mbox series

[v2,0/6] Check compiled files to filter kernel CVEs

Message ID 20250428134205.900354-1-daniel.turull@ericsson.com
Headers show
Series Check compiled files to filter kernel CVEs | expand

Message

Daniel Turull April 28, 2025, 1:41 p.m. UTC 
From: Daniel Turull <daniel.turull@ericsson.com>

Since kernel.org became a CNA, more information is available in the published CVEs, including details about which files are affected by a given CVE.

This series adds functionality to fetch the database from kernel.org CNA information:
git.kernel.org/pub/scm/linux/security/vulns.git

I have rewritten the original patch and integrated it with cve_check.py, cve_check, vex and create-spdx.

To filter out CVEs that are not applicable, we extract the files used during the kernel compilation and
compare it with the metadata in the CVE.

The CVE_CHECK_KERNEL is enabled by default, but not the CVE_CHECK_KERNEL_CONFIG, since it
needs to build the kernel and it is dependent on kernel configuration.

To include the files into SPDX, SPDX_INCLUDE_SOURCES needs to be enabled.

This could use as a base to run the vulnerability check independently and run an external tool to filter the CVEs.

In addition, we also integrate the data with the output of cve_check, vex, and create-spdx.

As a side effect of using better data from directly the kernel CNA, the number of vulnerabilities reported
increases.

Numbers from 2025-04-28

Standing CVEs:
- Before: 18 CVEs, mostly old that needs to be checked and clean up in a new commit. There is only one from 2025
- Checking with kernel vulns database: 82 CVEs
- Checking with only compiled files: 46 CVEs

v1: initial proposal
v2:
  - rewrite kernel_vulns to fetch similarly as cve-update-db-native
  - add functionality into cve_check.py, for the classes that uses oe.get_patched_cves function
  - add linux-vulns into the cve-check results
  - add only compiled files in the spdx, so the check can be done outside the build
  - include compiled files into spdx when CVE_CHECK_KERNEL_CONFIG and SPDX_INCLUDE_SOURCES is enabled

Daniel Turull

Daniel Turull (6):
  linux-vulns: fetch kernel.org CNA info
  cve-check: fix debug message
  kernel: add support to extract compiled files
  cve-check: move message outsite check_cves and sort
  cve-check, vex, spdx: use metadata from linux-vulns to enhance CVE
    reporting
  spdx: add option to include only compiled kernel files

 meta/classes-recipe/kernel.bbclass        |  11 ++
 meta/classes/create-spdx-2.2.bbclass      |   8 +
 meta/classes/cve-check.bbclass            |  35 +++-
 meta/classes/spdx-common.bbclass          |   7 +
 meta/classes/vex.bbclass                  |  10 ++
 meta/conf/distro/include/maintainers.inc  |   1 +
 meta/lib/oe/cve_check.py                  | 210 +++++++++++++++++++++-
 meta/lib/oe/spdx30_tasks.py               |   8 +
 meta/lib/oe/spdx_common.py                |  34 ++++
 meta/recipes-core/meta/linux-vulns_git.bb |  76 ++++++++
 10 files changed, 391 insertions(+), 9 deletions(-)
 create mode 100644 meta/recipes-core/meta/linux-vulns_git.bb