mbox series

[v5,0/3] Check compiled files to filter kernel CVEs

Message ID 20250521134400.1733473-1-daniel.turull@ericsson.com
Headers show
Series Check compiled files to filter kernel CVEs | expand

Message

Daniel Turull May 21, 2025, 1:43 p.m. UTC 
From: Daniel Turull <daniel.turull@ericsson.com>

Since kernel.org became a CNA, more information is available in the published CVEs, including details about which files are affected by a given CVE.

I have rewritten the original patch after the feedback received, including only the basic functionality in the build (extracting the sources as a text file and inside spdx) and created a postprocessing script that enrich the cve-summary.

To filter out CVEs that are not applicable, we extract the files used during the kernel compilation and
compare it with the metadata in the CVE.

To enabled, add in your local.conf SPDX_INCLUDE_COMPILED_SOURCES. It will generated spdx files with only the used sources.
If only the kernel is wanted use in your local.conf: SPDX_INCLUDE_COMPILED_SOURCES:pn-linux-yocto = "1".

This could use as a base to run the vulnerability check independently and run an external tool to filter the CVEs.

v1: initial proposal
v2:
  - rewrite kernel_vulns to fetch similarly as cve-update-db-native
  - add functionality into cve_check.py, for the classes that uses oe.get_patched_cves function
  - add linux-vulns into the cve-check results
  - add only compiled files in the spdx, so the check can be done outside the build
  - include compiled files into spdx when CVE_CHECK_KERNEL_CONFIG and SPDX_INCLUDE_SOURCES is enabled
v3:
  - make inclusion of compiled files generic for SPDX, so other systems that has knowledge of used files can also make more accurate sboms
  - have the functions to extract files in kernel.bbclass. For other recipes that in the future want to use this feature can add the function in their recipe or in a build bbclass.
  - move order of patches
  - explicitly have the save_compiled_files added only when having the CVE_CHECK_KERNEL_CONFIG
  - add first kernel cves in cve_check, so manual CVE_STATUS is preserved
  - add CVE_STATUS for false positives
v4:
 - Refactor and reduce series to 3 patches, one for spdx, one for the kernel, and one standalone script
v5:
 - Use debug information from do_package to extract compiled files
 - Read spdx file from the kernel in the script to process files

CC: Peter Marko <peter.marko@siemens.com>
CC: Marta Rybczynska <rybczynska@gmail.com>
CC: Joshua Watt <JPEWhacker@gmail.com>
CC: Quentin Schulz <quentin.schulz@cherry.de>

Daniel Turull

Daniel Turull (3):
  package: change location of debugsources to PKGDESTWORK
  spdx: add option to include only compiled sources
  improve_kernel_cve_report: add script for postprocesing of kernel CVE
    data

 meta/classes/create-spdx-2.2.bbclass         |   9 +
 meta/classes/spdx-common.bbclass             |   3 +
 meta/lib/oe/package.py                       |   5 +-
 meta/lib/oe/spdx30_tasks.py                  |  10 +
 meta/lib/oe/spdx_common.py                   |  49 ++
 scripts/contrib/improve_kernel_cve_report.py | 467 +++++++++++++++++++
 6 files changed, 542 insertions(+), 1 deletion(-)
 create mode 100755 scripts/contrib/improve_kernel_cve_report.py