leviathan
e4a600fef2
Adds per-CVE triage annotations that turn SKELETONKEY's JSON output
into something a SIEM/CTI/threat-intel pipeline can route on, and a
KEV badge in --list so operators see at-a-glance which modules
cover actively-exploited bugs.
New tool — tools/refresh-cve-metadata.py:
- Discovers CVEs by scanning modules/<dir>/ (no hardcoded list).
- Fetches CISA's Known Exploited Vulnerabilities catalog
(https://www.cisa.gov/.../known_exploited_vulnerabilities.csv).
- Fetches CWE classifications from NVD's CVE API 2.0
(services.nvd.nist.gov), throttled to the anonymous
5-req/30s limit (~3 minutes for 26 CVEs).
- Hand-curated ATT&CK technique mapping (T1068 default; T1611 for
container escapes, T1082 for kernel info leaks — MITRE doesn't
publish a clean CVE→technique feed).
- Generates three outputs:
docs/CVE_METADATA.json machine-readable, drift-checkable
docs/KEV_CROSSREF.md human-readable table
core/cve_metadata.c auto-generated lookup table
- --check mode diffs the committed JSON against a fresh fetch for
CI drift detection.
New core API — core/cve_metadata.{h,c}:
struct cve_metadata { cve, cwe, attack_technique, attack_subtechnique,
in_kev, kev_date_added };
const struct cve_metadata *cve_metadata_lookup(const char *cve);
Lookup keyed by CVE id, not module name — the metadata is properties
of the CVE (two modules covering the same bug see the same metadata).
The opsec_notes field stays on the module struct because exploit
technique varies per-module (different footprints).
Output surfacing:
- --list: new KEV column shows ★ for KEV-listed CVEs.
- --module-info (text): prints cwe / att&ck / 'in CISA KEV: YES (added
YYYY-MM-DD)' between summary and operations.
- --module-info / --scan (JSON): emits a 'triage' subobject with the
full record, plus an 'opsec_notes' field at top level when set.
Initial snapshot:
- 10 of 26 modules cover KEV-listed CVEs (dirty_cow, dirty_pipe,
pwnkit, sudo_samedit, ptrace_traceme, fuse_legacy, nf_tables,
overlayfs, overlayfs_setuid, netfilter_xtcompat).
- 24 of 26 have NVD CWE mappings; 2 unmapped (NVD has no weakness
record for CVE-2019-13272 and CVE-2026-46300 yet).
- All 26 mapped to an ATT&CK technique.
Verification:
- macOS local: 33 kernel_range + clean build, --module-info shows
'in CISA KEV: YES (added 2024-05-30)' for nf_tables, --list KEV
column renders.
- Linux (docker gcc:latest): 33 + 54 = 87 passes, 0 fails.
Follow-up commits will add per-module OPSEC notes and --explain mode.
44 lines
1.6 KiB
C
44 lines
1.6 KiB
C
/*
|
|
* SKELETONKEY — CVE metadata lookup
|
|
*
|
|
* Per-CVE annotations sourced from authoritative federal databases:
|
|
* - CISA Known Exploited Vulnerabilities catalog (in_kev, date_added)
|
|
* - NVD CVE API (cwe)
|
|
* - Hand-curated MITRE ATT&CK technique mapping
|
|
*
|
|
* Kept separate from struct skeletonkey_module because these are
|
|
* properties of the CVE (one CVE -> one set of values), not the
|
|
* exploit module. Two modules covering the same CVE see the same
|
|
* metadata. The OPSEC notes — which vary by exploit technique —
|
|
* stay on the module struct.
|
|
*
|
|
* The table is auto-generated from docs/CVE_METADATA.json by
|
|
* tools/refresh-cve-metadata.py. Do not hand-edit cve_metadata.c —
|
|
* re-run the refresh tool.
|
|
*/
|
|
|
|
#ifndef SKELETONKEY_CVE_METADATA_H
|
|
#define SKELETONKEY_CVE_METADATA_H
|
|
|
|
#include <stdbool.h>
|
|
#include <stddef.h>
|
|
|
|
struct cve_metadata {
|
|
const char *cve; /* "CVE-YYYY-NNNNN" */
|
|
const char *cwe; /* "CWE-NNN" or NULL if NVD has no mapping */
|
|
const char *attack_technique; /* "T1068" etc. */
|
|
const char *attack_subtechnique; /* "T1068.001" or NULL */
|
|
bool in_kev; /* true iff in CISA's KEV catalog */
|
|
const char *kev_date_added; /* "YYYY-MM-DD" or "" */
|
|
};
|
|
|
|
/* The full table. Length is `cve_metadata_table_len`. */
|
|
extern const struct cve_metadata cve_metadata_table[];
|
|
extern const size_t cve_metadata_table_len;
|
|
|
|
/* Lookup by CVE id (e.g. "CVE-2024-1086"). Returns NULL if the CVE
|
|
* isn't in the table. Cheap linear scan; we have <100 entries. */
|
|
const struct cve_metadata *cve_metadata_lookup(const char *cve);
|
|
|
|
#endif /* SKELETONKEY_CVE_METADATA_H */
|