Speaker
Description
The Problem: CVEs
- CVEs: Common Vulnerabilities and Exposures
- February 2024, Linux kernel project becomes the Linux kernel CVE Numbering Authority (CNA)
- The number of Linux kernel CVEs skyrockets
- Red Hat customers expect CVE fixes/mitigations, with some having Service Level Agreements for delivery within X number of days, depending on severity
- Red Hat did not get an increase in kernel developers commensurate with the increase in kernel CVEs
The Solution: Automation
- Don’t manually do things that can be done by robots! (*)
- Assignment of the work to the right team
- Identification of the patch fixing the CVE
- Backport of the fix (possibly with AI coding assistance)
- Submission of a merge request containing the fix
- Validation of the merge request
- Testing of the fix
(*) This does not necessarily mean AI, but it also does now