\documentclass[aspectratio=169,obeyspaces,spaces,hyphens,dvipsnames]{beamer}
\usepackage[utf8]{inputenc}
\usepackage{lmodern}% http://ctan.org/pkg/lm
\usepackage{minted}
\usepackage{hyperref}
\usepackage{xcolor}
\usepackage{pgfplots}
\usepackage{tikz}
\usepackage[normalem]{ulem}

\mode<presentation>
\usetheme{Bootlin}

\def\signed #1{{\leavevmode\unskip\nobreak\hfil\penalty50\hskip2em
  \hbox{}\nobreak\hfil(#1)
  \parfillskip=0pt \finalhyphendemerits=0 \endgraf}}

\newsavebox\mybox
\newenvironment{aquote}[1]
  {\savebox\mybox{#1}\begin{quotation}}
  {\signed{\usebox\mybox}\end{quotation}}

\title{Security vulnerability tracking tools in Buildroot}
\authors{Thomas Petazzoni}
\email{thomas.petazzoni@bootlin.com}
\slidesurl{https://bootlin.com/pub/conferences/2021/lee/petazzoni-buildroot-vulnerability-tracking/}
\institute{Bootlin}
\conference{Live Embedded Event, June 3rd 2021}

\begin{document}

\addtocontents{toc}{\protect\setcounter{tocdepth}{-1}}
\section{Security vulnerability tracking tools in Buildroot}
\addtocontents{toc}{\protect\setcounter{tocdepth}{2}}

\begin{frame}{Who is speaking ?}
  \begin{columns}
    \column{0.6\textwidth}
    \begin{itemize}
    \item Thomas Petazzoni
    \item Co-owner and CEO at Bootlin
    \item Joined in 2008, employee \#1
    \item Embedded Linux engineer and trainer
    \item Open-source contributor
    \item {\bf Buildroot co-maintainer}, contributor since 2008,
      contributed 4000+ patches
    \item Based in Toulouse, France
    \end{itemize}
    \column{0.4\textwidth}
    \includegraphics[width=\textwidth]{thomas-petazzoni-squared-new.jpg}
  \end{columns}
\end{frame}

\begin{frame}{Agenda}
  \begin{columns}
  \column{0.6\textwidth}
  \begin{itemize}
  \item What is Buildroot?
  \item Build systems and security vulnerabilities: which
    relationship?
  \item The acronym soup: NVD, CVE and CPE
  \item Security vulnerability tracking in Buildroot
  \item Limitations and future work
  \item Q\&A
  \end{itemize}
  \column{0.4\textwidth}
  \includegraphics[width=\textwidth]{agenda.jpg}
  \end{columns}
\end{frame}

\begin{frame}{What is Buildroot ?}
  \begin{columns}
  \column{0.8\textwidth}
  \begin{itemize}
  \item Embedded Linux build system
    \begin{itemize}
    \item Automates the process of cross-compiling a complete
      customized Linux system for embedded platforms
    \item Root filesystem with applications/libraries,
      cross-compilation toolchain, bootloader and kernel images
    \item Same role as OpenEmbedded/Yocto, OpenWrt, PTXdist, etc.
    \end{itemize}
  \item 2800+ packages, for the most popular open-source
    libraries/applications
  \item Simple to use and understand
  \item Written in {\em make} + {\em kconfig}
  \item 4 releases per year, one release maintained during one year
    with security updates
  \item Active community, large user base in the insdustry
  \end{itemize}
  \column{0.2\textwidth}
  \includegraphics[width=0.8\textwidth]{logo.png}\\
  \vspace{0.2cm}
  \includegraphics[width=0.8\textwidth]{spacex.jpg}\\
  \vspace{0.2cm}
  \includegraphics[width=0.8\textwidth]{tesla.jpg}
  \end{columns}
\end{frame}

\begin{frame}[fragile]{Buildroot quickstart}

  \begin{block}{}
\begin{verbatim}
$ git clone git://git.buildroot.org/buildroot
$ cd buildroot
$ git checkout 2021.02.2
\end{verbatim}
    \pause

\begin{verbatim}
$ make qemu_aarch64_virt_defconfig
\end{verbatim}

    \pause

\begin{verbatim}
$ make menuconfig
... customize your selection of packages ...
\end{verbatim}

