Prioritizing the Linux OS Hardening and CVE Mitigation
summary
Analysis of Linux kernel CVEs since 2021 drives a concrete triage: prioritize by CVSS base metrics first, cross‑reference EPSS probabilities and whether a CVE appears in the exploited catalog, and focus fixes with highest combined score. Production practice uses an internal JSON CVE database, automated scans (EPSS/CVSS feeds), backporting to LTS and delivering a k‑overlay with CVE patches to customers plus a lightweight microvisor toolkit for reduced attack surface.
AI-written summary · about
chapters (10)
- 0:00Linux OS hardening intro
- 1:27CVE and OS hardening basics
- 3:17CVE reporting process
- 5:25Kernel.org CNA 2024 changes
- 7:14Prioritizing CVEs with threat modeling
- 8:38Evaluating CVSS scores
- 10:25Exploited vulns and EPSS scores
- 12:53System hardening benchmarks
- 15:21Production kernel tools
- 16:49Q&A
related talks
17mSustaining Yesterday’s Linux: Delivering Security for Today’s Workloads
21mFrom CVEs To Compliance: Automating Embedded Linux Kernel Security
36mLinux Kernel CVEs: What Has Caused So Many to Suddenly Show Up?
35mKeeping Up with the CVEs: How to Find a Needle in a Haystack?
28mKernel CVEs are Alive, but Do Not Panic!
30mCVE Context Matters, but Do All Vulnerabilities Really Matter?
26mConfig Based CVE Matching for Linux Kernel
51mWhen it Comes to Managing Risk, Context is King