The vulnerability affects methods, devices, storage media, and electronic devices.

Abstract

This invention provides a method, apparatus, storage medium, and electronic device for correcting the scope of vulnerability impact, relating to the field of vulnerability management technology. The invention first obtains the initial scope of vulnerability impact from a publicly available data source, then locates the source file based on the vulnerability patch, and further finds all modification records of the software package containing the source file. It compares the software version that first introduced the source file into the software with the initial version number, thereby modifying the scope of vulnerability impact. This effectively increases the accuracy of vulnerability data, more accurately displaying the software version range affected by the vulnerability or increasing the initial version of the affected software package, effectively reducing false positives.

Description

Technical Field

[0001] This invention relates to the field of vulnerability management technology, and specifically to a method, apparatus, storage medium, and electronic device for correcting the scope of vulnerability impact. Background Technology

[0002] In traditional technical solutions, when building a vulnerability database, the scope of a vulnerability's impact is directly derived from information described in the data source from which it is based. The vulnerability data directly affects how security personnel patch the code.

[0003] However, when data sources disclose the scope of vulnerability impact, there is often a difference between the actual scope of vulnerability impact and the actual scope of vulnerability impact; they usually give a larger scope of impact.

[0004] Inaccurate data on the scope of impact of vulnerabilities can lead to false alarms. If there is a large amount of inaccurate data, it can further result in a significant waste of human resources. Summary of the Invention

[0005] (a) Technical problems to be solved

[0006] To address the shortcomings of existing technologies, this invention provides a method, apparatus, storage medium, and electronic device for correcting the scope of vulnerability impact, thus resolving the problem that the scope of vulnerability impact disclosed by existing publicly available data sources is too large.

[0007] (II) Technical Solution

[0008] To achieve the above objectives, the present invention provides the following technical solution:

[0009] Firstly, a method for correcting the scope of vulnerability impact is provided, the method comprising:

[0010] Obtain the initial impact scope of the vulnerability from a publicly available data source; the initial impact scope includes the initial version number;

[0011] Obtaining a patch for the aforementioned vulnerability requires modifying the source code files;

[0012] Retrieve all modification records of the software package containing the source file;

[0013] Based on the modification history, the software version that first introduced the source file into the software will be used as the alternative starting version number;

[0014] Compare the initial start version number and the alternative start version number. If the alternative start version number is greater than the initial start version number, then the alternative start version number is used as the initial start version number after the vulnerability is fixed.

[0015] Furthermore, the method also includes:

[0016] If the alternative starting version number is not greater than the initial starting version number, the initial impact range will not be modified.

[0017] Furthermore, the publicly available data source is the vulnerability's CPE format data.

[0018] Furthermore, the patch includes code modification information; the modification record includes the modification time and modification content.

[0019] Secondly, a patch-based vulnerability impact scope correction device is provided, characterized in that the device comprises:

[0020] The initial impact scope acquisition module is used to obtain the initial impact scope of the vulnerability from a public data source; the initial impact scope includes the initial version number;

[0021] The source file acquisition module is used to acquire the source files for which the patch for the vulnerability requires code modification.

[0022] The modification record acquisition module is used to acquire all modification records of the software package containing the source file.

[0023] The alternative starting version number determination module is used to determine the software version that first introduced the source file into the software as the alternative starting version number based on the modification record;

[0024] The impact scope correction module is used to compare the initial start version number and the alternative start version number. If the alternative start version number is greater than the initial start version number, the alternative start version number will be used as the initial start version number after the vulnerability is corrected.

[0025] Furthermore, the influence range correction module is also used to not correct the initial influence range if the candidate starting version number is not greater than the initial starting version number.

[0026] Furthermore, the publicly available data source is the vulnerability's CPE format data.

[0027] Furthermore, the patch includes code modification information; the modification record includes the modification time and modification content.

[0028] Thirdly, a computer-readable storage medium is provided that stores a computer program for resolving the scope of a vulnerability, wherein the computer program causes a computer to execute the aforementioned method for resolving the scope of a vulnerability.

[0029] Fourthly, an electronic device is provided, comprising:

[0030] One or more processors;

[0031] Memory; and

[0032] One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including methods for performing the aforementioned vulnerability impact scope correction method.

[0033] (III) Beneficial Effects

[0034] This invention provides a method, apparatus, storage medium, and electronic device for correcting the scope of a vulnerability. Compared with the prior art, it has the following advantages:

[0035] This invention first obtains the initial impact range of a vulnerability, then finds the source file based on the vulnerability patch, and then finds all modification records of the software package containing the source file. It compares the software version that first introduced the source file into the software with the initial version number, and then modifies the impact range of the vulnerability. This can effectively increase the accuracy of vulnerability data, more accurately display the software version range affected by the vulnerability or increase the initial version of the software package affected by the vulnerability, and effectively reduce the occurrence of false vulnerability reports. Attached Figure Description

[0036] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0037] Figure 1 This is a flowchart of an embodiment of the present invention;

[0038] Figure 2 This is an example diagram illustrating how to filter out source files that require code modification according to an embodiment of the present invention.

[0039] Figure 3 This is an example diagram illustrating the first submission of a query for a file according to an embodiment of the present invention;

[0040] Figure 4 This is an example image showing how to view all tags according to an embodiment of the present invention;

[0041] Figure 5 This is an example diagram showing the submissions contained in each tag, as per an embodiment of the present invention. Detailed Implementation

[0042] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention are described clearly and completely. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0043] This application provides a method, apparatus, storage medium, and electronic device for correcting the scope of vulnerability impact, thereby addressing the problem that the scope of vulnerability impact disclosed by existing publicly available data sources is too large.

