leviathan
e4a600fef2
Adds per-CVE triage annotations that turn SKELETONKEY's JSON output
into something a SIEM/CTI/threat-intel pipeline can route on, and a
KEV badge in --list so operators see at-a-glance which modules
cover actively-exploited bugs.
New tool — tools/refresh-cve-metadata.py:
- Discovers CVEs by scanning modules/<dir>/ (no hardcoded list).
- Fetches CISA's Known Exploited Vulnerabilities catalog
(https://www.cisa.gov/.../known_exploited_vulnerabilities.csv).
- Fetches CWE classifications from NVD's CVE API 2.0
(services.nvd.nist.gov), throttled to the anonymous
5-req/30s limit (~3 minutes for 26 CVEs).
- Hand-curated ATT&CK technique mapping (T1068 default; T1611 for
container escapes, T1082 for kernel info leaks — MITRE doesn't
publish a clean CVE→technique feed).
- Generates three outputs:
docs/CVE_METADATA.json machine-readable, drift-checkable
docs/KEV_CROSSREF.md human-readable table
core/cve_metadata.c auto-generated lookup table
- --check mode diffs the committed JSON against a fresh fetch for
CI drift detection.
New core API — core/cve_metadata.{h,c}:
struct cve_metadata { cve, cwe, attack_technique, attack_subtechnique,
in_kev, kev_date_added };
const struct cve_metadata *cve_metadata_lookup(const char *cve);
Lookup keyed by CVE id, not module name — the metadata is properties
of the CVE (two modules covering the same bug see the same metadata).
The opsec_notes field stays on the module struct because exploit
technique varies per-module (different footprints).
Output surfacing:
- --list: new KEV column shows ★ for KEV-listed CVEs.
- --module-info (text): prints cwe / att&ck / 'in CISA KEV: YES (added
YYYY-MM-DD)' between summary and operations.
- --module-info / --scan (JSON): emits a 'triage' subobject with the
full record, plus an 'opsec_notes' field at top level when set.
Initial snapshot:
- 10 of 26 modules cover KEV-listed CVEs (dirty_cow, dirty_pipe,
pwnkit, sudo_samedit, ptrace_traceme, fuse_legacy, nf_tables,
overlayfs, overlayfs_setuid, netfilter_xtcompat).
- 24 of 26 have NVD CWE mappings; 2 unmapped (NVD has no weakness
record for CVE-2019-13272 and CVE-2026-46300 yet).
- All 26 mapped to an ATT&CK technique.
Verification:
- macOS local: 33 kernel_range + clean build, --module-info shows
'in CISA KEV: YES (added 2024-05-30)' for nf_tables, --list KEV
column renders.
- Linux (docker gcc:latest): 33 + 54 = 87 passes, 0 fails.
Follow-up commits will add per-module OPSEC notes and --explain mode.
48 lines
2.2 KiB
Markdown
48 lines
2.2 KiB
Markdown
# CISA KEV Cross-Reference
|
|
|
|
Which SKELETONKEY modules cover CVEs that CISA has observed exploited
|
|
in the wild per the Known Exploited Vulnerabilities catalog.
|
|
Refreshed via `tools/refresh-cve-metadata.py`.
|
|
|
|
**10 of 26 modules cover KEV-listed CVEs.**
|
|
|
|
## In KEV (prioritize patching)
|
|
|
|
| CVE | Date added to KEV | CWE | Module |
|
|
| --- | --- | --- | --- |
|
|
| CVE-2019-13272 | 2021-12-10 | ? | `ptrace_traceme_cve_2019_13272` |
|
|
| CVE-2016-5195 | 2022-03-03 | CWE-362 | `dirty_cow_cve_2016_5195` |
|
|
| CVE-2021-3156 | 2022-04-06 | CWE-193 | `sudo_samedit_cve_2021_3156` |
|
|
| CVE-2022-0847 | 2022-04-25 | CWE-665 | `dirty_pipe_cve_2022_0847` |
|
|
| CVE-2021-4034 | 2022-06-27 | CWE-787 | `pwnkit_cve_2021_4034` |
|
|
| CVE-2021-3493 | 2022-10-20 | CWE-270 | `overlayfs_cve_2021_3493` |
|
|
| CVE-2024-1086 | 2024-05-30 | CWE-416 | `nf_tables_cve_2024_1086` |
|
|
| CVE-2022-0185 | 2024-08-21 | CWE-190 | `fuse_legacy_cve_2022_0185` |
|
|
| CVE-2023-0386 | 2025-06-17 | CWE-282 | `overlayfs_setuid_cve_2023_0386` |
|
|
| CVE-2021-22555 | 2025-10-06 | CWE-787 | `netfilter_xtcompat_cve_2021_22555` |
|
|
|
|
## Not in KEV
|
|
|
|
Not observed exploited per CISA — but several have public PoC code
|
|
and are technically reachable. "Not in KEV" is not the same as
|
|
"safe to ignore".
|
|
|
|
| CVE | CWE | Module |
|
|
| --- | --- | --- |
|
|
| CVE-2017-7308 | CWE-681 | `af_packet_cve_2017_7308` |
|
|
| CVE-2020-14386 | CWE-250 | `af_packet2_cve_2020_14386` |
|
|
| CVE-2021-33909 | CWE-190 | `sequoia_cve_2021_33909` |
|
|
| CVE-2022-0492 | CWE-287 | `cgroup_release_agent_cve_2022_0492` |
|
|
| CVE-2022-25636 | CWE-269 | `nft_fwd_dup_cve_2022_25636` |
|
|
| CVE-2022-2588 | CWE-416 | `cls_route4_cve_2022_2588` |
|
|
| CVE-2023-0179 | CWE-190 | `nft_payload_cve_2023_0179` |
|
|
| CVE-2023-0458 | CWE-476 | `entrybleed_cve_2023_0458` |
|
|
| CVE-2023-2008 | CWE-129 | `vmwgfx_cve_2023_2008` |
|
|
| CVE-2023-22809 | CWE-269 | `sudoedit_editor_cve_2023_22809` |
|
|
| CVE-2023-32233 | CWE-416 | `nft_set_uaf_cve_2023_32233` |
|
|
| CVE-2023-3269 | CWE-416 | `stackrot_cve_2023_3269` |
|
|
| CVE-2023-4622 | CWE-416 | `af_unix_gc_cve_2023_4622` |
|
|
| CVE-2026-31635 | CWE-130 | `dirtydecrypt_cve_2026_31635` |
|
|
| CVE-2026-41651 | CWE-367 | `pack2theroot_cve_2026_41651` |
|
|
| CVE-2026-46300 | ? | `fragnesia_cve_2026_46300` |
|