alegrey91/vex8s: Suppress vulnerabilities making use of Kubernetes context to scans · GitHub

(this brand isn’t AI generated)

Vex8s generates VEX paperwork by correlating container vulnerabilities with Kubernetes settings to find out which CVEs are literally exploitable in your cluster.

Please observe, that is an experimental challenge. Things may change shortly.

The challenge goals to evaluate the exploitability of recognized CVEs inside Kubernetes workloads by combining vulnerability classification and securityContext evaluation.

It is predicated on the next idea:

• Each CVE is categorized into a number of vulnerability courses (CWE)
• CVE description is processed by an embedded ML model to foretell its exploitation category.
• Both the CWEs and the expected exploitation classes are mixed to find out if the CVE is mitigable.
• Each exploitation class, maps to a set of Kubernetes settings that may block or cut back the influence.
• By parsing a Kubernetes manifest, we are able to examine the container settings to judge whether or not the related settings are in place.
• Combining each analyses permits the system to find out if a CVE is exploitable in a given workload configuration.
• If it ends in a CVE mitigation, we add this to the ultimate VEX doc.

For a extra in-depth studying you may seek the advice of this paper: Environment-Aware Vulnerability Suppression Using Kubernetes Security Contexts and VEX

You can obtain the most recent binary from the release web page.

Or you may construct it manually:

vex8s at present helps 2 methods to generate VEX paperwork:

• passive-mode: passing an already generated vulnerability report created by trivy or grype.

• active-mode: actively scanning the photographs utilizing trivy or grype engines after which gereating the doc based mostly on the outcomes.

Using trivy:

# generate vulnerability report.
trivy picture --format json --output nginx.trivy.json nginx:1.21.0

# generate VEX doc by processing vulnerability report.
vex8s generate --manifest examples/nginx.yaml --report nginx.trivy.json --output nginx.vex.json

# scan once more with VEX doc to suppress vulnerabilities.
trivy picture --vex nginx.vex.json --show-suppressed nginx:1.21.0

The similar will be utilized utilizing grype:

# generate sbom report.
grype --output cyclonedx-json --file nginx.grype.json nginx:1.21.0

# generate vulnerability report.
grype sbom:./nginx.grype.json --output json --file nginx.grype-vr.json

# generate VEX doc by processing vulnerability report.
vex8s generate --manifest examples/nginx.yaml --report nginx.grype-vr.json --output nginx.vex.json

# scan sbom with VEX doc to suppress vulnerabilities.
grype sbom:./nginx.grype.json --output desk --vex nginx.vex.json --show-suppressed

Using trivy:

# scan the picture and routinely generate VEX doc.
vex8s generate --manifest examples/nginx.yaml --scan.engine trivy --output nginx.vex.json

# scan once more with VEX doc to suppress vulnerabilities.
trivy picture --vex nginx.vex.json --show-suppressed nginx:1.21.0

The similar will be utilized utilizing grype:

# generate sbom report.
grype --output cyclonedx-json --file nginx.grype.json nginx:1.21.0

# scan the picture and routinely generate VEX doc.
vex8s generate --manifest examples/nginx.yaml --scan.engine grype --output nginx.vex.json

# scan sbom with VEX doc to suppress vulnerabilities.
grype sbom:./nginx.grype.json --output desk --vex nginx.vex.json --show-suppressed

Each CVE is assessed into a number of exploitation courses, which drive the
mitigation choice. vex8s helps two classifier engines by way of --classifier:

• embedded (default): an offline ONNX ML model
  bundled within the binary. No community entry required.
• gemini: makes use of Google’s Gemini LLM to categorise the CVE description.
  Requires the GEMINI_API_KEY setting variable (optionally GEMINI_MODEL).

export GEMINI_API_KEY="your-api-key"

vex8s generate --manifest examples/nginx.yaml --report nginx.trivy.json 
  --output nginx.vex.json --classifier gemini

See the documentation — specifically the
User Guide — for a full walkthrough, the Gemini
classifier setup, and a whole flag reference.

This challenge was impressed by Akihiro Suda’s challenge vexllm.