    \pause

\begin{verbatim}
$ make
\end{verbatim}
  \end{block}

  \pause

  Ready to use images in \code{output/images}

\end{frame}

\begin{frame}{Build systems and security vulnerabilities}
  \begin{itemize}
  \item Build systems are responsible for {\bf automatically}
    downloading, building and integrating all the system components
  \item Typically includes a {\bf large number} of open-source
    libraries/applications + some in-house/proprietary components
  \item Number of open-source components can get quite large on a
    typical embedded systems $\rightarrow$ {\bf difficult to manually
      track} all security vulnerabilities
  \item Just like build systems usually offer {\em license compliance}
    tooling, it makes sense to also have {\bf security vulnerability
      tracking} tooling.
  \end{itemize}
\end{frame}

\begin{frame}{NVD, NIST, CVE, CPE: the acronym soup}
  \begin{columns}
  \column{0.6\textwidth}
  \begin{itemize}
  \item {\bf NVD} = National Vulnerability Database
  \item Maintained by {\bf NIST}, National Institute of Standards and
    Technology, US
  \item \url{https://nvd.nist.gov/}
  \item {\em The NVD is the U.S. government repository of standards
      based vulnerability management data represented using the
      Security Content Automation Protocol (SCAP). This data enables
      automation of vulnerability management, security measurement,
      and compliance. The NVD includes databases of security checklist
      references, security-related software flaws, misconfigurations,
      product names, and impact metrics.}
  \end{itemize}
  \column{0.4\textwidth}
  \includegraphics[height=0.6\textheight]{nvd-screenshot.png}
\end{columns}
\end{frame}

\begin{frame}{NVD, NIST, CVE, CPE: the acronym soup}
  \begin{columns}
  \column{0.6\textwidth}
  \begin{itemize}
  \item {\bf CVE} = Common Vulnerabilities and Exposures
  \item A reference for publicly-known security vulnerabilities
  \item Some well-known CVEs
    \begin{itemize}
    \item CVE-2014-0160, Heartbleed
    \item CVE-2017-5754, Meltdown
    \item CVE-2020-24588, one of the FragAttacks
    \end{itemize}
  \item Are generally recognized in the industry as the reference
    identifiers for known security issues.
  \item NVD provides a per-year JSON dump of the CVEs at
    \url{https://nvd.nist.gov/vuln/data-feeds}
  \end{itemize}
  \column{0.4\textwidth}
  \includegraphics[height=0.6\textheight]{json-dump-list.png}
\end{columns}
\end{frame}

\begin{frame}[fragile]{CVE database entry example: CVE-2020-29074}
\begin{block}{}
  {\scriptsize
  \begin{verbatim}
    "cve" : {
      ...
      "CVE_data_meta" : {
        "ID" : "CVE-2020-29074",
        "ASSIGNER" : "cve@mitre.org"
      },
     ....
     "configurations" : {
      "CVE_data_version" : "4.0",
      "nodes" : [ {
        "operator" : "OR",
        "children" : [ ],
        "cpe_match" : [ {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:a:x11vnc_project:x11vnc:0.9.16:*:*:*:*:*:*:*",
          "cpe_name" : [ ]
        } ]
\end{verbatim}
  }
  \end{block}
  $\rightarrow$ single version affected, 0.9.16
\end{frame}

\begin{frame}[fragile]{CVE database entry example: CVE-2018-0733}
\begin{block}{}
  {\scriptsize
  \begin{verbatim}
    "cve" : {
      ...
      "CVE_data_meta" : {
        "ID" : "CVE-2018-0733",
        "ASSIGNER" : "openssl-security@openssl.org"
      },

