Kernel CVEs

General Discussion
1

Hello,

Is there a possibility to obtain list of vulnerabilities(CVEs) for beagleboard kernel? I tried using SIEM like Wazuh to scan it and Dependency Track but I don’t think they recognise custom kernel made by TI to match with their database

2

Most TI kernels will not see any special cve patches past their last stable advertised version.. so just use stable version indicated.

Regards,

3

Thanks for the quick response. But is there a possibility to get a list of vulnerabilities for the last stable advertised version?

4

We can try.. cip-project / cip-kernel / kernel-cve-triage · GitLab

What kernel, uname -r are you running..

5

Right now it is 6.18.40-bone45
But I try to follow the releases to keep it up to date, so it will change in the nearest future

6

oh that’s an easy one, it’s just mainline 6.18.40 with hdmi patches and overlays..

6.18.41 was released yesterday, it’s in my queue today to get out.. Making sure you're not a bot!

Here i was thinking it was a 5.10.x-ti…

Regards,

Edit every cve site wants me to login, nope losing interest…

7

I don’t know why they are asking you to log in but here I found a database that is available on github:

and here is just the same list that is available online to look thorugh:
https://nvd.nist.gov/vuln/search#/nvd/home?resultType=records

It is regarding the CRA that is hot topic right now in Europe

Also regarding the script that you provided, I understand that it’s something to use when I build the kernel, but currently I’m using the standard one

1 Like
8

thanks that cve project helps!

9

great :slight_smile: btw are you building the kernel using yocto? beacuse it has some built-in function to detect cves

10

All official kernel builds in the apt repo are built in native Debian sbuild’s to match target file-system… Aka the Debian 13 (armhf) kernel package is built native on Debian 13 (armfh), this ensures the same “exact” installed gcc is used on both the builder and the target system in your hands..

In development 4 targets are ‘build’ tested with: .gitlab-ci.yml · am33x-v6.18 · Robert Nelson / bb-kernel · GitLab (Debian 13, Debian (Forky), Ubuntu (26.04) and Fedora (44) Pipelines · Robert Nelson / bb-kernel · GitLab

Regards,