search

intel / cve-bin-tool

The CVE Binary Tool helps you determine if your system includes known vulnerabilities. You can scan binaries for over 200 common, vulnerable components (openssl, libpng, libxml2, expat and others), or if you know the components used, you can get a list of known vulnerabilities associated with an SBOM or a list of components and versions.
https://cve-bin-tool.readthedocs.io/en/latest/
GNU General Public License v3.0
1.18k stars 454 forks source link

GSoC 2024 brainstorming #3524

Closed terriko closed 4 months ago

terriko commented 9 months ago

GSoC 2024 has been officially announced and the schedule is up here: https://developers.google.com/open-source/gsoc/timeline

We'll want to have some viable ideas nailed down around the end of January for when Python puts in an org application. But the first step to this is brainstorming on all ideas (including ones that may not work out for various reasons) so feel free to just throw ideas around here and we'll narrow it down later.

Some wishlist items off the top of my head to get the discussion started:

  1. Improved PURL/SBOM support and other input data quality tools
    • helping people annotate SBOMs with PURL data or otherwise improve SBOM quality
    • improved PURL support for our language parsers (some of this may happen before gsoc but I suspect there will still be work to do by then)
    • we'd previously discussed using additional metadata (e.g. from language package repositories) to improve scan quality but didn't get a taker for that gsoc project, so it might get rolled into a new one
  2. Improved Triage tooling:
    • warning when triage goes "out of date"
    • improved support for using multiple triage files
    • improved tooling and guidance (documentation) on how to triage, how to share triage, how to use shared triage. I suspect that in writing documentation people will find a few more gaps.
terriko commented 9 months ago
terriko commented 9 months ago
terriko commented 9 months ago
terriko commented 9 months ago
terriko commented 9 months ago
terriko commented 9 months ago
terriko commented 9 months ago
terriko commented 9 months ago
terriko commented 9 months ago

Two ideas from gsoc 2023 that didn't get chosen/completed:

We'll likely rework those a bit before using them, but they could potentially be viable options in 2024.

And one even older one to show that we've been thinking about triage for a while...

JCoonradt commented 7 months ago

Hello, my name is Jensen! I am new to open-source development, but I have extensive programming experience and a passion for cybersecurity. I would love to get involved with the CVE Binary Tool Project, and I hope to apply to Google Summer of Code. An interesting project could be creating a Ghidra-based backend for the CVE Binary Tool scanner. By incorporating Ghidra’s binary pattern analysis, it could be possible to improve the vulnerability scanning. This project would probably fall under the consideration of improved SBOM generation tools. Also, if you have any advice on getting involved with the CVE Binary Tool Project, that would be amazing!

terriko commented 7 months ago

@JCoonradt that sounds intriguing, but I don't think we have any mentors familiar with Ghidra to run that this year, and we've got a few more urgent needs that are much more likely to get selected. The biggest issue in my brain right now is anything that can improve the matching for the language parsers and sboms to avoid false positives based on common names, but we'll be discussing ideas and prioritizing during our monthly meeting on Wednesday so I'll have some better described project ideas after that.

anthonyharrison commented 7 months ago

Hello, my name is Jensen! I am new to open-source development, but I have extensive programming experience and a passion for cybersecurity. I would love to get involved with the CVE Binary Tool Project, and I hope to apply to Google Summer of Code. An interesting project could be creating a Ghidra-based backend for the CVE Binary Tool scanner. By incorporating Ghidra’s binary pattern analysis, it could be possible to improve the vulnerability scanning. This project would probably fall under the consideration of improved SBOM generation tools. Also, if you have any advice on getting involved with the CVE Binary Tool Project, that would be amazing!

@JCoonradt Thanks for the idea but Ghidra is a very complicated Java project. I consider that getting Ghidra to produce the information which we could use in the tool is non-trivial and certainly not within the capabilities of a typical GSOC student. I have looked briefly at Ghidra and I don't think it is suitable for generating the binary checkers we need for cve-bin-tool. However, if you have a prototype to show how the binary analysis capabilities of Ghidra could be used, then it would be interesting to look at. (note that there are already a number of binary analysis tools in Python which might be worth considering as they may offer a better integration route for cve-bin-tool).

I agree with @terriko in that the improvements to language parsers to remove false positives and improve the component matching SBOM triage process (there is a lot of work to do in this area now) are more pressing at this stage.

terriko commented 7 months ago

Notes from Jan monthly meeting:

Idea not for gsoc:

terriko commented 7 months ago

Additional notes from Terri:

terriko commented 4 months ago

Brainstorming is long over for this year (we're into selection now) so I'll close up this thread.