CVE bin tool integration, VEX support -> F20 replacement #1452

m-1-k-3 · 2025-02-02T19:23:58Z

What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)

Feature

What is the current behavior? (You can also link to an open issue here)

F20 quite slow
No VEX support

What is the new behavior (if this is a feature change)? If possible add a screenshot.

Does this PR introduce a breaking change? (What changes might users need to make in their application due to this PR?)

This will replace the current F20 module

Other information:

docker base image 1.5.1d needed
~~Currently work in progress~~
read only filesystem of our current docker base image is currently not working with cve-bin-tool

m-1-k-3 · 2025-02-04T10:01:28Z

initial test results:

[*] Tue Feb  4 08:44:38 CET 2025 - F17_cve_bin_tool starting
[*] Tue Feb  4 09:20:07 CET 2025 - F17_cve_bin_tool finished
[*] Tue Feb  4 09:20:07 CET 2025 - F20_vul_aggregator starting
[*] Tue Feb  4 11:00:00 CET 2025 - F20_vul_aggregator finished

35minutes vs 1h:40minutes ... Feel free to test

modules/F17_cve_bin_tool.sh

m-1-k-3 · 2025-02-04T10:08:45Z

VEX data can be viewed in the SBOM directory:

└─$ jq . ~/firmware-analysis/emba_logs_test1/SBOM/EMBA_sbom_vex_only.json

Currently it is not integrated into the final SBOM. Will come soon.

modules/S118_busybox_verifier.sh

modules/F17_cve_bin_tool.sh

modules/S118_busybox_verifier.sh

+        lVERIFIED_BB_CVE="${lVERIFIED_BB_CVE//;}"
+        local lV_ENTRY="(V)"
+        # ensure we have the correct length
+        lV_ENTRY=$(printf '%s%*s' ${lV_ENTRY} $((19-${#lVERIFIED_BB_CVE}-${#lV_ENTRY})))


modules/S26_kernel_vuln_verifier.sh

+        print_output "[*] Replacing ${lVERIFIED_BB_CVE} in ${LOG_PATH_MODULE}/cve_sum/*_finished.txt" "no_log"
+        local lV_ENTRY="(V)"
+        # ensure we have the correct length
+        lV_ENTRY=$(printf '%s%*s' ${lV_ENTRY} $((19-${#lVERIFIED_BB_CVE}-${#lV_ENTRY})))


m-1-k-3 · 2025-02-11T09:02:46Z

F17 looks quite good and generates a vex only json and integrates the vex data also into the SBOM:

The original CycloneDX SBOM is as before available without VEX data in f15.

Currently we are not passing the BSI check. Looks as we have some little issues in our JSON. This needs further investigations.

m-1-k-3 · 2025-02-11T14:51:39Z

Not too bad :)

└─$ ~/github-repos/sbomqs-linux-amd64 score /home/m1k3/firmware-analysis/emba_logs_test1/SBOM/EMBA_cyclonedx_vex_sbom.json -b
7.6     cdx     1.5     json    /home/m1k3/firmware-analysis/emba_logs_test1/SBOM/EMBA_cyclonedx_vex_sbom.json

