Vulnerability Management

1. Vulnerability Response

The openUBMC community prioritizes the security of its releases. SIG Security is responsible for receiving, investigating, and disclosing all related security vulnerabilities. We strongly encourage security researchers and industry organizations to proactively report suspected flaws to SIG Security for rapid response, analysis, and resolution.

2. Supported Versions

The vulnerability response process is focused primarily on openUBMC community releases.

3. Vulnerability Handling Process

Every security vulnerability is assigned to a dedicated individual for tracking and resolution. This coordinator (a SIG Security member) is responsible for driving the fix and disclosure process.

We will detail three key stages of this workflow: Vulnerability Reporting, Vulnerability Assessment, and Vulnerability Disclosure.

3.1 Vulnerability Reporting

If you suspect an openUBMC product contains a security vulnerability, we urge you to report it to the openUBMC community and collaborate with us to ensure its responsible remediation and disclosure.

3.1.1 Vulnerability Reporting Method

Potential security vulnerabilities in openUBMC products should be reported via email to SIG Security at securities@public.openubmc.cn. Given the highly sensitive nature of vulnerability data, we strongly recommend encrypting your submission using SIG Security's PGP public key to ensure confidentiality. We are fully equipped to receive OpenPGP-encrypted emails. List of SIG Security members:

• Zhang Chao [@TacoJay], zhangchao60@huawei.com
• Yan Chuanjie [@loopvoid], yanchuanjie@huawei.com
• Peng Xianglin [@Free_Tomato], pengxianglin2@huawei.com

3.1.2 Vulnerability Report Content

To facilitate the rapid confirmation and validation of a suspected vulnerability, please include (but do not limit your report to) the following information in your submission email:

• Basic information: Include the module impacted by the vulnerability, the trigger conditions, and the potential system impact upon successful exploitation.
• Technical details: Include system configuration, localization methods, a description of the exploit, POC (Proof-of-Concept), and detailed reproduction steps.
• Suggested remediation: Your proposed solution or mitigation advice.
• Reporter information: Your organization and contact details.
• Disclosure plan: Your potential timeline or plan for public disclosure of the vulnerability.

3.1.3 Response Time

We will respond to suspected security vulnerabilities reported via email within five days and provide the reporter with an update on the issue's handling progress.

3.2 Vulnerability Assessment

The industry standard for assessing vulnerability severity is the Common Vulnerability Scoring System (CVSS). When using CVSS v3, we require the definition of a vulnerability exploitation scenario and assess the actual impact within that context. The severity rating assesses exploit complexity and the resulting impact on Confidentiality, Integrity, and Availability (CIA) to generate a corresponding score.

3.2.1 Assessment Criteria

The openUBMC community uses CVSS v3 to assess vulnerabilities. CVSS v3 assesses the impact of a vulnerability using the following vectors:

• Attack Vector (AV): Reflects the context by which vulnerability exploitation is possible.
• Attack Complexity (AC): Describes the difficulty of executing the attack and the conditions required for a successful exploit.
• User Interaction (UI): Determines whether successful exploitation requires user participation.
• Privileges Required (PR): Records the level of user authorization necessary for a successful attack.
• Scope (S): Determines whether the attacker can impact components with different authorization levels.
• Confidentiality (C): Measures the extent of impact resulting from information disclosure to unauthorized parties.
• Integrity (I): Measures the extent of impact resulting from data modification or tampering.
• Availability (A): Measures the extent to which users are affected when access to data or services is impaired.

3.2.2 Assessment Principles

• Vulnerability severity is assessed, not overall risk.
• The assessment must be based on a defined attack scenario, ensuring that a successful attack within that scenario can cause an impact on Confidentiality, Integrity, or Availability (CIA).
• When a security vulnerability has multiple attack scenarios, the assessment must use the scenario that causes the maximum impact (for example, the highest CVSS score).
• If a vulnerability exists in an embedded or called library, the attack scenario must be determined based on how the library is used within the product prior to assessment.
• Security flaws that cannot be triggered or do not affect CIA will receive a CVSS score of 0.

3.2.3 Assessment Steps

When assessing a vulnerability, proceed according to the following steps:

• Define the plausible attack scenario and score based on that scenario.
• Identify the Vulnerable Component and the Impact Component (the component affected by the flaw).
• Assign base metrics: Determine the vulnerability's overall impact by scoring the Exploitability (AV/AC/PR/UI/S) and Impact (C/I/A) metrics.

3.2.4 Severity Rating

Severity Rating	Score
Critical	9.0 - 10.0
High	7.0 - 8.9
Medium	4.0 - 6.9
Low	0.1 - 3.9
None	0.0

3.3 Vulnerability Disclosure

To protect the security of openUBMC users, the openUBMC community strictly controls the spread of vulnerability information during the investigation, remediation, and public disclosure phases. We limit this sensitive information to only the personnel directly involved in addressing the flaw. We will not publicly disclose, discuss, or confirm security issues related to openUBMC products until a public disclosure is made. We also require the vulnerability reporter to maintain strict confidentiality until this official public release. Once a security vulnerability has been fixed, the openUBMC community will issue a security advisory. This advisory will include the technical details of the flaw, the CVE ID, CVSS score, severity rating, and information regarding affected and patched versions. Security advisories are available via email subscription.