Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 1 | # This class is used to check recipes against public CVEs. |
| 2 | # |
| 3 | # In order to use this class just inherit the class in the |
| 4 | # local.conf file and it will add the cve_check task for |
| 5 | # every recipe. The task can be used per recipe, per image, |
| 6 | # or using the special cases "world" and "universe". The |
| 7 | # cve_check task will print a warning for every unpatched |
| 8 | # CVE found and generate a file in the recipe WORKDIR/cve |
| 9 | # directory. If an image is build it will generate a report |
| 10 | # in DEPLOY_DIR_IMAGE for all the packages used. |
| 11 | # |
| 12 | # Example: |
| 13 | # bitbake -c cve_check openssl |
| 14 | # bitbake core-image-sato |
| 15 | # bitbake -k -c cve_check universe |
| 16 | # |
| 17 | # DISCLAIMER |
| 18 | # |
| 19 | # This class/tool is meant to be used as support and not |
| 20 | # the only method to check against CVEs. Running this tool |
| 21 | # doesn't guarantee your packages are free of CVEs. |
| 22 | |
Brad Bishop | 37a0e4d | 2017-12-04 01:01:44 -0500 | [diff] [blame] | 23 | # The product name that the CVE database uses. Defaults to BPN, but may need to |
| 24 | # be overriden per recipe (for example tiff.bb sets CVE_PRODUCT=libtiff). |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 25 | CVE_PRODUCT ??= "${BPN}" |
Brad Bishop | 37a0e4d | 2017-12-04 01:01:44 -0500 | [diff] [blame] | 26 | |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 27 | CVE_CHECK_DB_DIR ?= "${DL_DIR}/CVE_CHECK" |
| 28 | CVE_CHECK_DB_FILE ?= "${CVE_CHECK_DB_DIR}/nvd.db" |
| 29 | |
| 30 | CVE_CHECK_LOCAL_DIR ?= "${WORKDIR}/cve" |
| 31 | CVE_CHECK_LOCAL_FILE ?= "${CVE_CHECK_LOCAL_DIR}/cve.log" |
| 32 | CVE_CHECK_TMP_FILE ?= "${TMPDIR}/cve_check" |
| 33 | |
| 34 | CVE_CHECK_DIR ??= "${DEPLOY_DIR}/cve" |
| 35 | CVE_CHECK_MANIFEST ?= "${DEPLOY_DIR_IMAGE}/${IMAGE_NAME}${IMAGE_NAME_SUFFIX}.cve" |
| 36 | CVE_CHECK_COPY_FILES ??= "1" |
| 37 | CVE_CHECK_CREATE_MANIFEST ??= "1" |
| 38 | |
| 39 | # Whitelist for packages (PN) |
| 40 | CVE_CHECK_PN_WHITELIST = "\ |
| 41 | glibc-locale \ |
| 42 | " |
| 43 | |
| 44 | # Whitelist for CVE and version of package |
| 45 | CVE_CHECK_CVE_WHITELIST = "{\ |
Brad Bishop | 37a0e4d | 2017-12-04 01:01:44 -0500 | [diff] [blame] | 46 | 'CVE-2014-2524': ('6.3','5.2',), \ |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 47 | }" |
| 48 | |
| 49 | python do_cve_check () { |
| 50 | """ |
| 51 | Check recipe for patched and unpatched CVEs |
| 52 | """ |
| 53 | |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 54 | if os.path.exists(d.getVar("CVE_CHECK_TMP_FILE")): |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 55 | patched_cves = get_patches_cves(d) |
| 56 | patched, unpatched = check_cves(d, patched_cves) |
| 57 | if patched or unpatched: |
| 58 | cve_data = get_cve_info(d, patched + unpatched) |
| 59 | cve_write_data(d, patched, unpatched, cve_data) |
| 60 | else: |
| 61 | bb.note("Failed to update CVE database, skipping CVE check") |
| 62 | } |
| 63 | |
| 64 | addtask cve_check after do_unpack before do_build |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 65 | do_cve_check[depends] = "cve-check-tool-native:do_populate_sysroot cve-check-tool-native:do_populate_cve_db" |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 66 | do_cve_check[nostamp] = "1" |
