TimesysGit / vigiles-openwrt

Vulnerability management tool that provides OpenWRT SBOM generation and CVE Analysis of target images.
10 stars 6 forks source link

Kernel Build directory not found #4

Closed valdumped closed 2 years ago

valdumped commented 2 years ago

Hello, I have tried to run a scan on an openwrt generic x86 build. The scan runs fine and find userspace vulnerabilities until the kernel config is retrieved and I get the Warning message : "Vigiles WARNING: Kernel Config: Kernel Build directory not found."

Using the -k option with specific path to the kernel configuration in the debug messages i can see that the kernel configuration is taken into account, but if I read the documentation correctly, this option only allows you to filter the CVEs ?

How can I get Vigiles to find my Kernel build directory? Or what is the default path to use in order to retrieve this configuration?

Thank you for your answer

iancampbell commented 2 years ago

The -k option allows for the specification of an external or not standard location of the kernel config. Uploading a kernel config allows Vigiles to filter out CVEs that are not applicable to your configuration as some CVEs may only affect modules that are not enabled in your configuration.

There is currently no way to manually specify the directory to look for specific packages, including the kernel.

To help us reproduce and fix this issue please provide us with the following information if you are able to:

If you are unable to publicly share this information an issue can also be created through our support portal.

valdumped commented 2 years ago

Thank you for your quick answer, ok I understand better the -k option. Normally the kernel config is retrieved through the path openwrt/build_dir/toolchain-x86_64_gcc-xxx/linux-x.x.x?

To do the scan I only cloned the last version of OpenWrt on the github and built a generic version:

Build informations :

config.zip

I hope there is enough informations or I can try to make a ticket on the support.

iancampbell commented 2 years ago

Is it possible that a relative path was used when specifying the build path?

Example with absolute path:

./vigiles-openwrt.py -b /home/user/projects/openwrt

We currently have a fix to remove the absolute path requirement that will be released once it passes our testing and review stages.

valdumped commented 2 years ago

Yes it was exactly the problem I had. Using an absolute path fixed the problem thank you for your help !