How to scan a generic Linux kernel

[firmianay]

Great work! Can I use it for a generic Linux kernel instead of an Android kernel? I looked at the Linux ecosystem on the OSV website, but it doesn't seem to be the latest dataset, and there is no corresponding Vanir signature. What should I do? Thank you.

[doryiii]

Thanks for your interest! Right now Google only generates signatures for Android-related vulns. Of course you can run Vanir with the Android dataset on a generic kernel, but you will miss out on vulns that would not affect Android. We do see interests in generic kernel vulns, and have some rough idea on how to support those, but currently we do not have the resources to implement this yet.

This work would involve:

1. Obtaining kernel vulns (osv.dev is an easy source, but it is a bit out of date. The most up-to-date kernel vuln info can be found in https://git.kernel.org/pub/scm/linux/security/vulns.git/tree/cve/published).
2. Parsing them to figure out which patch is the original fix out of all the backports.
3. Write a code_extractor module that can handle kernel.org patches.
4. Run sign_generator_runner (or write your own signature generation system using Vanir as a library).

You can also try doing this yourself. We welcome any and all contributions!

[firmianay]

Hi, I see that the program has been significantly updated. Does it now support generic kernel scanning? What should I do now?

[doryiii]

We are working with people at OSV.dev to publish Vanir signature to vulns in their GIT ecosystem (https://osv.dev/list?ecosystem=GIT), which contains a lot of widely-used libraries, as the first expansion outside of Android. If that goes well, we will probably be able to expand this to other ecosystems too, and the Linux kernel would be a first candidate.

[firmianay]

I used this format to generate the signature and it worked fine. The question is, when the number of vulnerabilities is large, a lot of time is spent on network requests. If I have cloned the repository, can I generate it locally without a hosted web application?

    {
        "id": "CVE-2024-58091",
        "modified": "xxxx",
        "affected": [{
            "ranges": [{
                "type": "GIT",
                "repo": "https://github.com/torvalds/linux.git",
                "events": [{"fixed": "0d087de947babf7ed70029d042abcc6ed06ff415"}]
            }]
        }]
    },

[doryiii]

If I have cloned the repository, can I generate it locally without a hosted web application?

We don't have an exposed commandline argument for this yet, but for now you can manually modify vanir/code_extractors/code_extractor.py to pass git_instead_ofs as a parameter to extract_commits_for_affected_entry(). E.g.

  return extractor_class().extract_commits_for_affected_entry(
      affected, requests_session=session, git_instead_ofs=[('https://github.com/torvalds/linux.git', 'file:///your/local/repo')]
  )

A small note in case you have not done this: be careful that you have obtained all objects in your clone. Some are not transfered via a regular git clone; for example, if you just do git clone https://github.com/torvalds/linux.git, the commit in your example (0d087de947babf7ed70029d042abcc6ed06ff415) will not be cloned. The easiest way to get everything would be to do a git clone --mirror.

[firmianay]

I tried several times as follows, but I don't quite understand why the local fetch is affected by the "--depth=2" parameter, while the remote server is not.

$ git clone --mirror https://github.com/google/vanir.git
$ git --git-dir=./vanir_git --no-pager init
$ git --git-dir=./vanir_git --no-pager config extensions.partialClone true

$ git --git-dir=./vanir_git --no-pager fetch --filter=blob:none --no-tags --depth=2 https://github.com/google/vanir.git 99ff4b3a9d0fe7359346d088c4b142ad3c55cf62
From https://github.com/google/vanir
 * branch          99ff4b3a9d0fe7359346d088c4b142ad3c55cf62 -> FETCH_HEAD
$ git --git-dir=./vanir_git --no-pager fetch --filter=blob:none --no-tags --depth=2 file:///home/test/vanir.git 9
9ff4b3a9d0fe7359346d088c4b142ad3c55cf62
warning: filtering not recognized by server, ignoring
error: Server does not allow request for unadvertised object 99ff4b3a9d0fe7359346d088c4b142ad3c55cf62
$ git --git-dir=./vanir_git --no-pager fetch --filter=blob:none --no-tags file:///home/test/vanir.git 99ff4b3a9d0
fe7359346d088c4b142ad3c55cf62 
From file:///home/test/vanir
 * branch            99ff4b3a9d0fe7359346d088c4b142ad3c55cf62 -> FETCH_HEAD

