fix for Spurious linux_kernel CVEs, cpe string handling

e-m-b-a / emba

EMBA - The firmware security analyzer

https://www.securefirmware.de

GNU General Public License v3.0

2.62k stars 229 forks source link

fix for Spurious linux_kernel CVEs, cpe string handling #1086

Closed m-1-k-3 closed 6 months ago

m-1-k-3 commented 6 months ago

What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)

Bug fix

What is the current behavior? (You can also link to an open issue here)

see https://github.com/e-m-b-a/emba/issues/1080

What is the new behavior (if this is a feature change)? If possible add a screenshot.

closes https://github.com/e-m-b-a/emba/issues/1080

m-1-k-3 commented 6 months ago

@gluesmith2021 could you give it a try

gluesmith2021 commented 6 months ago

@gluesmith2021 could you give it a try

Fix works perfectly. Diff between CVE results from before-fix and after-fix on my sample also reveals that other software was affected, i.e. not only linux_kernel as is the original issue. For example, "lua:5.1.2" would incorrectly match those two CVEs for the same reason:

The fix prevents such incorrect matches. Thank you.