kernel-cve-tool

A tool for reviewing downstream Linux kernel repositories for CVE patches.

Setup

1. Clone the git repository with your Linux kernel and checkout the branch you want to review. For example:

   $ git clone https://github.com/OE4T/linux-tegra-4.9.git -b oe4t-patches-l4t-r32.6
   

2. Add linux-stable as a git remote and fetch it:

   $ git remote add stable git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git
   $ git fetch stable
   

3. In a different directory, clone the linux_kernel_cves repository:

   $ git clone https://github.com/nluedtke/linux_kernel_cves.git
   

4. cd to where you checked out your kernel repo and run kernel-cve-tool:

   $ kernel-cve-tool -P /path/to/linux_kernel_cves
   

The upstream stable kernel repo is needed for locating commits for fixes that may not be present in your local repository. The linux_kernel_cves repository is a data set that maps CVEs to upstream kernel commits.

Note that the script assumes that your branch is derived from one of the existing stable kernel labels (e.g., 'v4.9') - in other words, it must contain commits from one of the linux-X.Y branches in the stable repository, and have other commits added it to it.

Execution

The script parses the top-level makefile to determine the base kernel version, parses the JSON data files in linux_kernel_cves, and builds a list of CVEs to look for.

Initially:

• CVEs listed as fixed in versions earlier than the current SUBLEVEL are assumed to be present.
• CVEs fixed in versions after the current SUBLEVEL or listed in the data set as 'outstanding' are assumed to be unfixed.

The script then searches for commits that contain either the git hash corresponding to the reported fix (if present in the data set) for each of the CVEs in the 'unfixed' list, and/or the exact subject line for the fix commit. If found in the current branch, the CVE is moved to the 'fixed' list.

Note that this processing can take several minutes.

When the scan is complete, two files are created in the current directory:

• PATCHED-CVES: lists the CVEs in the 'fixed' list
• NO-FIXES-AVILABLE: lists the CVEs that have no patches available
• cherry-picks.list: lists the git hashes for manual cherry-picking with:

  $ cut -d: -f1 cherry-picks.list | git cherry-pick -x --stdin  
  

  For CVEs that are not (yet) fixed upstream in the version of the kernel on which your tree is based, but have commits for some other (presumably later) version, the entries in the cherry-pick list will be tagged with the legend (NOT THIS VERSION). Applying those patches will likely be more difficult.

Checking specific CVEs with kernel-cve-vercheck

Using the same setup as described above, the kernel-cve-vercheck tool can be used to get information about a specific CVE, based on the information in the database. For each CVE number specified on the command line, the tool will determine if it is applicable by comparing the current kernel version to the "stream" data in the database for that version, and classify the CVE as patchable (fix available in a later version), outstanding (no patch available for the current kernel version), or not applicable (patch not applicable to the current version, or already patched). Only the database information is used; this tool does not search the local git repository for patches that may have been applied. It does examine the local Makefile to determine the kernel version, however.

Please note

This code comes with no warranties or assurances as to its suitability for any particular purpose. Use at your own risk.