| 67 | |
| 68 | python cve_check_cleanup () { |
| 69 | """ |
| 70 | Delete the file used to gather all the CVE information. |
| 71 | """ |
| 72 | |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 73 | bb.utils.remove(e.data.getVar("CVE_CHECK_TMP_FILE")) |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 74 | } |
| 75 | |
| 76 | addhandler cve_check_cleanup |
| 77 | cve_check_cleanup[eventmask] = "bb.cooker.CookerExit" |
| 78 | |
| 79 | python cve_check_write_rootfs_manifest () { |
| 80 | """ |
| 81 | Create CVE manifest when building an image |
| 82 | """ |
| 83 | |
| 84 | import shutil |
| 85 | |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 86 | if os.path.exists(d.getVar("CVE_CHECK_TMP_FILE")): |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 87 | bb.note("Writing rootfs CVE manifest") |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 88 | deploy_dir = d.getVar("DEPLOY_DIR_IMAGE") |
| 89 | link_name = d.getVar("IMAGE_LINK_NAME") |
| 90 | manifest_name = d.getVar("CVE_CHECK_MANIFEST") |
| 91 | cve_tmp_file = d.getVar("CVE_CHECK_TMP_FILE") |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 92 | |
| 93 | shutil.copyfile(cve_tmp_file, manifest_name) |
| 94 | |
| 95 | if manifest_name and os.path.exists(manifest_name): |
| 96 | manifest_link = os.path.join(deploy_dir, "%s.cve" % link_name) |
| 97 | # If we already have another manifest, update symlinks |
| 98 | if os.path.exists(os.path.realpath(manifest_link)): |
| 99 | os.remove(manifest_link) |
| 100 | os.symlink(os.path.basename(manifest_name), manifest_link) |
| 101 | bb.plain("Image CVE report stored in: %s" % manifest_name) |
| 102 | } |
| 103 | |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 104 | ROOTFS_POSTPROCESS_COMMAND_prepend = "${@'cve_check_write_rootfs_manifest; ' if d.getVar('CVE_CHECK_CREATE_MANIFEST') == '1' else ''}" |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 105 | |
| 106 | def get_patches_cves(d): |
| 107 | """ |
| 108 | Get patches that solve CVEs using the "CVE: " tag. |
| 109 | """ |
| 110 | |
| 111 | import re |
| 112 | |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 113 | pn = d.getVar("PN") |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 114 | cve_match = re.compile("CVE:( CVE\-\d{4}\-\d+)+") |
| 115 | patched_cves = set() |
| 116 | bb.debug(2, "Looking for patches that solves CVEs for %s" % pn) |
| 117 | for url in src_patches(d): |
| 118 | patch_file = bb.fetch.decodeurl(url)[2] |
| 119 | with open(patch_file, "r", encoding="utf-8") as f: |
| 120 | try: |
| 121 | patch_text = f.read() |
| 122 | except UnicodeDecodeError: |
| 123 | bb.debug(1, "Failed to read patch %s using UTF-8 encoding" |
| 124 | " trying with iso8859-1" % patch_file) |
| 125 | f.close() |
| 126 | with open(patch_file, "r", encoding="iso8859-1") as f: |
| 127 | patch_text = f.read() |
| 128 | |
| 129 | # Search for the "CVE: " line |
| 130 | match = cve_match.search(patch_text) |
| 131 | if match: |
| 132 | # Get only the CVEs without the "CVE: " tag |
| 133 | cves = patch_text[match.start()+5:match.end()] |
| 134 | for cve in cves.split(): |
| 135 | bb.debug(2, "Patch %s solves %s" % (patch_file, cve)) |
| 136 | patched_cves.add(cve) |
| 137 | else: |
| 138 | bb.debug(2, "Patch %s doesn't solve CVEs" % patch_file) |
| 139 | |
| 140 | return patched_cves |
| 141 | |
