Scanning for known vulnerabilities in an embedded distribution
summary
Oniro builds from source with Yocto/OpenEmbedded, targets IoT and supports multiple kernels, and runs roughly ~300 packages per product build; vulnerability scanning uses cvcheck (version-only lookups) plus a coverage extension that flags NVD mismatches. Findings: about half of reported CVEs map to the Linux stack, version mismatches and backports hide fixes (example: Python backport fixed in 3.8.12), and a libdecrypt CVE-id/patch mismatch required repo comments and Yocto fixes. Future: machine‑readable issue feeds, upstream stable‑branch scans, puppet detection, and continued hardening.
AI-written summary · about
chapters (11)
- 0:00Intro
- 0:52Neuro
- 2:00Why is scanning important
- 2:58Common vulnerabilities and exposures
- 5:45Notes from the practice
- 7:29CVCheck
- 8:50What we found
- 9:51Coverage
- 11:31libdecrypt
- 13:53Summary
- 14:32QA
related talks
34mYocto Project/OpenEmbedded Meets Security
37mTracking Vulnerabilities with Buildroot and Yocto
35mDetecting and Defusing the Ticking Time Bomb: Understanding CVEs and Upstreaming in Yocto
42mScan, Patch, VEX - Using Open Source Tools to Manage...
42mComparison and Proposal of Vulnerability Management Approaches in Yocto-Based...
42mNavigating the Sea of CVEs: Securing Your Linux Distributions
40mSecuring a Yocto-based Distribution: The Case of AllScenariosOS
40mOpen Source CVE Monitoring and Management: Cutting Through the Vulnerability Storm