English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

In vulnerability assessments, software component-based CVE attribution is acommon method to identify possibly vulnerable systems at scale. However, suchversion-centric approaches yield high false-positive rates for binarydistributed Linux kernels in firmware images. Not filtering included vulnerablecomponents is a reason for unreliable matching, as heterogeneous hardwareproperties, modularity, and numerous development streams result in a plethoraof vendor-customized builds. To make a step towards increased resultreliability while retaining scalability of the analysis method, we enrichversion-based CVE matching with kernel-specific build data from binary imagesusing automated static firmware analysis. We open source an attributionpipeline that gathers kernel configuration and target architecture to dry buildthe present kernel version and filter CVEs based on affected file references inrecord descriptions. In a case study with 127 router firmware images, we showthat in comparison to naive version matching, our approach identifies 68% ofall version CVE matches as false-positives and reliably removes them from theresult set. For 12% of all matches it provides additional evidence of issueapplicability. For 19.4%, our approach does not improve reliability becauserequired file references in CVEs are missing.

Towards Reliable and Scalable Linux Kernel CVE Attribution in Automated Static Firmware Analyses