mbox series

[v3,0/8] Check compiled files to filter kernel CVEs

Message ID 20250429143904.634082-1-daniel.turull@ericsson.com
Headers show
Series Check compiled files to filter kernel CVEs | expand

Message

Daniel Turull April 29, 2025, 2:38 p.m. UTC 
From: Daniel Turull <daniel.turull@ericsson.com>

Since kernel.org became a CNA, more information is available in the published CVEs, including details about which files are affected by a given CVE.

This series adds functionality to fetch the database from kernel.org CNA information:
git.kernel.org/pub/scm/linux/security/vulns.git

I have rewritten the original patch and integrated it with cve_check.py, cve_check, vex and create-spdx.

To filter out CVEs that are not applicable, we extract the files used during the kernel compilation and
compare it with the metadata in the CVE.

The CVE_CHECK_KERNEL is enabled by default, but not the CVE_CHECK_KERNEL_CONFIG, since it
needs to build the kernel and it is dependent on kernel configuration.

To include the files into SPDX, SPDX_INCLUDE_SOURCES needs to be enabled.

This could use as a base to run the vulnerability check independently and run an external tool to filter the CVEs.

In addition, we also integrate the data with the output of cve_check, vex, and create-spdx.

As a side effect of using better data from directly the kernel CNA, the number of vulnerabilities reported
increases.

Numbers from 2025-04-28

Standing CVEs:
- Before: 18 CVEs, mostly old that needs to be checked and clean up in a new commit. There is only one from 2025
- Checking with kernel vulns database: 82 CVEs
- Checking with only compiled files: 46 CVEs

v1: initial proposal
v2:
  - rewrite kernel_vulns to fetch similarly as cve-update-db-native
  - add functionality into cve_check.py, for the classes that uses oe.get_patched_cves function
  - add linux-vulns into the cve-check results
  - add only compiled files in the spdx, so the check can be done outside the build
  - include compiled files into spdx when CVE_CHECK_KERNEL_CONFIG and SPDX_INCLUDE_SOURCES is enabled
v3:
  - make inclusion of compiled files generic for SPDX, so other systems that has knowledge of used files can also make more accurate sboms
  - have the functions to extract files in kernel.bbclass. For other recipes that in the future want to use this feature can add the function in their recipe or in a build bbclass.
  - move order of patches
  - explicitly have the save_compiled_files added only when having the CVE_CHECK_KERNEL_CONFIG
  - add first kernel cves in cve_check, so manual CVE_STATUS is preserved
  - add CVE_STATUS for false positives

Daniel Turull

Daniel Turull (8):
  linux-vulns: fetch kernel.org CNA info
  cve-check: fix debug message
  kernel: add support to extract compiled files
  cve-check: move message outsite check_cves and sort
  spdx: add option to include only compiled kernel files
  cve-check: optionally allow to force update
  cve-check, vex, spdx: use metadata from linux-vulns to enhance CVE
    reporting
  cve-exclusions: correct CVE_STATUS

 meta/classes-recipe/kernel.bbclass          |  37 ++++
 meta/classes/create-spdx-2.2.bbclass        |   8 +
 meta/classes/cve-check.bbclass              |  51 +++--
 meta/classes/spdx-common.bbclass            |   4 +
 meta/classes/vex.bbclass                    |  11 +
 meta/conf/distro/include/maintainers.inc    |   1 +
 meta/lib/oe/cve_check.py                    | 211 +++++++++++++++++++-
 meta/lib/oe/spdx30_tasks.py                 |   8 +
 meta/recipes-core/meta/linux-vulns_git.bb   |  76 +++++++
 meta/recipes-kernel/linux/cve-exclusion.inc |  31 +++
 10 files changed, 424 insertions(+), 14 deletions(-)
 create mode 100644 meta/recipes-core/meta/linux-vulns_git.bb