempfile
+import textwrap
 import cve_lib
+from kernel_lib import (is_kernel_cna_cve,
+                        get_kernel_break_fix,
+                        get_affected_subsystems)
 from uct.config import read_uct_config
 
 opter = optparse.OptionParser()
@@ -39,6 +43,7 @@ opter.add_option("--embargoed", help="Include embargoed directory when looking f
 opter.add_option("--include-eol", help="Include EoL releases", action='store_true')
 opter.add_option("--binaries-json", help="Path to JSON mapping of binary packages to versions (can repeat, default: binaries.json)", action='append', default=[])
 opter.add_option("--this-only-affected", help="Makes this only affected feature optional", action='store_true')
+opter.add_option("--kernel-cna-cves", help="Check for Kernel CNA CVEs and add a paragraph for that", action='store_true')
 (opt, args) = opter.parse_args()
 
 if len(args) < 2:
@@ -752,7 +757,54 @@ if len(CVEs):
 
     if opt.embargoed:
         pull_usn_cmd.append('--embargoed')
+
+    kernel_cna_cves = []
+    if opt.kernel_cna_cves:
+        for cve in CVEs:
+            if is_kernel_cna_cve(cve):
+                kernel_cna_cves.append(cve)
+        pull_usn_cmd.append('--kernel-cna-cves=%s' % kernel_cna_cves)
+
     print(subprocess.Popen(pull_usn_cmd + sorted(CVEs), stdout=subprocess.PIPE).communicate()[0].decode("utf-8"))
+
+    if opt.kernel_cna_cves:
+        all_fix_commits = []
+        for cve in kernel_cna_cves:
+            break_commits, fix_commits = get_kernel_break_fix(cve)
+            all_fix_commits.append(fix_commits)
+
+        affected_subsystems, other_files = get_affected_subsystems(all_fix_commits)
+
+        print("XXX-CHECK-XXX")
+        if affected_subsystems:
+            print("Several security issues were discovered in the Linux kernel.")
+            print("An attacker could possibly use these to compromise the system.")
+            print("This update corrects flaws in the following subsystems:")
+            if opt.debug:
+                debug("Subsystems affected in Kernel CNA CVEs:")
+            for subsystem, files in affected_subsystems.items():
+                print(f"  - {subsystem};")
+                if opt.debug:
+                    debug(f"  - {subsystem};")
+                    for file_path in files:
+                        debug(f"    - {file_path}")
+        else:
+            print("No affected subsystems found.")
+        print(textwrap.fill("(%s)" % (", ".join(kernel_cna_cves)), 75))
+        print("XXX-CHECK-XXX")
+
+        if other_files:
+            print("XXX-CHECK-XXX")
+            print("Other Files (Not Belonging to Any Subsystem):")
+            if opt.debug:
+                debug("Other Files (Not Belonging to Any Subsystem):")
+            for file_path in other_files:
+                print(f"- {file_path}")
+                if opt.debug:
+                    debug(f"- {file_path}")
+            print("XXX-CHECK-XXX")
+
+
 if not opt.kernel_mode:
     print('XXX IF COMPILER PROTECTED XXX')
     print('The default compiler options for affected releases should reduce the')
diff --git a/scripts/test_kernel_lib.py b/scripts/test_kernel_lib.py
index 1bb35c5..405300a 100755
--- a/scripts/test_kernel_lib.py
+++ b/scripts/test_kernel_lib.py
@@ -17,8 +17,11 @@ from kernel_lib import (
     kernel_package_version,
     convert_name_to_meta,
     convert_name_to_signed,
+    is_kernel_cna_cve,
+    get_affected_subsystems,
+    get_kernel_break_fix
 )
-
+from uct.config import read_uct_config
 
 class TestKernelMabiCalc:
     def test_basic_version(self):
@@ -72,3 +75,29 @@ class TestKernelComputeSignedName:
     def test_bad_kernel_name(self):
         with pytest.raises(ValueError):
             convert_name_to_signed("not-linux")
+
+
+class TestKernelCNACVEs:
+    def test_is_kernel_cna_cve(self):
+        assert is_kernel_cna_cve('CVE-2024-26581')
+        assert is_kernel_cna_cve('CVE-2024-24860') is False
+
+    def test_get_affected_subsystems(self):
+        break_commits, fix_commits = get_kernel_break_fix('CVE-2023-52447')
+        assert fix_commits == ['876673364161da50eed6b472d746ef88242b2368', '876673364161da50eed6b472d746ef88242b2368']
+        assert break_commits == ['bba1dc0b55ac462d24ed1228ad49800c238cd6d7', '638e4b825d523bed7a55e776c153049fb7716466']
+
+        expected_subsystems = {'BPF subsystem': ['kernel/bpf/map_in_map.c', 'kernel/bpf/syscall.c']}
+        expected_other_files = ['include/linux/bpf.h']
+
+        config = read_uct_config()
+        if 'linux_kernel_path' not in config:
+            pytest.skip("linux_kernel_path not configured, skipping!")
+
+        subsystems, other_files = get_affected_subsystems([fix_commits])
+        assert subsystems == expected_subsystems
+        assert other_files == expected_other_files
+
+        fail_fix_commit = ['deadb33f']
+        with pytest.raises(ValueError):
+            get_affected_subsystems([fail_fix_commit])