CVEhound

CVEhound is a tool for checking Linux sources for known CVEs. The tool is based on coccinelle rules and grep patterns. The tool checks sources for vulnerable code patterns of known CVEs and missing fixes for them.

• What: The tool tries to find "unfixed" code of known CVEs;
• How: The tool uses coccinelle/grep rules with patterns that helps to detect known CVE bugs or their fixes. Thus, sources are checked either for a presence of "unfixed" code pieces (e.g. CVE-2020-12912), or for an absence of a fix (e.g. CVE-2020-26088);
• Why: If you have a git log then it's easier to check what CVEs are fixed based on a git history. However, many vendors (samsung, huawei, various iot, routers manufacturers) publish kernel sources as archives without a development log. In most cases their kernels are based on LTS kernels, but versions are far from upstream. Linux version string from Makefile will only give you information about what CVEs were fixed by kernel developers up to this version. It will not help you to understand what fixes were backported by a vendor itself. In this case it's possible to apply the tool and check "missing" CVE fixes.

CVEHound: Audit Kernel Sources for Missing CVE Fixes

Linux Security Summit 2021 Presentation (EN)

ZeroNights 2021 Presentation (RU)

Found issues in stable trees

• CVE-2020-27825 fix missing backports for 5.4, 4.19, 4.14, 4.9, 4.4 kernels
• CVE-2021-4149 fix missing backports to 4.19, 4.14, 4.9 kernels
• CVE-2022-26490 fix missing backports
• CVE-2023-1989 fix missing backports for 6.1, 5.15, 5.10, 5.4, 4.19, 4.14 kernels
• Similar to CVE-2021-28660 fix in r8188eu driver
• Similar to CVE-2021-28660 fix in rtl8723bs driver
• Similar to CVE-2022-26490 fix in st-nci driver
• Security regression CVE-2020-10781
• See tests exceptions for more examples

Prerequisites

• Python 3 (>=3.11)
• pip (Python package manager)
• grep with pcre support (-P flag)
• coccinelle (>= 1.0.7)

Install prerequisites:

# Ubuntu, coccinelle uses libpython2.7 internally
# Seems like some ppas mark libpython dependency as optional
$ sudo add-apt-repository ppa:npalix/coccinelle
$ sudo apt install python3-pip coccinelle libpython2.7

# Fedora
$ sudo dnf install python3-pip coccinelle

# macOS
$ brew install coccinelle

Installation

To install the latest stable version just run the following command:

$ python3 -m pip install --user cvehound

For development purposes you may install cvehound in "editable" mode directly from the repository (clone it on your computer beforehand):

$ pip install -e .

To update the cve rules from github repository:

$ cvehound_update_rules

How to use

The simplest way to start using CVEhound is to run the following command:

$ cvehound --kernel ~/linux
Found: CVE-2020-27830
Found: CVE-2020-27152
Found: CVE-2020-29371
Found: CVE-2020-26088

where dir should point to the Linux kernel sources. CVEhound will check the sources for all cve patterns that you can find in cve dir. To check the sources for particular CVEs one can use:

$ cvehound --kernel ./linux --kernel-config --cve CVE-2020-27194 CVE-2020-29371
Checking: CVE-2020-27194
Found: CVE-2020-27194
MSG: bpf: Fix scalar32_min_max_or bounds tracking
CWE: Improper Restriction of Operations within the Bounds of a Memory Buffer
FIX DATE: 2020-10-08 09:02:53
https://www.linuxkernelcves.com/cves/CVE-2020-27194
Affected Files:
 - linux/kernel/bpf/verifier.c: CONFIG_BPF & CONFIG_BPF_SYSCALL
   linux/.config: affected
Config: ./linux/.config affected

Checking: CVE-2020-29371
Found: CVE-2020-29371
MSG: romfs: fix uninitialized memory leak in romfs_dev_read()
CWE: Use of Uninitialized Resource
FIX DATE: 2020-08-21 16:52:53
https://www.linuxkernelcves.com/cves/CVE-2020-29371
Affected Files:
 - linux/fs/romfs/storage.c: CONFIG_ROMFS_FS
   linux/.config: not affected
Config: ./linux/.config not affected

Other args:

• --report - will produce json file with found CVEs Most of the metainformation in the generated report is taken from linuxkernelcves.com
• --kernel-config or --kernel-config <file> - will infer the kernel configuration required to build the affected code (based on Kbuild/Makefiles, ifdefs are not checked) and check kernel .config file if there is one
• --files, --cwe - will limit the scope of checked cves to the kernel files of interest or specific CWE classes
• --exploit - check only for CVEs that are known to be exploitable (according to the FSTEC BDU database)

Contributing

Development Setup

# Clone and install in editable mode
$ git clone https://github.com/evdenis/cvehound.git
$ cd cvehound
$ pip install -e '.[tests]'

# Install pre-commit hooks
$ pip install pre-commit
$ pre-commit install

# Run linting and type checking
$ pre-commit run --all-files

The project uses:

• ruff for linting and formatting
• mypy for static type checking (strict mode)
• pre-commit for automated code quality checks

Writing CVE Detection Rules

If you'd like to contribute new CVE detection rules, please see our comprehensive guides:

• Writing Coccinelle Detection Rules for CVE Patterns - Complete guide with step-by-step instructions, patterns, and examples
• Coccinelle CVE Detection Cheat Sheet - Quick reference for common patterns
• AI Agent Guide - Systematic approach for AI agents writing CVE rules

Templates:

• contrib/template.cocci - Enhanced template with examples and comments
• contrib/blank.cocci - Minimal template for new rules

License

Python code is licensed under GPLv3. All rules in cvehound/cve folder are licensed under GPLv2.

Acknowledgements

I would like to thank the following projects and people behind them:

• coccinelle for the program matching engine
• linuxkernelcves.com for information about Linux CVEs
• undertaker for mapping kernel configs to .c files
• sympy for the symbolic logic solver