| 142 | def check_cves(d, patched_cves): |
| 143 | """ |
| 144 | Run cve-check-tool looking for patched and unpatched CVEs. |
| 145 | """ |
| 146 | |
| 147 | import ast, csv, tempfile, subprocess, io |
| 148 | |
| 149 | cves_patched = [] |
| 150 | cves_unpatched = [] |
Brad Bishop | 37a0e4d | 2017-12-04 01:01:44 -0500 | [diff] [blame] | 151 | bpn = d.getVar("CVE_PRODUCT") |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 152 | pv = d.getVar("PV").split("git+")[0] |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 153 | cves = " ".join(patched_cves) |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 154 | cve_db_dir = d.getVar("CVE_CHECK_DB_DIR") |
| 155 | cve_whitelist = ast.literal_eval(d.getVar("CVE_CHECK_CVE_WHITELIST")) |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 156 | cve_cmd = "cve-check-tool" |
| 157 | cmd = [cve_cmd, "--no-html", "--csv", "--not-affected", "-t", "faux", "-d", cve_db_dir] |
| 158 | |
| 159 | # If the recipe has been whitlisted we return empty lists |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 160 | if d.getVar("PN") in d.getVar("CVE_CHECK_PN_WHITELIST").split(): |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 161 | bb.note("Recipe has been whitelisted, skipping check") |
| 162 | return ([], []) |
| 163 | |
| 164 | # It is needed to export the proxies to download the database using HTTP |
| 165 | bb.utils.export_proxies(d) |
| 166 | |
| 167 | try: |
| 168 | # Write the faux CSV file to be used with cve-check-tool |
| 169 | fd, faux = tempfile.mkstemp(prefix="cve-faux-") |
| 170 | with os.fdopen(fd, "w") as f: |
| 171 | f.write("%s,%s,%s," % (bpn, pv, cves)) |
| 172 | cmd.append(faux) |
| 173 | |
| 174 | output = subprocess.check_output(cmd, stderr=subprocess.STDOUT).decode("utf-8") |
| 175 | bb.debug(2, "Output of command %s:\n%s" % ("\n".join(cmd), output)) |
| 176 | except subprocess.CalledProcessError as e: |
| 177 | bb.warn("Couldn't check for CVEs: %s (output %s)" % (e, e.output)) |
| 178 | finally: |
| 179 | os.remove(faux) |
| 180 | |
| 181 | for row in csv.reader(io.StringIO(output)): |
| 182 | # Third row has the unpatched CVEs |
| 183 | if row[2]: |
| 184 | for cve in row[2].split(): |
| 185 | # Skip if the CVE has been whitlisted for the current version |
| 186 | if pv in cve_whitelist.get(cve,[]): |
| 187 | bb.note("%s-%s has been whitelisted for %s" % (bpn, pv, cve)) |
| 188 | else: |
| 189 | cves_unpatched.append(cve) |
| 190 | bb.debug(2, "%s-%s is not patched for %s" % (bpn, pv, cve)) |
| 191 | # Fourth row has patched CVEs |
| 192 | if row[3]: |
| 193 | for cve in row[3].split(): |
| 194 | cves_patched.append(cve) |
| 195 | bb.debug(2, "%s-%s is patched for %s" % (bpn, pv, cve)) |
| 196 | |
| 197 | return (cves_patched, cves_unpatched) |
| 198 | |
| 199 | def get_cve_info(d, cves): |
| 200 | """ |
| 201 | Get CVE information from the database used by cve-check-tool. |
| 202 | |
| 203 | Unfortunately the only way to get CVE info is set the output to |
| 204 | html (hard to parse) or query directly the database. |
| 205 | """ |
| 206 | |
| 207 | try: |
| 208 | import sqlite3 |
| 209 | except ImportError: |
| 210 | from pysqlite2 import dbapi2 as sqlite3 |
| 211 | |
| 212 | cve_data = {} |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 213 | db_file = d.getVar("CVE_CHECK_DB_FILE") |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 214 | placeholder = ",".join("?" * len(cves)) |
