Lightning Talk: Pruning the Kernel CVEs With Code Reachability Analysis
summary
Method maps CVEs to vulnerable kernel functions and uses static code reachability with Kconfig + module-aware analysis and interprocedural call graphs to decide exploitability. An open-source tool on GitHub automates the analysis and evaluation against representative workloads. Results: kernel became a CNA in Feb 2024 and CVEs rose from ~5/week to ~104/week (peaks ~800/week); using tinyconfig (362 opts) CVEs drop to 176 (~91% reduction), Ubuntu config + 195 loaded modules prunes ~60% to 814.
AI-written summary · about
related talks
32mPruning Kernel CVEs With Code Reachability Analysis
28mKernel CVEs are Alive, but Do Not Panic!
26mConfig Based CVE Matching for Linux Kernel
44mDeep Analysis of Exploitable Linux Kernel Vulnerabilities 2017-2019
36mLinux Kernel CVEs: What Has Caused So Many to Suddenly Show Up?
20mPrioritizing the Linux OS Hardening and CVE Mitigation
17mExploring Function-Level Code Metrics and Developer Attributes for Linux Kernel Vulnerabilities
21mFrom CVEs To Compliance: Automating Embedded Linux Kernel Security