论文标题
在自动化的静态固件分析中迈向可靠且可扩展的Linux内核CVE归因
Towards Reliable and Scalable Linux Kernel CVE Attribution in Automated Static Firmware Analyses
论文作者
论文摘要
在漏洞评估中，基于软件的CVE归因是一种常见方法，可以大规模识别可能的脆弱系统。但是，这种以版本为中心的方法为固件图像中的二进制分布式Linux内核产生了高阳性率。不包含弱势组件是不可靠匹配的原因，因为异质的硬件属性，模块化和众多开发流导致大量供应商定制的构建。为了在保持分析方法的可扩展性的同时迈出提高结果的可靠性，我们使用自动化的静态固件分析丰富了基于版本的CVE与二进制图像的内核特异性构建数据匹配。我们开源一个归因管道，该管道收集内核配置和目标体系结构，以根据记录描述中受影响的文件参考来构建当前的内核版本和过滤CVE。在使用127个路由器固件图像的案例研究中，我们表明，与幼稚版本匹配相比，我们的方法将所有版本CVE匹配的68％识别为假阳性，并可靠地将其从结果集中删除。对于所有匹配项中的12％，它提供了问题适用性的其他证据。对于19.4％的人，我们的方法无法提高可靠性，因为CVE中所需的文件参考缺失。
In vulnerability assessments, software component-based CVE attribution is a common method to identify possibly vulnerable systems at scale. However, such version-centric approaches yield high false-positive rates for binary distributed Linux kernels in firmware images. Not filtering included vulnerable components is a reason for unreliable matching, as heterogeneous hardware properties, modularity, and numerous development streams result in a plethora of vendor-customized builds. To make a step towards increased result reliability while retaining scalability of the analysis method, we enrich version-based CVE matching with kernel-specific build data from binary images using automated static firmware analysis. We open source an attribution pipeline that gathers kernel configuration and target architecture to dry build the present kernel version and filter CVEs based on affected file references in record descriptions. In a case study with 127 router firmware images, we show that in comparison to naive version matching, our approach identifies 68% of all version CVE matches as false-positives and reliably removes them from the result set. For 12% of all matches it provides additional evidence of issue applicability. For 19.4%, our approach does not improve reliability because required file references in CVEs are missing.