    "configurations" : {
      "nodes" : [ {
        "operator" : "OR",
        "cpe_match" : [ {
          "vulnerable" : true,
          "cpe23Uri" : "cpe:2.3:a:openssl:openssl:*:*:*:*:*:*:*:*",
          "versionStartIncluding" : "1.1.0",
          "versionEndIncluding" : "1.1.0g",
          "cpe_name" : [ ]
        } ]
      } ]
\end{verbatim}
  }
\end{block}
  $\rightarrow$ range of versions affected
\end{frame}

\begin{frame}{CVE-2018-0733 list of affected versions}
  \begin{center}
    \includegraphics[width=\textwidth]{CVE-2018-0733.png}
  \end{center}
\end{frame}

\begin{frame}{NVD, NIST, CVE, CPE: the acronym soup}
  \begin{columns}
  \column{0.6\textwidth}
  \begin{itemize}
  \item {\bf CPE} = Common Platform Enumeration
  \item {\em structured naming scheme for information technology
      systems, software, and packages}
  \item Or put it different: unique identifier for software releases
  \item {\tiny \code{cpe:<cpe_version>:<part>:<vendor>:<product>:<version>:<update>:<edition>:<language>:<sw_edition>:<target_sw>:<target_hw>:<other>}}
  \item Examples
    \begin{itemize}
    \item {\scriptsize \code{cpe:2.3:a:ntp:ntp:4.2.8:p3:*:*:*:*:*:*}}
    \item {\scriptsize \code{cpe:2.3:a:x11vnc_project:x11vnc:0.9.16:*:*:*:*:*:*:*}}
    \end{itemize}
  \item {\em CPE dictionary} provided by NVD: lists all known software
    releases, as a huge XML blurb
  \item Used in the NVD database of CVEs
  \end{itemize}
  \column{0.4\textwidth}
  \includegraphics[height=0.6\textheight]{cpe.png}
\end{columns}
\end{frame}

\begin{frame}{In Buildroot}
  \begin{itemize}
  \item Existing \code{pkg-stats} tool
    \begin{itemize}
    \item Originally maintainer-oriented
    \item Collects details on the entire package set
    \item Existence of license file ? Hash file ? Current packaged
      version vs. latest upstream version ?
    \end{itemize}
  \item Extended with:
    \begin{itemize}
    \item Collecting details only for the packages of the current
      configuration $\rightarrow$ useful for users
    \item Matching of packages with the NVD databases: CVE and CPE
    \end{itemize}
  \item \code{make pkg-stats}
    \begin{itemize}
    \item Produces JSON and HTML output
    \item Downloads NVD database in \code{$(DL_DIR)/buildroot-nvd/}
    \end{itemize}
  \item Available since Buildroot 2021.02
  \end{itemize}
\end{frame}

\begin{frame}{{\tt pkg-stats} output}
  \begin{center}
    \includegraphics[width=\textwidth]{pkg-stats.png}
  \end{center}
\end{frame}

\begin{frame}{CPE identifiers}
  \begin{itemize}
  \item By default
    \begin{itemize}
    \item Buildroot generates a CPE identifier equal to:
      \code{cpe:2.3:a:<pkg>_project:<pkg>:<pkg-version>:*:*:*:*:*:*}
    \item Sometimes doesn't match with how the software component is
      referenced in the NVD CPE dictionary
    \end{itemize}
  \item Can be overridden on a per-package basis with:
    \begin{itemize}
    \item \code{<pkg>_CPE_ID_PREFIX}
    \item \code{<pkg>_CPE_ID_VENDOR}
    \item \code{<pkg>_CPE_ID_PRODUCT}
    \item \code{<pkg>_CPE_ID_VERSION}
    \item \code{<pkg>_CPE_ID_UPDATE}
    \end{itemize}
  \item The \code{pkg-stats} output indicates if the generated CPE
    identifier has been found in the CPE dictionary. If not found:
    \begin{itemize}
    \item Incorrect CPE information in Buildroot
    \item Incomplete CPE dictionary
    \end{itemize}
  \item Many Buildroot packages already annotated with correct CPE ID
    information.
  \end{itemize}
\end{frame}

\begin{frame}{{\tt pkg-stats} output details}

  \includegraphics[width=\textwidth]{attr.png}

  \only<2>{
    \begin{itemize}
    \item some \code{<pkg>_CPE_ID_*} variables defined $\rightarrow$ CPE information verified
    \item CPE identifier exists in the CPE dictionary
    \item no known CVEs
    \end{itemize}
    \vspace{0.5cm}
  }

