Tracking Vulnerabilities with Buildroot and Yocto
summary
Explains practical vulnerability tracking for Buildroot and Yocto using NVD/CPE data and the actual commands and outputs: make package-stats downloads NVD JSON, caches 24 hours and emits JSON/HTML; Yocto uses inherit cve-check and per-recipe CVE files. Calls out CPE mismatch problems, incorrect NVD ranges, and that Linux shows ~1,000 CVEs in a build. Shows limitations: need full buildroot/Yocto sources to regenerate lists, build-only packages are included, exclusions require source edits, and suggests weekly CI checks and moving toward SBOM/OSV integration.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:04Tracking vulnerabilities matters
- 3:52CVE and CPE databases
- 8:17CPE limitations for open source
- 12:17Vulnerability tracking in Buildroot
- 16:18Buildroot exclusions and limits
- 21:15Post-release CVE evaluation
- 23:01Vulnerability tracking in Yocto
- 25:32Yocto CVE tracking limits
- 26:34Software Bill of Materials alternative
- 27:18OSV database and ecosystems
- 29:06OSV adoption challenges
- 31:19Summary and tooling recs
- 31:52Q&A: Kernel vulnerabilities
- 32:37Q&A: Field updates for devices
- 34:05Q&A: CVE and OSV cross-ref
- 35:47Q&A: NVD shutdown impact
related talks
35mDetecting and Defusing the Ticking Time Bomb: Understanding CVEs and Upstreaming in Yocto
40mOpen Source CVE Monitoring and Management: Cutting Through the Vulnerability Storm
42mComparison and Proposal of Vulnerability Management Approaches in Yocto-Based...
19mScanning for known vulnerabilities in an embedded distribution
30mDistribution Builders Meet VEX
30mThe National Vulnerability Database (NVD) – Where It Is and Where It’s Going
26mConfig Based CVE Matching for Linux Kernel
53mThe Cyber Resilience Act: Navigating Its Impact on Yocto-Based Products