$ git --git-dir=./vanir_git --no-pager config --add url.file:///home/test/vanir.git.insteadOf https://github.com/google/vanir.git
$ git --git-dir=./vanir_git --no-pager fetch --filter=blob:none --no-tags --depth=2 https://github.com/google/vanir.git 99ff4b3a9d0fe7359346d088c4b142ad3c55cf62
warning: filtering not recognized by server, ignoring
error: Server does not allow request for unadvertised object 99ff4b3a9d0fe7359346d088c4b142ad3c55cf62
$ git --git-dir=./vanir_git --no-pager fetch --filter=blob:none --no-tags https://github.com/google/vanir.git 99ff4b3a9d0fe
7359346d088c4b142ad3c55cf62 
From file:///home/test/vanir
 * branch            99ff4b3a9d0fe7359346d088c4b142ad3c55cf62 -> FETCH_HEAD

[doryiii]

Interesting. I cannot reproduce this though; what's your git version? I am on 2.51.0:

❯ git clone --quiet --mirror https://github.com/google/vanir.git vanir_local
❯ git --git-dir=./vanir_out --no-pager init --quiet
❯ git --git-dir=./vanir_out --no-pager config extensions.partialClone true
❯ git --git-dir=./vanir_out --no-pager fetch --filter=blob:none --no-tags --depth=2 file:///tmp/vanir_local 99ff4b3a9d0fe7359346d088c4b142ad3c55cf62
warning: filtering not recognized by server, ignoring
remote: Enumerating objects: 167, done.
remote: Counting objects: 100% (167/167), done.
remote: Compressing objects: 100% (129/129), done.
remote: Total 167 (delta 45), reused 129 (delta 35), pack-reused 0 (from 0)
Receiving objects: 100% (167/167), 1.06 MiB | 25.82 MiB/s, done.
Resolving deltas: 100% (45/45), done.
From file:///tmp/vanir_local
 * branch            99ff4b3a9d0fe7359346d088c4b142ad3c55cf62 -> FETCH_HEAD

❯ git --git-dir=vanir_out rev-list 99ff4b3a9d0fe7359346d088c4b142ad3c55cf62 -2                                                            
99ff4b3a9d0fe7359346d088c4b142ad3c55cf62
de3fb6d6cc3d5521520747748855c87d311e2b43

[firmianay]

I was using 2.25.1, and after reinstalling 2.51.0, everything worked fine

[Yan-Yan98]

Hi all,
what is the current state for supporting generic Linux kernel scanning?
We expanded vanir in our project to support the Linux kernel and would be willing to upstream those changes.

[doryiii]

Hi all, what is the current state for supporting generic Linux kernel scanning?

We had to shuffle priorities a bit; we're currently focusing on getting automated CI build/release/intake process for Vanir, as well as expanding Vanir to non-Google userspace vulns (which is just now live on vulns with available patches on https://osv.dev/list?ecosystem=GIT). Due to that, generic kernel support was pushed back.

We expanded vanir in our project to support the Linux kernel and would be willing to upstream those changes.

If you have made changes that enable Vanir to work with generic kernel vulns, by all means, create a PR! We're more than happy to accept contributions. Make sure you or your organization have accepted the Google CLA (https://cla.developers.google.com/clas) as our legal team requires that for contributions to be included in Vanir github release; you will still be credited.

Just out of curiosity; you don't have to answer if you don't want to, but may I know which organization you're working for?

[Yan-Yan98]

Sounds good! I'll probably create the PR tomorrow.
The Google CLA is already signed by my organization (BMW).