TencentOS Vulnerability Service Rules
This policy applies to all TencentOS products and aims to help TencentOS users and community members understand how TencentOS assesses, responds to, and discloses security vulnerabilities in the system.
Vulnerability Definition
Vulnerability refers to a weakness or defect in the system that can be exploited to threaten the confidentiality, integrity, and availability of the system or its application data.
Vulnerability Reporting
The TencentOS Security Operations team monitors the security landscape of open source communities worldwide in real time through multiple channels. Meanwhile, we also welcome users to proactively report security vulnerabilities found in the distribution to us.
If you discover a suspected security vulnerability in TencentOS products, we hope that you will report it to us and work with us to fix and disclose the issue in a responsible manner.
However, for the following situations, it is recommended that you contact the maintenance team for consultation before reporting.
You only want security-related technical assistance.
The defect you wish to report is not security-related (cannot be exploited to undermine system security).
Vulnerability Reporting Methods
In accordance with the Cybersecurity Law of the People's Republic of China, we advise against publicly disclosing details of TencentOS security vulnerabilities. To report a security vulnerability, please send an email to the TencentOS Security Emergency Response mailbox (tencentos_secure@tencent.com), and we will respond as soon as possible.
Because vulnerability information is sensitive, we recommend that you encrypt your email using PGP when sending it (for encryption methods and keys, see the appendix; this is not mandatory).
Vulnerability Reporting Content
To facilitate effective communication, we recommend that you compose your vulnerability reporting email in the following format (for uncertain items, you may fill in "uncertain").
Vulnerability title: Briefly summarize the vulnerability in one sentence, directly reflecting the vulnerability type and affected components. For example, the sudoedit command in sudo contains a heap overflow vulnerability that enables privilege escalation.
Self-introduction: Please briefly introduce yourself or your organization so that we can contact you.
Basic vulnerability information.
Vulnerability type: Select a category for the vulnerability. It is recommended to refer to the CWE vulnerability classification standard (CWE List Version 4.15). Severity level: Please provide the self-assessment result and rationale for the vulnerability based on the CVSS v3.1 standard.
Affected systems and components: Please provide the affected TencentOS version (which can be determined by running the cat /etc/tencentos-release command, for example, TencentOS Server 4) and the affected software packages (for example, sudo-1.8.29-7.tl3.x86_64).
Initial discovery time: Please provide the initial discovery time of the vulnerability.
Source of original information: Please describe the source of vulnerability information, whether it is discovered by yourself or obtained from other sources.
Whether the vulnerability has been reported to other organizations: If so, please provide the name of the organization and the reporting date.
Detailed vulnerability description.
Vulnerability overview: Please briefly describe the vulnerability in a few sentences.
Vulnerability impact: Please describe the scope of impact and potential damage caused by the vulnerability.
Vulnerability reproduction process: Please describe the vulnerability discovery procedure in detail using text and screenshots, ensuring readers can follow the steps to reproduce the vulnerability.
Proof of concept (POC): It can be provided in the attachment or via the corresponding link.
Remediation recommendations: Please provide suggestions for fixing the vulnerability, including written descriptions, patches, pseudocode, or other applicable forms.
Vulnerability Reporting Response
The TencentOS Security Operations team is committed to providing the most timely response to vulnerability reports:
We will acknowledge receipt of the security vulnerability report within 1 working day, complete the preliminary assessment and respond to the reported security issue within 3 working days, and synchronize the progress of vulnerability handling with the reporter at any time.
For vulnerabilities that have not been publicly disclosed, we will report to the MIIT National Vulnerability Database (NVDB) and notify upstream software communities within 2 days after receiving the information. Other than this, we will not provide vulnerability details to any third party without the permission of the reporter.
We are not affiliated with any third-party bug bounty programs and currently do not offer monetary rewards for vulnerability reports in our products. However, with the reporter's consent, we will acknowledge the contributions in our security advisories.
Vulnerability Assessment
The impact of a vulnerability is related to the version, usage, platform, and compilation method of the affected component. Therefore, the TencentOS security team must re-evaluate the vulnerability based on the specific environment. The evaluation includes but is not limited to the following:
Do we include the affected software packages in the released version?
If the affected software packages are included, which release versions are affected?
What is the severity and impact of the vulnerability?
Is there an existing CVE ID corresponding to it?
We use the internationally recognized vulnerability scoring standard CVSS v3.1 to assess the severity of vulnerabilities. For detailed information about this standard, see Common Vulnerability Scoring System. CVSS v3.1 evaluates the impact of a vulnerability through the following combination of metrics: Available metrics.
Attack vector (AV): measures the remoteness of the target system and the method of exploiting the vulnerability.
Attack complexity (AC): measures the difficulty of executing an attack and the factors required for a successful exploit.
User interaction (UI): determines whether an attack involves user participation.
Privileges required (PR): records the authentication level of the user identity required to carry out an attack.
Scope (S): determines whether an attacker can affect components outside their security domain or permission scope.
Affected metrics.
Confidentiality (C): measures whether unauthorized users can access information resources and the level of access they have.
Integrity (I): measures the impact of vulnerabilities on data credibility and authenticity.
Availability (A): measures the impact of vulnerabilities on legitimately authorized users' access to data or services.
Based on the CVSS v3.1 scoring, we categorize vulnerabilities into the following five severity levels:
|
Critical | 9.0-10.0 |
High | 7.0-8.9 |
Medium | 4.0-6.9 |
Low | 0.1-3.9 |
None | 0.0 |
We will decide whether to fix the vulnerability and what resources to allocate based on the vulnerability severity level.
Vulnerability Disclosure
After the security vulnerability is fixed, TencentOS will be publicly disclosed in the form of a security advisory, which includes but is not limited to:
Affected component versions and fixed versions.
Fixing or preventive measures.
Link to the defect management system for the vulnerability.
Once a fix or mitigation is available, we will disclose the vulnerability as soon as possible. The specific disclosure date will be determined through negotiation between the TencentOS security team and the vulnerability reporter.
To help administrators quickly decide whether to update and when to update, we categorize security advisories into four levels:
|
Critical | This rating applies to vulnerabilities that can be easily exploited by remote unauthenticated attackers without user interaction, leading to system compromise (arbitrary code execution). These are the types of vulnerabilities that worms can exploit. Vulnerabilities requiring authenticated remote users or local users, or those depending on rare configurations do not fall under the critical severity rating. |
Important | This rating applies to vulnerabilities that can easily compromise the confidentiality, integrity, or availability of resources. These vulnerabilities allow local users to gain privileges, unauthenticated remote users to access resources that should be protected by authentication, authenticated remote users to execute arbitrary code, or unauthenticated remote users to cause denial of service without user interaction. |
Moderate | This rating applies to defects that may be harder to exploit but could still compromise the confidentiality, integrity, or availability of resources under certain circumstances. These vulnerabilities may have severe or significant impacts, but based on technical assessments, they are less likely to be exploited or only affect rare configurations. Vulnerabilities that cause intermittent local denial-of-service (requiring service restarts) of fundamental system services (such as kernel, systemd, polkit, and dbus...), regardless of whether user interaction is required, should also be rated as moderate. |
Low | This rating applies to all other security-related issues. These types of vulnerabilities are considered unlikely to be exploited, or the impact of successful exploitation is minimal. |
To protect user security, TencentOS will not publicly disclose security issues or CVE IDs in its products before investigation, remediation, and security advisory publication are completed. Therefore, all CVE IDs displayed on the vulnerability approval page are fixed CVE IDs, and any CVE IDs not included are marked as Not Affected/No Fix.