Pruning Kernel CVEs With Code Reachability Analysis
summary
Static reachability maps NVD CVEs to vulnerable kernel functions using Kconfig, module load status and interprocedural call graphs and the open‑source KCV pruner automates that pipeline. Claim: many CVEs are never reachable — after becoming a CNA kernel CVE volume jumps ~21× to ~104/week, but build‑time pruning yields up to 91.4% reduction on tiny configs and distro defaults see ~12.1% pruned; combining module‑load data cuts 1807→814 CVEs (60.4% pruned). Runtime function reachability is not yet implemented.
AI-written summary · about
chapters (8)
- 0:00Kernel CVEs introduction
- 3:57Most CVEs are false positives
- 7:52Code reachability layers
- 11:47Pruning CVEs at build time
- 13:10Filtering CVEs at load time
- 15:38KCV Pruner automation
- 20:43Future tool directions
- 27:05Q&A
related talks
05mLightning Talk: Pruning the Kernel CVEs With Code Reachability Analysis
26mConfig Based CVE Matching for Linux Kernel
56mNarrow – SCA Reachability Analysis Without The Effort
22mWhen is a vulnerability not a vulnerability? Overcoming the...
28mKernel CVEs are Alive, but Do Not Panic!
17mExploring Function-Level Code Metrics and Developer Attributes for Linux Kernel Vulnerabilities
35mKeeping Up with the CVEs: How to Find a Needle in a Haystack?
40mOpen Source CVE Monitoring and Management: Cutting Through the Vulnerability Storm