  \includegraphics[width=\textwidth]{acl.png}

  \only<3>{
    \begin{itemize}
    \item no \code{<pkg>_CPE_ID_*} variable $\rightarrow$ don't know
      if the default CPE identifier is correct
    \item based on this default CPE identifier $\rightarrow$ no known CVE
    \end{itemize}
    \vspace{0.5cm}
  }

  \includegraphics[width=\textwidth]{atop.png}

  \only<4>{
    \begin{itemize}
    \item some \code{<pkg>_CPE_ID_*} variables defined $\rightarrow$ CPE information verified
    \item no entry in CPE dictionary $\rightarrow$ version 2.6.0 not known by NVD
    \item CVE-2011-3618 applicable: NVD database indicates it applies to all versions.
    \end{itemize}
    \vspace{0.5cm}
  }

  \includegraphics[width=\textwidth]{busybox.png}

  \only<5>{
    \begin{itemize}
    \item some \code{<pkg>_CPE_ID_*} variables defined $\rightarrow$ CPE information verified
    \item no entry in CPE dictionary $\rightarrow$ version 1.33.0 not known by NVD
    \item no known CVEs
    \end{itemize}
    \vspace{0.5cm}
  }

\end{frame}

\begin{frame}[fragile]{Ignoring CVEs}

  \begin{itemize}

  \item Sometimes a CVE is reported as applicable to particular
    version but should be ignored by Buildroot

  \item Typical reasons:

    \begin{itemize}

    \item Buildroot has backported the security fix as a patch in
      \code{package/<pkg>/}

    \item The security issue doesn't apply to the Buildroot
      configuration/usage of the package

    \end{itemize}

  \item \code{<pkg>_IGNORE_CVES} can be used per package to ignore
    specific CVEs

    {\small
    \begin{block}{package/bind/bind.mk}
\begin{minted}{make}
# Only applies to RHEL6.x with DNSSEC validation on
BIND_IGNORE_CVES = CVE-2017-3139
\end{minted}
    \end{block}

    \begin{block}{package/hostapd/hostapd.mk}
\begin{minted}{make}
# 0002-ASN.1-Validate-DigestAlgorithmIdentifier-parameters.patch
HOSTAPD_IGNORE_CVES += CVE-2021-30004
\end{minted}
    \end{block}
  }

  \end{itemize}

\end{frame}

\begin{frame}{Limitations}
  \begin{itemize}
  \item Packages with {\bf custom versions} from Git (Linux, U-Boot, etc.)
    $\rightarrow$ Buildroot doesn't know how to match custom versions
    with well-known upstream releases.
  \item {\bf CPE dictionary not complete} and/or {\bf inaccuracies} in CVE reports
    \begin{itemize}
    \item NVD maintainers open to contributions
    \item Buildroot developers have successfully contributed to the
      CPE and CVE databases
    \end{itemize}
  \item {\bf Only} tracks security issues reported as CVEs
    \begin{itemize}
    \item Some security issues not reported as CVEs
    \item Proprietary/in-house software is regularly much worse from a
      security standpoint!
    \end{itemize}
  \end{itemize}
\end{frame}

\begin{frame}{Conclusion}
  \begin{itemize}
  \item Security vulnerability tracking has become important to keep
    devices updated
  \item NVD provides useful databases, in machine-parsable formats
  \item Buildroot \code{pkg-stats} is the entry point to use such
    databases in a Buildroot context
  \item Run \code{pkg-stats} in a cronjob and monitor the results
  \item If a package if affected by a CVE
    \begin{itemize}
    \item See if a version upgrade is necessary
    \item Or backport the security fix + add \code{<pkg>_IGNORE_CVES}
    \item Contribute the result to upstream Buildroot!
    \end{itemize}
  \end{itemize}
\end{frame}

\questionslide

\end{document}
