Open Source CVE Monitoring and Management: Cutting Through the Vulnerability Storm
summary
Claims that NVD/MITRE CPE data often contains typos and inconsistent names, causing both missed vulnerabilities and many false positives; 2018 saw 16,000+ CVEs, a ~300/week rate that makes manual triage infeasible. Demonstrates practical filtering: kernel-config filtering cuts 658 → 432 CVEs and scoring/attack-vector filters shrink lists further. Shows Yocto tooling (the cve-check class and new CV update database using JSON) and reports that moving to logical version comparisons uncovers about ten additional CVEs versus the old XML string match.
AI-written summary · about
chapters (23)
- 0:00Intro
- 0:56CVE what?
- 2:45How much does security mean to you?
- 5:21CVE content
- 7:33How to monitor CVES? Linux Distro model
- 9:05DIY CVE monitoring
- 10:44CVE monitoring in Yocto Bullin support for automatic checking CVES
- 11:32I have a CVE list, now what?
- 13:55DIY CVE Patching
- 15:04Upgrade vs. Backport
- 17:32Reasons to upgrade
- 18:42CVE data quality (False positives and misses)
- 20:49Yocto solutions
- 22:26Yocto CVE report bugs' YMMV
- 23:33Yocto CVE check improvements YMMV
- 26:03Linux kernel CVES
- 27:26Delays in CVE reporting / analysis
- 30:19Fun stats on delays
- 31:07Leveraging work done by others!
- 32:05Secure boot and chain of trust
- 33:45Layered approach
- 35:12Tools wishlist
- 36:49Take away
related talks
35mDetecting and Defusing the Ticking Time Bomb: Understanding CVEs and Upstreaming in Yocto
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)
37mTracking Vulnerabilities with Buildroot and Yocto
30mThe Growing Crisis in CVE Data Quality
41mKeeping Up With The Joneses (CVEs)
30mThe National Vulnerability Database (NVD) – Where It Is and Where It’s Going
01mEvolution of CVEs and Vulnerability Management
53mThe Trials and Tribulations of Bulk Converting CVEs to OSV