feat(S26): add degraded verification mode for kernel vulnerability checking by nikepakou · Pull Request #1927 · e-m-b-a/emba

nikepakou · 2026-04-01T06:03:06Z

Summary

This PR implements a degraded verification mode for the S26 kernel vulnerability verifier module to address issue #1925.

Changes

Add KERNEL_SOURCE_AVAILABLE flag to detect kernel source availability
Implement vuln_checker_threader_degraded() for symbol-based CVE filtering
When kernel source download fails, extract function names from CVE descriptions and match against firmware symbol table
Only report CVEs with matching function names in degraded mode
Update final_log_kernel_vulns() to handle degraded mode statistics

Problem Solved

The current S26 module generates many false positives when kernel source download fails:

cve-bin-tool detects CVEs based on version numbers
Kernel source download fails/times out
Result: CVEs are reported but cannot be verified

Solution

When kernel source is unavailable:

Extract kernel symbols from firmware ELF and modules
Extract function names from CVE descriptions (NVD database)
Match function names against firmware symbol table
Only report CVEs with confirmed function presence

This significantly reduces false positives while maintaining accurate vulnerability detection.

Closes #1925

github-actions

Thank you for contributing a pull request!

Welcome to the EMBA firmware analysis community!

We are glad you are here and appreciate your contribution. Please keep in mind our contributing guidelines here and here.
Also, please check existing open issues and consider to open a discussion in the dedicated discussion area.
Additionally, we have collected a lot of details around EMBA, the installation and the usage of EMBA in our Wiki.

If you like EMBA you have the chance to support us by becoming a Sponsor or buying some beer here.

To show your love for EMBA with nice shirts or other merch you can check our Spreadshop.

This is an automatic message. Allow for time for the EMBA community to be able to read the pull request and comment on it.

m-1-k-3 · 2026-04-01T06:19:33Z

Thank you @nikepakou for the bug report and the fix here. Before going into detailed review please ensure that your PR is based on the latest master as we introduced shfmt a few days ago for enforcing a nicer formatting style.

m-1-k-3 · 2026-04-01T07:46:37Z

shfmt is currently not passing. Please check

…ecking - Add KERNEL_SOURCE_AVAILABLE flag to detect kernel source availability - Implement vuln_checker_threader_degraded() for symbol-based CVE filtering - When kernel source download fails, extract function names from CVE descriptions and match against firmware symbol table - Only report CVEs with matching function names in degraded mode - Update final_log_kernel_vulns() to handle degraded mode statistics - Add English-only comments for international collaboration This addresses the issue of reducing false positives when kernel source download fails during firmware analysis. Closes: e-m-b-a#1925

Copilot

Pull request overview

This PR adds a “degraded verification mode” to S26_kernel_vuln_verifier so that when kernel source download is unavailable, the module filters version-derived kernel CVEs by matching function names extracted from NVD descriptions against symbols found in the firmware’s kernel/module ELF data (aiming to reduce false positives, per #1925).

Changes:

Introduces KERNEL_SOURCE_AVAILABLE gating and a degraded verification path (vuln_checker_threader_degraded) that performs symbol-name-based CVE filtering when sources can’t be obtained.
Refactors S26 flow to always extract kernel/module symbols and then choose between normal (source-based) vs degraded (symbol-only) verification.
Reworks final reporting (final_log_kernel_vulns) and summary update logic to incorporate degraded-mode behavior/statistics.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

…ify_v2

m-1-k-3

A quite huge PR with a lot of changes. I am done around 50% of it. Multiple comments to check and adjust. Please also share your testing firmware and your testing procedure (EMBA start command)

m-1-k-3 · 2026-04-04T10:31:41Z

+#   - Final vulnerability report
+# ==========================================================================================
+
+# Set thread priority to 1 (low priority)


set to 1 means that this module is a priority modules

m-1-k-3 · 2026-04-04T10:33:51Z

  module_wait "S24_kernel_bin_identifier"

-  # now we should have a csv log with a kernel version:
+  # Check if S24 CSV log exists


please adjust the comment that this file should be available if s24 gave us results

m-1-k-3 · 2026-04-04T11:03:23Z

    print_output "[+] Identified kernel version: ${ORANGE}${lK_VERSION}${NC}"

+    # Find kernel ELF entries matching current version from S24 CSV
+    # Sort by column 4 (version) in descending order, prioritize higher versions


field 4 is the identified init

m-1-k-3 · 2026-04-04T11:05:15Z

        print_output "[+] Found kernel configuration file: ${ORANGE}${KERNEL_CONFIG_PATH}${NC}"
-        # we use the first entry with a kernel config detected
+        # Use the first entry with kernel config detected
+        # Column 1 is the matching kernel elf file - sometimes only config without elf file


this is a kernel file but it does not automatically mean this is a elf file

m-1-k-3 · 2026-04-04T11:05:39Z

+        # Column 1 is the matching kernel elf file - sometimes only config without elf file
        if [[ "$(echo "${lKERNEL_DATA}" | cut -d\; -f1)" == "/"* ]]; then
-          # field 1 is the matching kernel elf file - sometimes we have a config but no elf file
+          # field 1 is the matching kernel elf file


