Config Based CVE Matching for Linux Kernel
summary
Current method of matching CVEs by package and major kernel version produces hundreds of false positives (benchmarks show >80% on a recent LTS). The pipeline replaces coarse NVD CPE matching with Ubuntu CVE Tracker lookups and commit-id based range extraction to find exact vulnerable commit ranges, then runs the kernel coverage command against the product .config to check whether the vulnerable lines actually compile. Results cut manual triage by roughly 50–90% and removes an additional ~10% of false positives beyond commit-range filtering.
AI-written summary · about
chapters (9)
- 0:00Start
- 1:02Too many CVEs detected on Linux kernel
- 3:36NVD records are too rough
- 5:00Example NVD record
- 5:32Ubuntu CVE Tracker
- 8:34Classify the Linux kernel vulnerabilities
- 10:37Example CVE triage flow
- 14:55Benchmark
- 20:13Conclusion
related talks
40mOpen Source CVE Monitoring and Management: Cutting Through the Vulnerability Storm
21mFrom CVEs To Compliance: Automating Embedded Linux Kernel Security
20mPrioritizing the Linux OS Hardening and CVE Mitigation
05mLightning Talk: Pruning the Kernel CVEs With Code Reachability Analysis
37mTracking Vulnerabilities with Buildroot and Yocto
53mThe Trials and Tribulations of Bulk Converting CVEs to OSV
32mPruning Kernel CVEs With Code Reachability Analysis
28mKernel CVEs are Alive, but Do Not Panic!