└─$ ~/github-repos/sbomqs-linux-amd64 score /home/m1k3/firmware-analysis/emba_logs_test1/SBOM/EMBA_cyclonedx_vex_sbom.json   
SBOM Quality by Interlynk Score:7.6     components:22   /home/m1k3/firmware-analysis/emba_logs_test1/SBOM/EMBA_cyclonedx_vex_sbom.json
+-----------------------+--------------------------------+-----------+--------------------------------+
|       CATEGORY        |            FEATURE             |   SCORE   |              DESC              |
+-----------------------+--------------------------------+-----------+--------------------------------+
| NTIA-minimum-elements | comp_with_name                 | 10.0/10.0 | 22/22 have names               |
+                       +--------------------------------+-----------+--------------------------------+
|                       | comp_with_supplier             | 0.0/10.0  | 0/22 have supplier names       |
+                       +--------------------------------+-----------+--------------------------------+
|                       | comp_with_uniq_ids             | 10.0/10.0 | 22/22 have unique ID's         |
+                       +--------------------------------+-----------+--------------------------------+
|                       | comp_with_version              | 9.5/10.0  | 21/22 have versions            |
+                       +--------------------------------+-----------+--------------------------------+
|                       | sbom_authors                   | 10.0/10.0 | doc has 1 authors              |
+                       +--------------------------------+-----------+--------------------------------+
|                       | sbom_creation_timestamp        | 10.0/10.0 | doc has creation timestamp     |
|                       |                                |           | 2025-02-11T15:46:38+01:00      |
+                       +--------------------------------+-----------+--------------------------------+
|                       | sbom_dependencies              | 0.0/10.0  | doc has 0 dependencies         |
+-----------------------+--------------------------------+-----------+--------------------------------+
| Quality               | comp_valid_licenses            | 3.2/10.0  | 7/22 components with valid     |
|                       |                                |           | license                        |
+                       +--------------------------------+-----------+--------------------------------+
|                       | comp_with_any_vuln_lookup_id   | 9.5/10.0  | 21/22 components have any      |
|                       |                                |           | lookup id                      |
+                       +--------------------------------+-----------+--------------------------------+
|                       | comp_with_deprecated_licenses  | 10.0/10.0 | 0/22 components have           |
|                       |                                |           | deprecated licenses            |
+                       +--------------------------------+-----------+--------------------------------+
|                       | comp_with_multi_vuln_lookup_id | 0.0/10.0  | 0/22 components have multiple  |
|                       |                                |           | lookup id                      |
+                       +--------------------------------+-----------+--------------------------------+
|                       | comp_with_primary_purpose      | 9.5/10.0  | 21/22 components have primary  |
|                       |                                |           | purpose specified              |
+                       +--------------------------------+-----------+--------------------------------+
|                       | comp_with_restrictive_licenses | 10.0/10.0 | 0/22 components have           |
|                       |                                |           | restricted licenses            |
+                       +--------------------------------+-----------+--------------------------------+
|                       | sbom_with_creator_and_version  | 10.0/10.0 | 1/1 tools have creator and     |
|                       |                                |           | version                        |
+                       +--------------------------------+-----------+--------------------------------+
|                       | sbom_with_primary_component    | 10.0/10.0 | primary component found        |
+-----------------------+--------------------------------+-----------+--------------------------------+
| Semantic              | comp_with_checksums            | 10.0/10.0 | 22/22 have checksums           |
+                       +--------------------------------+-----------+--------------------------------+
|                       | comp_with_licenses             | 3.6/10.0  | 8/22 have licenses             |
+                       +--------------------------------+-----------+--------------------------------+
|                       | sbom_required_fields           | 10.0/10.0 | Doc Fields:true Pkg            |
|                       |                                |           | Fields:true                    |
+-----------------------+--------------------------------+-----------+--------------------------------+
| Sharing               | sbom_sharable                  | 0.0/10.0  | doc has a sharable license     |
|                       |                                |           | free 0 :: of 0                 |
+-----------------------+--------------------------------+-----------+--------------------------------+
| Structural            | sbom_parsable                  | 10.0/10.0 | provided sbom is parsable      |
+                       +--------------------------------+-----------+--------------------------------+
|                       | sbom_spec                      | 10.0/10.0 | provided sbom is in a          |
|                       |                                |           | supported sbom format of       |
|                       |                                |           | spdx,cyclonedx                 |
+                       +--------------------------------+-----------+--------------------------------+
|                       | sbom_spec_file_format          | 10.0/10.0 | provided sbom should be in     |
|                       |                                |           | supported file format for      |
|                       |                                |           | spec: json and version:        |
|                       |                                |           | json,xml                       |
+                       +--------------------------------+-----------+--------------------------------+
|                       | sbom_spec_version              | 10.0/10.0 | provided sbom should be        |
|                       |                                |           | in supported spec version      |
|                       |                                |           | for spec:1.5 and versions:     |
|                       |                                |           | 1.0,1.1,1.2,1.3,1.4,1.5,1.6    |
+-----------------------+--------------------------------+-----------+--------------------------------+

And finally BSI compliance

└─$ ~/github-repos/sbomqs-linux-amd64 compliance --bsi /home/m1k3/firmware-analysis/emba_logs_test1/SBOM/EMBA_cyclonedx_vex_sbom.json -b
BSI TR-03183-2 v1.1 Compliance Report
Score:4.0 RequiredScore:5.6 OptionalScore:2.4 for /home/m1k3/firmware-analysis/emba_logs_test1/SBOM/EMBA_cyclonedx_vex_sbom.json

m-1-k-3 · 2025-02-11T14:59:26Z

I think everything is in place to find further bugs ... please give it a try @BenediktMKuehne @beruhan @torabi12 @hands0meware @busby666 and others :)

modules/F17_cve_bin_tool.sh

m-1-k-3 · 2025-02-11T21:29:40Z

The main performance boost can be seen if you enable/disable the VEX_METRICS parameter in the scan profiles:

VEX_METRICS=1:

[*] Tue Feb 11 22:08:08 CET 2025 - F17_cve_bin_tool starting
[*] Tue Feb 11 22:18:22 CET 2025 - F17_cve_bin_tool finished
[!] Tue Feb 11 22:18:27 CET 2025 - Test ended on Tue Feb 11 22:18:27 CET 2025 and took about 0 days and 00:19:32

VEX_METRICS=0:

[*] Tue Feb 11 21:37:16 CET 2025 - F17_cve_bin_tool starting
[*] Tue Feb 11 21:38:53 CET 2025 - F17_cve_bin_tool finished
[!] Tue Feb 11 21:38:55 CET 2025 - Test ended on Tue Feb 11 21:38:55 CET 2025 and took about 0 days and 00:07:43