matching kernel file

m-1-k-3 · 2026-04-04T11:53:52Z

-  lKARCH="${lKARCH,,}"
-  export COMPILE_SOURCE_FILES=0
-  export COMPILE_SOURCE_FILES_VERIFIED=0
+  local lARCH="${3:-}"


the K was for kernel. Please recover the original name

m-1-k-3 · 2026-04-04T11:57:37Z

+  # -d: debug mode, output detailed info
+  # -i: ignore errors
+  # Based on paper: https://arxiv.org/pdf/2209.05217.pdf
+  make -C "${lKERNEL_DIR}" ARCH="${lARCH}" -Bndi 2>/dev/null | grep -E "\.c|\.h|\.S" >"${LOG_PATH_MODULE}"/kernel-compile-files.log || true


please do not remove the LANG as this will result in issue on other language systems

m-1-k-3 · 2026-04-04T11:59:38Z

+  cp "${lCONFIG}" "${lKERNEL_DIR}/.config" || true
+
+  print_output "[*] Update kernel configuration"
+  make -C "${lKERNEL_DIR}" ARCH="${lARCH}" olddefconfig 2>/dev/null || true


please leave the reference to stack overflow

m-1-k-3 · 2026-04-04T12:01:49Z

+  cp "${lCONFIG}" "${lKERNEL_DIR}/.config" || true
+
+  print_output "[*] Update kernel configuration"
+  make -C "${lKERNEL_DIR}" ARCH="${lARCH}" olddefconfig 2>/dev/null || true


please leave the original logging and the linking to the log for later verification

m-1-k-3 · 2026-04-04T12:05:52Z

+
+  print_output "[*] Generating final vulnerability report for kernel ${ORANGE}${lK_VERSION}${NC}"
+
+  # Create CSV report file (header) -保持向后兼容格式


please stay in english

m-1-k-3 · 2026-04-04T15:59:32Z

With #1930 in place I let your module run with the following command:

sudo ./emba -f ~/Downloads/DIR600B5_FW214WWb01.bin -l ~/Downloads/emba_logs_kernel  -y -S -m s24 -m s25 -m s26 -m f199 -W

I got no verified vulnerabilities anymore:

With only #1930 in place it looks the following:

github-actions bot reviewed Apr 1, 2026

View reviewed changes

m-1-k-3 added bug Something isn't working Core modules (Sxx) The core scanning modules (Sxx modules) EMBA labels Apr 1, 2026

nikepakou force-pushed the s26_modify_v2 branch from 0c96755 to 7b875ff Compare April 1, 2026 06:28

m-1-k-3 reviewed Apr 1, 2026

View reviewed changes

Comment thread modules/S26_kernel_vuln_verifier.sh Outdated

m-1-k-3 reviewed Apr 1, 2026

View reviewed changes

Comment thread modules/S26_kernel_vuln_verifier.sh Outdated

nikepakou force-pushed the s26_modify_v2 branch 2 times, most recently from 33e3f2a to 3d83b34 Compare April 1, 2026 10:08

nikepakou force-pushed the s26_modify_v2 branch from 3d83b34 to 021cb32 Compare April 1, 2026 10:33

nikepakou closed this Apr 1, 2026

nikepakou reopened this Apr 1, 2026

feat: fallback extract_kernel_arch

c980e02

nikepakou requested a review from m-1-k-3 April 2, 2026 01:03

m-1-k-3 requested a review from Copilot April 2, 2026 06:50

Copilot started reviewing on behalf of m-1-k-3 April 2, 2026 06:51 View session

Copilot AI reviewed Apr 2, 2026

View reviewed changes

nikepakou added 2 commits April 2, 2026 16:12

Merge branch 'master' of https://github.com/e-m-b-a/emba into s26_mod…

b49c34f

…ify_v2

bugfix: modify kernel version format in CSV report file

55a7cfd

nikepakou force-pushed the s26_modify_v2 branch from ccad541 to 55a7cfd Compare April 2, 2026 08:34

m-1-k-3 reviewed Apr 2, 2026

View reviewed changes

Comment thread modules/S26_kernel_vuln_verifier.sh Outdated

bugfix: shfmt format S26_kernel_vuln_verifier.sh

58a2ade

m-1-k-3 mentioned this pull request Apr 3, 2026

S24 vmlinux-to-elf adjustments #1930

Merged

m-1-k-3 requested changes Apr 4, 2026

View reviewed changes


		print_output "[*] Generating final vulnerability report for kernel ${ORANGE}${lK_VERSION}${NC}"

		# Create CSV report file (header) -保持向后兼容格式

Uh oh!

Conversation

nikepakou commented Apr 1, 2026

Summary

Changes

Problem Solved

Solution

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

Uh oh!

m-1-k-3 commented Apr 1, 2026

Uh oh!

m-1-k-3 commented Apr 1, 2026

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

m-1-k-3 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

m-1-k-3 commented Apr 4, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants