Package: cvehound
CVEhoundCVEhound is a tool for checking linux sources for known CVEs.
The tool is based oncoccinellerules and grep patterns. The tool checks sources for vulnerable
code patterns of known CVEs and missing fixes for them.What:The tool tries to find "unfixed" code of known CVEs;How:The tool usescoccinelle/greprules with patterns that helps to detect known CVE bugs or their fixes. Thus, sources are checked either for a presence of "unfixed" code pieces (e.g.CVE-2020-12912), or for an absence of a fix (e.g.CVE-2020-26088);Why:If you have a git log then it's easier to check what CVEs are fixed based on a git history. However, many vendors (samsung, huawei, various iot, routers manufacturers) publish kernel sources as archives without a development log. In most cases their kernels are based on LTS kernels, but versions are far from upstream. Linux version string from Makefile will only give you an information about what CVEs were fixed by kernel developers upto this version. It will not help you to understand what fixes were backported by a vendor itself. In this case it's possible to apply the tool and check "missing" CVE fixes.CVEHound: Audit Kernel Sources for Missing CVE FixesLinux Security Summit 2021 Presentation (EN)ZeroNights 2021 Presentation (RU)Found issues in stable treesCVE-2020-27825 fixmissing backportsfor5.4, 4.19, 4.14, 4.9, 4.4 kernelsCVE-2021-4149 fixmissing backportsto4.19, 4.14, 4.9 kernelsCVE-2022-26490 fixmissing backportsCVE-2023-1989 fix missing backports for6.1, 5.15, 5.10, 5.4, 4.19, 4.14 kernelsSimilar to CVE-2021-28660fix in r8188eu driverSimilar to CVE-2021-28660fix in rtl8723bs driverSimilar to CVE-2022-26490fixinst-nci driverSecurityregression CVE-2020-10781Seetests exceptionsfor more examplesPrerequisitesPython 3 (>=3.5)pip (Python package manager)grep with pcre support (-P flag)coccinelle (>= 1.0.7)Install prerequisites:# Ubuntu, coccinelle uses libpython2.7 internally# Seems like some ppas mark libpython dependency as optional$sudoadd-apt-repositoryppa:npalix/coccinelle
$sudoaptinstallpython3-pipcoccinellelibpython2.7# Fedora$sudodnfinstallpython3-pipcoccinelle# macOS$brewinstallcoccinelleInstallationTo install the latest stable version just run the following command:$python3-mpipinstall--usercvehoundFor development purposes you may install cvehound in "editable" mode
directly from the repository (clone it on your computer beforehand):$pipinstall-e.To update the cve rules from github repository:$cvehound_update_rulesHow to useThe simplest way to start using CVEhound is to run the following command:$cvehound--kernel~/linux
Found:CVE-2020-27830
Found:CVE-2020-27152
Found:CVE-2020-29371
Found:CVE-2020-26088wheredirshould point to linux kernel sources. CVEhound will check the
sources for all cve patterns that you can find incve dir.
To check the sources for particular CVEs one can use:$cvehound--kernel./linux--kernel-config--cveCVE-2020-27194CVE-2020-29371
Checking:CVE-2020-27194
Found:CVE-2020-27194
MSG:bpf:Fixscalar32_min_max_orboundstracking
CWE:ImproperRestrictionofOperationswithintheBoundsofaMemoryBuffer
FIXDATE:2020-10-0809:02:53
https://www.linuxkernelcves.com/cves/CVE-2020-27194
AffectedFiles:-linux/kernel/bpf/verifier.c:CONFIG_BPF&CONFIG_BPF_SYSCALLlinux/.config:affected
Config:./linux/.configaffected

Checking:CVE-2020-29371
Found:CVE-2020-29371
MSG:romfs:fixuninitializedmemoryleakinromfs_dev_read()CWE:UseofUninitializedResource
FIXDATE:2020-08-2116:52:53
https://www.linuxkernelcves.com/cves/CVE-2020-29371
AffectedFiles:-linux/fs/romfs/storage.c:CONFIG_ROMFS_FSlinux/.config:notaffected
Config:./linux/.confignotaffectedOther args:--report- will produce json file with found CVEs
Most of metainformation in generated report is taken from linuxkernelcves.com--kernel-configor--kernel-config <file>- will infer the kernel configuration required to
build the affected code (based on Kbuild/Makefiles, ifdefs are not checked) and
check kernel .config file if there is one--files,--cwe- will limit the scope of checked cves to the kernel files of
interest or specific CWE classes--exploit- check only for CVEs that are known to be exploitable (according to
the FSTEC BDU database)LICENSEPython code is licensed under GPLv3. All rules in cvehound/cve folder are licensed under GPLv2.AcknowledgementsI would like to thank the following projects and people behind them:coccinellefor the program matching enginelinuxkernelcves.comfor information about Linux CVEsundertakerfor mapping kernel configs to .c filessympyfor the symbolic logic solver