On the other hand you will loose all the exploit details.

m-1-k-3 added 3 commits January 29, 2025 15:49

cve-bin-tool setup

f53521a

bump docker base image

9b0ecda

fix installer

367e40e

m-1-k-3 added enhancement New feature or request docker docker related things EMBArk Installation Installation issues cve-search Some cve-search question/issue in progress Someone is working on this EMBA SBOM SBOM related issues labels Feb 2, 2025

m-1-k-3 mentioned this pull request Feb 3, 2025

partial ripgrep support #1448

Closed

m-1-k-3 added 4 commits February 4, 2025 10:23

f17 testmodule

7548921

shellcheck

7a162f4

permissions, little fixes

01f95bf

spaces

df38857

cleanup

755d282

github-advanced-security bot found potential problems Feb 4, 2025

View reviewed changes

modules/F17_cve_bin_tool.sh Fixed Show fixed Hide fixed

m-1-k-3 added 10 commits February 4, 2025 11:09

remove var

827b757

dep checking

c8f31e6

spaces

fc57436

duplicate handling

e22564b

add vex profile

48dde14

output

e7bac73

fix emulation results

b01ae92

further adjustments

afa6e72

little cleanup

c1d07a8

var declaration

5446c81

github-advanced-security bot found potential problems Feb 6, 2025

View reviewed changes

modules/S118_busybox_verifier.sh Fixed Show fixed Hide fixed

modules/S118_busybox_verifier.sh Fixed Show fixed Hide fixed

m-1-k-3 added 4 commits February 6, 2025 20:55

cleanup

6e991b6

make s118 integrated into f17

82c5cb0

shellchecker

02e5c06

make s118 integration work

cdfaef8

github-advanced-security bot found potential problems Feb 8, 2025

View reviewed changes

modules/F17_cve_bin_tool.sh Fixed Show fixed Hide fixed

modules/F17_cve_bin_tool.sh Fixed Show fixed Hide fixed

modules/F17_cve_bin_tool.sh Fixed Show fixed Hide fixed

m-1-k-3 changed the title ~~CVE bin tool integration -> F20 replacement~~ CVE bin tool integration, VEX support -> F20 replacement Feb 8, 2025

upload workflows

96b8483

m-1-k-3 mentioned this pull request Feb 9, 2025

Add python runner module S28 #1320

Open

m-1-k-3 added 3 commits February 9, 2025 18:41

make s26 work again

1a0bdff

cleanup

f2093e3

integrate vex into sbom

c52c4d0

github-advanced-security bot found potential problems Feb 11, 2025

View reviewed changes

shellcheck

96b1937

m-1-k-3 added 3 commits February 11, 2025 10:23

adjust sbom

d5714e9

make it valid again2

b9312ca

fix version

fcf61f2

m-1-k-3 removed the in progress Someone is working on this label Feb 11, 2025

cleanup

3f0f904

m-1-k-3 marked this pull request as ready for review February 11, 2025 15:30

m-1-k-3 added 2 commits February 11, 2025 16:35

adjust sbom profiles

5116dbf

preprocssing in thread

d45ae37

github-advanced-security bot found potential problems Feb 11, 2025

View reviewed changes

modules/F17_cve_bin_tool.sh Fixed Show fixed Hide fixed

m-1-k-3 added 3 commits February 11, 2025 22:02

profile adjustments

a550fc2

profile adjustments

a7958aa

profile adjustments

eb6dc81

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CVE bin tool integration, VEX support -> F20 replacement #1452

CVE bin tool integration, VEX support -> F20 replacement #1452

m-1-k-3 commented Feb 2, 2025 •

edited

Loading

m-1-k-3 commented Feb 4, 2025

m-1-k-3 commented Feb 4, 2025

m-1-k-3 commented Feb 11, 2025 •

edited

Loading

m-1-k-3 commented Feb 11, 2025 •

edited

Loading

m-1-k-3 commented Feb 11, 2025

m-1-k-3 commented Feb 11, 2025

CVE bin tool integration, VEX support -> F20 replacement #1452

Are you sure you want to change the base?

CVE bin tool integration, VEX support -> F20 replacement #1452

Conversation

m-1-k-3 commented Feb 2, 2025 • edited Loading

m-1-k-3 commented Feb 4, 2025

m-1-k-3 commented Feb 4, 2025

m-1-k-3 commented Feb 11, 2025 • edited Loading

m-1-k-3 commented Feb 11, 2025 • edited Loading

m-1-k-3 commented Feb 11, 2025

m-1-k-3 commented Feb 11, 2025

m-1-k-3 commented Feb 2, 2025 •

edited

Loading

m-1-k-3 commented Feb 11, 2025 •

edited

Loading

m-1-k-3 commented Feb 11, 2025 •

edited

Loading