Looking at all the recent Linux kernel crash CVEs I see that the "Scope Changed" metric is always "Unchanged" indicating that "The vulnerable component is the affected component".

My question is, why wouldn't a kernel crash have a "Changed" Scope? Subsequent to a kernel crash ALL other software components have their availability affected, in which case the affected components will be different than the vulnerable component.

  • first.org/cvss/v3.0/…. I think that provides your answer. "Unchanged: An exploited vulnerability can only affect resources managed by the same authority."
    – schroeder
    Commented Jul 8 at 16:49
  • I’m voting to close this question because it is answered by the definitions provided by CVSS
    – schroeder
    Commented Jul 8 at 16:52


Browse other questions tagged .