Files

T

leviathan e4a600fef2 module metadata: CWE + ATT&CK + CISA KEV triage from federal sources

Adds per-CVE triage annotations that turn SKELETONKEY's JSON output
into something a SIEM/CTI/threat-intel pipeline can route on, and a
KEV badge in --list so operators see at-a-glance which modules
cover actively-exploited bugs.

New tool — tools/refresh-cve-metadata.py:

  - Discovers CVEs by scanning modules/<dir>/ (no hardcoded list).
  - Fetches CISA's Known Exploited Vulnerabilities catalog
    (https://www.cisa.gov/.../known_exploited_vulnerabilities.csv).
  - Fetches CWE classifications from NVD's CVE API 2.0
    (services.nvd.nist.gov), throttled to the anonymous
    5-req/30s limit (~3 minutes for 26 CVEs).
  - Hand-curated ATT&CK technique mapping (T1068 default; T1611 for
    container escapes, T1082 for kernel info leaks — MITRE doesn't
    publish a clean CVE→technique feed).
  - Generates three outputs:
      docs/CVE_METADATA.json   machine-readable, drift-checkable
      docs/KEV_CROSSREF.md     human-readable table
      core/cve_metadata.c      auto-generated lookup table
  - --check mode diffs the committed JSON against a fresh fetch for
    CI drift detection.

New core API — core/cve_metadata.{h,c}:

  struct cve_metadata { cve, cwe, attack_technique, attack_subtechnique,
                        in_kev, kev_date_added };
  const struct cve_metadata *cve_metadata_lookup(const char *cve);

Lookup keyed by CVE id, not module name — the metadata is properties
of the CVE (two modules covering the same bug see the same metadata).
The opsec_notes field stays on the module struct because exploit
technique varies per-module (different footprints).

Output surfacing:
  - --list: new KEV column shows ★ for KEV-listed CVEs.
  - --module-info (text): prints cwe / att&ck / 'in CISA KEV: YES (added
    YYYY-MM-DD)' between summary and operations.
  - --module-info / --scan (JSON): emits a 'triage' subobject with the
    full record, plus an 'opsec_notes' field at top level when set.

Initial snapshot:
  - 10 of 26 modules cover KEV-listed CVEs (dirty_cow, dirty_pipe,
    pwnkit, sudo_samedit, ptrace_traceme, fuse_legacy, nf_tables,
    overlayfs, overlayfs_setuid, netfilter_xtcompat).
  - 24 of 26 have NVD CWE mappings; 2 unmapped (NVD has no weakness
    record for CVE-2019-13272 and CVE-2026-46300 yet).
  - All 26 mapped to an ATT&CK technique.

Verification:
  - macOS local: 33 kernel_range + clean build, --module-info shows
    'in CISA KEV: YES (added 2024-05-30)' for nf_tables, --list KEV
    column renders.
  - Linux (docker gcc:latest): 33 + 54 = 87 passes, 0 fails.

Follow-up commits will add per-module OPSEC notes and --explain mode.

2026-05-23 10:38:01 -04:00

2.2 KiB

Raw Blame History

CISA KEV Cross-Reference

Which SKELETONKEY modules cover CVEs that CISA has observed exploited in the wild per the Known Exploited Vulnerabilities catalog. Refreshed via tools/refresh-cve-metadata.py.

10 of 26 modules cover KEV-listed CVEs.

In KEV (prioritize patching)

CVE	Date added to KEV	CWE	Module
CVE-2019-13272	2021-12-10	?	`ptrace_traceme_cve_2019_13272`
CVE-2016-5195	2022-03-03	CWE-362	`dirty_cow_cve_2016_5195`
CVE-2021-3156	2022-04-06	CWE-193	`sudo_samedit_cve_2021_3156`
CVE-2022-0847	2022-04-25	CWE-665	`dirty_pipe_cve_2022_0847`
CVE-2021-4034	2022-06-27	CWE-787	`pwnkit_cve_2021_4034`
CVE-2021-3493	2022-10-20	CWE-270	`overlayfs_cve_2021_3493`
CVE-2024-1086	2024-05-30	CWE-416	`nf_tables_cve_2024_1086`
CVE-2022-0185	2024-08-21	CWE-190	`fuse_legacy_cve_2022_0185`
CVE-2023-0386	2025-06-17	CWE-282	`overlayfs_setuid_cve_2023_0386`
CVE-2021-22555	2025-10-06	CWE-787	`netfilter_xtcompat_cve_2021_22555`

Not in KEV

Not observed exploited per CISA — but several have public PoC code and are technically reachable. "Not in KEV" is not the same as "safe to ignore".

CVE	CWE	Module
CVE-2017-7308	CWE-681	`af_packet_cve_2017_7308`
CVE-2020-14386	CWE-250	`af_packet2_cve_2020_14386`
CVE-2021-33909	CWE-190	`sequoia_cve_2021_33909`
CVE-2022-0492	CWE-287	`cgroup_release_agent_cve_2022_0492`
CVE-2022-25636	CWE-269	`nft_fwd_dup_cve_2022_25636`
CVE-2022-2588	CWE-416	`cls_route4_cve_2022_2588`
CVE-2023-0179	CWE-190	`nft_payload_cve_2023_0179`
CVE-2023-0458	CWE-476	`entrybleed_cve_2023_0458`
CVE-2023-2008	CWE-129	`vmwgfx_cve_2023_2008`
CVE-2023-22809	CWE-269	`sudoedit_editor_cve_2023_22809`
CVE-2023-32233	CWE-416	`nft_set_uaf_cve_2023_32233`
CVE-2023-3269	CWE-416	`stackrot_cve_2023_3269`
CVE-2023-4622	CWE-416	`af_unix_gc_cve_2023_4622`
CVE-2026-31635	CWE-130	`dirtydecrypt_cve_2026_31635`
CVE-2026-41651	CWE-367	`pack2theroot_cve_2026_41651`
CVE-2026-46300	?	`fragnesia_cve_2026_46300`

2.2 KiB Raw Blame History

CISA KEV Cross-Reference

In KEV (prioritize patching)

Not in KEV

2.2 KiB

Raw Blame History