cve-check-tool

cve-check-tool, as its name suggests, is a tool for checking known (public) CVEs. The tool will identify potentially vunlnerable software packages within Linux distributions through version matching. Where possible it will also seek to determine (through a distribution implemention) if a vulnerability has been addressed by way of a patch.

CVEs are only ever potential - due to the various policies of various distributions, and indeed semantics in versioning within various projects, it is expected that the tool may generate false positives.

The tool is designed to integrate with a locally cached copy of the National Vulnerability Database, which should be updated every 3-4 hours. Correctly integrated within the workflow of a distribution, and indeed with the correct bug report tool, this yields a minimum 4 hour turnaround on all disclosed CVEs (non-embargoed)

Data Usage

cve-check-tool downloads the NVD in its entirety, from 2002 until the current moment. The decompressed XML database is in excess of 550MB, so this should be taken into account before running the tool. From then on, only the changed database segments are fetched. Therefore it is advisable to use cve-check-tool on a machine that has sufficient space and internet connection.

On a fairly modern machine, it should only take around 10 seconds to consume the databases. Note however that when the tool runs, it will use a lot of resources to ensure it is fast (it needs to go through over 7 million lines of XML, for one.)

CLI usage:

Most common usage, automatically determine package type and scan for the packages in the given package list file:

cve-check-tool ../packages

Recurse a directory structure, with the predetermined type of eopkg:

cve-check-tool -t eopkg .

Check a single RPM source package, ignoring patched issues:

cve-check-tool -n readline.spec

Flags can be combined, check -h for details. An example to recurse all directories, finding .spec RPM files, and ignoring patched issues:

cve-check-tool -n -t rpm .

License

cve-check-tool is available under the terms of the GNU General Public License, Version 2. Please check the LICENSE file for further details.

Copyright (C) 2015 Intel Corporation