Navigating the Sea of CVEs: Securing Your Linux Distributions
summary
OSV.dev aggregates over 300,000 advisories across 31 ecosystems and 21 vulnerability databases and adds an upstream field to map distro trackers (USN, DSA) to CVEs so distro-specific fixes are clear. Two tools exist: OSV-Scanner (CLI) and OSV-Scannable (library). OSV-Scanner does container and project scans, uses distro advisories to avoid false positives, and applies function- and package-level reachability (Rust/Go function-level, Java static analysis) to hide unreachable findings — e.g., 170 reported down to ~130, saving ~20% triage time.
AI-written summary · about
chapters (11)
- 0:00Introduction
- 1:25Linux distribution advisories
- 8:14OSV and its infrastructure
- 12:12Mapping CVE relationships
- 15:28Navigating vulnerability data
- 17:55OSV scanner for projects
- 20:25Container scan vulnerabilities
- 24:41Reducing noise with reachability
- 27:28VEX for vulnerability management
- 35:23VEX adoption challenges
- 41:05Q&A
related talks
41mScalable Management of Vulnerabilities in Open Source
24mLessons from OSV: Vulnerability Management for Open Source
36mSecurity Scanning - Past/Present/Future
35mKeeping Up with the CVEs: How to Find a Needle in a Haystack?
55mLet’s Talk About Fitness for Purpose: Comparing and Contrasting the CVE List with OSV.dev
24mOvercoming CVE Shock - Adding Perspective in Vulnerability Scanning
35mDetecting and Defusing the Ticking Time Bomb: Understanding CVEs and Upstreaming in Yocto
40mOpen Source CVE Monitoring and Management: Cutting Through the Vulnerability Storm