CVEhound is a tool for checking linux sources for known CVEs. The tool is based on coccinelle rules and grep patterns. The tool checks sources for vulnerable code patterns of known CVEs and missing fixes for them.
Ubuntu, coccinelle uses libpython2.7 internally Seems like some ppas mark libpython dependency as optional sudo apt install python3-pip coccinelle libpython2.7 Fedora sudo dnf install python3-pip coccinelle
To install the latest stable version just run the following command:
python3 -m pip install --user cvehound
For development purposes you may install cvehound in "editable" mode directly from the repository (clone it on your computer beforehand):
pip install -e .
The simplest way to start using CVEhound is to run the following command:
cvehound --kernel ~/linux Found: CVE-2020-27830 Found: CVE-2020-27152 Found: CVE-2020-29371 Found: CVE-2020-26088
where dir should point to linux kernel sources. CVEhound will check the sources for all cve patterns that you can find in cve dir. To check the sources for particular CVEs one can use:
cvehound --kernel ./linux --kernel-config --cve CVE-2020-27194 CVE-2020-29371 Checking: CVE-2020-27194 Found: CVE-2020-27194 MSG: bpf: Fix scalar32_min_max_or bounds tracking CWE: Improper Restriction of Operations within the Bounds of a Memory Buffer FIX DATE: 2020-10-08 09:02:53 https://www.linuxkernelcves.com/cves/CVE-2020-27194 Affected Files: - linux/kernel/bpf/verifier.c: CONFIG_BPF & CONFIG_BPF_SYSCALL linux/.config: affected Config: ./linux/.config affected Checking: CVE-2020-29371 Found: CVE-2020-29371 MSG: romfs: fix uninitialized memory leak in romfs_dev_read() CWE: Use of Uninitialized Resource FIX DATE: 2020-08-21 16:52:53 https://www.linuxkernelcves.com/cves/CVE-2020-29371 Affected Files: - linux/fs/romfs/storage.c: CONFIG_ROMFS_FS linux/.config: not affected Config: ./linux/.config not affected
--report- will produce json file with found CVEs Most of metainformation in generated report is taken from linuxkernelcves.com
--kernel-config <file>- will infer the kernel configuration required to build the affected code (based on Kbuild/Makefiles, ifdefs are not checked) and check kernel .config file if there is one
--cwe- will limit the scope of checked cves to the kernel files of interest or specific CWE classes
--exploit- check only for CVEs that are known to be exploitable (according to the FSTEC BDU database)
Python code is licensed under GPLv3. All rules in cvehound/cve folder are licensed under GPLv2.
I would like to thank the following projects and people behind them: