Comparison and Proposal of Vulnerability Management Approaches in Yocto-Based...
Talkat Open Source Summit Japan + AI_dev: Open Source GenAI & ML Summit + Automotive Linux Summit 2025 · 2025-12-08..12-10·
summary
Comparison runs on two smart‑grid Yocto images and simulates two detection events: an April 10 kernel sound CVE that proves a false positive and a September 5 project timer CVE that is confirmed exploited and triggers CERT/CSIRT notifications and a fix release within 14 days. Evaluation finds cb_check requires bitbake and must preserve Yocto cache, while ytox_check is 6–7× faster and produces OpenVEX/SPDX2.2 output; converting SPDX to CycloneDX for Dependency‑Track fails in places, so cb_check is usable today and ytox_check has the most future potential.
AI-written summary · about
chapters (10)
- 0:00Vulnerability management intro
- 2:34Vulnerability methods overview
- 8:46Three tools comparison
- 14:23Evaluation setup and tests
- 18:51Yocto CVE check simulation
- 24:43Yocto VEX check simulation
- 29:50Dependency Track evaluation
- 31:40Pros and cons of methods
- 33:06Conclusion and future work
- 34:02Q&A
related talks
35mDetecting and Defusing the Ticking Time Bomb: Understanding CVEs and Upstreaming in Yocto
37mTracking Vulnerabilities with Buildroot and Yocto
53mThe Cyber Resilience Act: Navigating Its Impact on Yocto-Based Products
40mOpen Source CVE Monitoring and Management: Cutting Through the Vulnerability Storm- 53mThe Cyber Resilience Act: Navigating Its Impact on Yocto-Based Products
34mYocto Project/OpenEmbedded Meets Security
19mScanning for known vulnerabilities in an embedded distribution
24mOvercoming CVE Shock - Adding Perspective in Vulnerability Scanning