| 215 | query = "SELECT * FROM NVD WHERE id IN (%s)" % placeholder |
| 216 | conn = sqlite3.connect(db_file) |
| 217 | cur = conn.cursor() |
| 218 | for row in cur.execute(query, tuple(cves)): |
| 219 | cve_data[row[0]] = {} |
| 220 | cve_data[row[0]]["summary"] = row[1] |
| 221 | cve_data[row[0]]["score"] = row[2] |
| 222 | cve_data[row[0]]["modified"] = row[3] |
| 223 | cve_data[row[0]]["vector"] = row[4] |
| 224 | conn.close() |
| 225 | |
| 226 | return cve_data |
| 227 | |
| 228 | def cve_write_data(d, patched, unpatched, cve_data): |
| 229 | """ |
| 230 | Write CVE information in WORKDIR; and to CVE_CHECK_DIR, and |
| 231 | CVE manifest if enabled. |
| 232 | """ |
| 233 | |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 234 | cve_file = d.getVar("CVE_CHECK_LOCAL_FILE") |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 235 | nvd_link = "https://web.nvd.nist.gov/view/vuln/detail?vulnId=" |
| 236 | write_string = "" |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 237 | unpatched_cves = [] |
| 238 | bb.utils.mkdirhier(d.getVar("CVE_CHECK_LOCAL_DIR")) |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 239 | |
| 240 | for cve in sorted(cve_data): |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 241 | write_string += "PACKAGE NAME: %s\n" % d.getVar("PN") |
| 242 | write_string += "PACKAGE VERSION: %s\n" % d.getVar("PV") |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 243 | write_string += "CVE: %s\n" % cve |
| 244 | if cve in patched: |
| 245 | write_string += "CVE STATUS: Patched\n" |
| 246 | else: |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 247 | unpatched_cves.append(cve) |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 248 | write_string += "CVE STATUS: Unpatched\n" |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 249 | write_string += "CVE SUMMARY: %s\n" % cve_data[cve]["summary"] |
| 250 | write_string += "CVSS v2 BASE SCORE: %s\n" % cve_data[cve]["score"] |
| 251 | write_string += "VECTOR: %s\n" % cve_data[cve]["vector"] |
| 252 | write_string += "MORE INFORMATION: %s%s\n\n" % (nvd_link, cve) |
| 253 | |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 254 | if unpatched_cves: |
| 255 | bb.warn("Found unpatched CVE (%s), for more information check %s" % (" ".join(unpatched_cves),cve_file)) |
| 256 | |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 257 | with open(cve_file, "w") as f: |
| 258 | bb.note("Writing file %s with CVE information" % cve_file) |
| 259 | f.write(write_string) |
| 260 | |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 261 | if d.getVar("CVE_CHECK_COPY_FILES") == "1": |
| 262 | cve_dir = d.getVar("CVE_CHECK_DIR") |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 263 | bb.utils.mkdirhier(cve_dir) |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 264 | deploy_file = os.path.join(cve_dir, d.getVar("PN")) |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 265 | with open(deploy_file, "w") as f: |
| 266 | f.write(write_string) |
| 267 | |
Brad Bishop | 6e60e8b | 2018-02-01 10:27:11 -0500 | [diff] [blame] | 268 | if d.getVar("CVE_CHECK_CREATE_MANIFEST") == "1": |
| 269 | with open(d.getVar("CVE_CHECK_TMP_FILE"), "a") as f: |
Patrick Williams | c0f7c04 | 2017-02-23 20:41:17 -0600 | [diff] [blame] | 270 | f.write("%s" % write_string) |