[PATCH v4 0/3] Check compiled files to filter kernel CVEs

[<daniel.turull@ericsson.com>]

From: Daniel Turull <daniel.turull@ericsson.com>

Since kernel.org became a CNA, more information is available in the published CVEs, including details about which files are affected by a given CVE.

I have rewritten the original patch after the feedback received, including only the basic functionality in the build (extracting the sources as a text file and inside spdx)
and created a postprocessing script that enrich the cve-summary.

To filter out CVEs that are not applicable, we extract the files used during the kernel compilation and
compare it with the metadata in the CVE.

To enabled, add in your local.conf SPDX_INCLUDE_COMPILED_SOURCES.

This could use as a base to run the vulnerability check independently and run an external tool to filter the CVEs.

This patch can reduce the noise of kernel CVEs by around 70% with the default qemu kernel config and even more with smaller kernels.

Kernel     | Total CVEs | Fix backported | Vulnerable | Filter with x86-64 qemu yocto compiled files
6.12.28    |   1201     |  1138          | 63         |  25
6.6.90     |   3121     |  2877          | 244        |  80
6.1.138    |   2979     |  2522          | 457        |  142
5.15.182   |   3767     |  3005          | 762        |  230
5.10.237   |   3586     |  2622          | 964        |  288
5.4.293    |   3030     |  1806          | 1224       |  394

When looking at the spdx source files included in the linux-yocto with a qemu-x86-64 build, it goes from 86989 to 38312 files included, since only c files are removed.

v1: initial proposal
v2:
  - rewrite kernel_vulns to fetch similarly as cve-update-db-native
  - add functionality into cve_check.py, for the classes that uses oe.get_patched_cves function
  - add linux-vulns into the cve-check results
  - add only compiled files in the spdx, so the check can be done outside the build
  - include compiled files into spdx when CVE_CHECK_KERNEL_CONFIG and SPDX_INCLUDE_SOURCES is enabled
v3:
  - make inclusion of compiled files generic for SPDX, so other systems that has knowledge of used files can also make more accurate sboms
  - have the functions to extract files in kernel.bbclass. For other recipes that in the future want to use this feature can add the function in their recipe or in a build bbclass.
  - move order of patches
  - explicitly have the save_compiled_files added only when having the CVE_CHECK_KERNEL_CONFIG
  - add first kernel cves in cve_check, so manual CVE_STATUS is preserved
  - add CVE_STATUS for false positives
v4:
 - Refactor and reduce series to 3 patches, one for spdx, one for the kernel, and one standalone script

CC: Peter Marko <peter.marko@siemens.com>
CC: Marta Rybczynska <rybczynska@gmail.com>
CC: Joshua Watt <JPEWhacker@gmail.com>

Daniel Turull

Daniel Turull (3):
  spdx: add option to include only compiled sources
  kernel: add support to extract compiled files
  improve_kernel_cve_report: add script for postprocesing of kernel CVE
    data

 meta/classes-recipe/kernel.bbclass           |  19 +
 meta/classes/create-spdx-2.2.bbclass         |   9 +
 meta/classes/spdx-common.bbclass             |   3 +
 meta/lib/oe/spdx30_tasks.py                  |   9 +
 meta/lib/oe/spdx_common.py                   |  33 ++
 scripts/contrib/improve_kernel_cve_report.py | 437 +++++++++++++++++++
 6 files changed, 510 insertions(+)
 create mode 100755 scripts/contrib/improve_kernel_cve_report.py