Distribution Builders Meet VEX
summary
Yocto Project builds generate CV metadata that is already close to VEX: the build system’s CV check detects package-level CVEs, honors per-recipe patch files like CVE_2024_45781.patch to mark fixes, and flags NVD problems, platform-only issues, and configuration-dependent non-exploitability. The experiment produces many complete VEX entries by converting metadata into OpenVEX but requires nonstandard status fields (disputed NVD, abandoned upstream, vendor-added patches) and cannot yet resolve vendor layer inheritance or merge SBOMs/VEXes across multiple processors for products with ~200+ packages. Code is open source.
AI-written summary · about
chapters (6)
- 0:00VEX and Yokto introduction
- 3:19Yokto fundamentals and layers
- 6:52CV check tool limits
- 9:44Generating VEX from metadata
- 14:23VEX generation open problems
- 17:43Future directions & Q&A
related talks
45mVEXing Open Source Security: Vulnerability Data for Everything
37mTracking Vulnerabilities with Buildroot and Yocto
31mVEX! or... How to Reduce CVE Noise With One Simple Trick!
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks
50mDemocratizing Exploitability Data with OpenVEX
48m5 Steps to VEX Success: Managing the End-to-End Workflow
30mTaming the Scanner Storm: How VEX Brings Context to Vulnerability Data
42mComparison and Proposal of Vulnerability Management Approaches in Yocto-Based...