[0044] The technical solution in this application is to solve the above-mentioned technical problems, and the general idea is as follows:

[0045] Existing public data sources often present a discrepancy between the published impact scope of vulnerabilities and the actual impact scope, typically giving a larger-than-expected range. To address this issue, this invention first obtains the initial impact scope of the vulnerability from public data sources; then, it obtains the source files whose code needs to be modified for the patch; next, it obtains all modification records of the software package containing the source files; subsequently, based on these modification records, it uses the software version that first incorporates the source files as a candidate starting version number; finally, it compares the initial starting version number and the candidate starting version number. If the candidate starting version number is greater than the initial starting version number, it is used as the initial starting version number after the vulnerability is patched. This approach narrows the vulnerability's impact scope and reduces the probability of false positives.

[0046] To better understand the above technical solutions, the following will provide a detailed explanation of the technical solutions in conjunction with the accompanying drawings and specific implementation methods.

[0047] Example 1:

[0048] like Figure 1 As shown, this invention provides a method for correcting the scope of a vulnerability, which is executed by a computer and includes:

[0049] Obtain the initial impact scope of the vulnerability from a publicly available data source; the initial impact scope includes the initial version number;

[0050] Obtaining a patch for the aforementioned vulnerability requires modifying the source code files;

[0051] Retrieve all modification records of the software package containing the source file;

[0052] Based on the modification history, the software version that first introduced the source file into the software will be used as the alternative starting version number;

[0053] Compare the initial start version number and the alternative start version number. If the alternative start version number is greater than the initial start version number, then the alternative start version number is used as the initial start version number after the vulnerability is fixed.

[0054] The beneficial effects of this embodiment are:

[0055] 1) In this embodiment of the invention, the initial impact range of the vulnerability is first obtained, and then the source file is found based on the vulnerability patch. Then, all modification records of the software package containing the source file are found. The software version that first introduced the source file into the software is compared with the initial version number, and then the impact range of the vulnerability is modified. This can effectively increase the accuracy of vulnerability data, and can more accurately display the software version range affected by the vulnerability or increase the initial version of the software package affected by the vulnerability, effectively reducing the situation of false vulnerability reports.

[0056] The implementation process of the embodiments of the present invention will be described in detail below:

[0057] Software package: refers to a program or group of programs that has specific functions and is used to accomplish a specific task.

[0058] Source file: refers to the source code file of the software package;

[0059] A vulnerability is a flaw that exists in the specific implementation of hardware, software, protocols, or system security policies.

[0060] Patches: Small packages used to resolve issues caused by vulnerabilities.

[0061] Modification history: refers to the record of each modification made to the software package;

[0062] CPE format data: (short for Common Platform Enumeration) is a standardized method for naming software applications, operating systems, and hardware.

[0063] CPE naming rules:

[0064] cpe: / <part> : <vendor> : <product> : <version> : <update> : <edition> : <language>

[0065] in,

[0066] Part: Target type;

[0067] vendor: manufacturer;

[0068] Product: Product Name;

[0069] version: Version number;

[0070] Update: Update package;

[0071] edition: version;

[0072] Language: Language item.

[0073] Therefore, the method includes the following steps:

[0074] S1. Obtain the initial impact scope of the vulnerability from publicly available data sources.

[0075] In practice, there are no restrictions on publicly available data sources. For example, a publicly available data source could be NVD, a repository of standard vulnerability management data represented by the Security Content Automation Protocol (SCAP) used by the US government. This database automates vulnerability management and security measurement. NVD includes databases of security checklist references, security-related software defects, misconfigurations, product names, and impact metrics. NVD uses standardized data formats; for example, the initial impact of a vulnerability can be obtained from CPE format data. Initial vulnerability data can also be obtained from other vulnerability disclosure addresses.

[0076] Kernel vulnerabilities can be found on this website: https: / / www.linuxkernelcves.com / ;

[0077] Vulnerabilities in other open-source software, such as those affecting OpenSSL, can be found here: https: / / www.openssl.org / news / vulnerabilities.html.

[0078] Obtaining the patch for the aforementioned vulnerability requires modifying the source code files.

[0079] In practice, vulnerabilities and patches can be in a one-to-many or one-to-one relationship. The content of the patch is in a standard format, such as a .patch file. In Linux systems, the diff command can generate patch files, and then the patch command can be used to patch the problematic program code.

[0080] By directly parsing the patch content according to the standard, the source files that need code modification can be filtered out. Meanwhile, such as... Figure 2 As shown, there are also open-source methods to parse the source files in the patch file, and the source files found may be multiple or just one.

[0081] Obtain all modification records of the software package containing the source file.

[0082] In practice, this embodiment does not limit the method of obtaining modification records. Taking the kernel as an example, the kernel source code is hosted on git. To obtain modification records, you only need to clone the project to your local machine and then execute git log. The modification records include what modifications were made at what time.

[0083] The software version that first introduced the source file into the software based on the modification history will be used as the alternative starting version number.

[0084] In practice, when the source file is first imported into the software, the modification record will save the modification information, so this version may be the real starting version number.

[0085] Taking the kernel as an example, the steps are as follows:

[0086] S401, clone the complete kernel source code from https: / / www.kernel.org / ;

[0087] S402, such as Figure 3 As shown, this query retrieves the first commit of a specific file.

[0088] S403, such as Figure 4 As shown, view all tags;

[0089] S404, such as Figure 5 As shown, view the submissions contained in each tag;

[0090] S405: Find the hash value submitted in S402, determine which tag in S404 it belongs to, and obtain the corresponding alternative starting version number.

[0091] Compare the initial start version number and the alternative start version number. If the alternative start version number is greater than the initial start version number, then the alternative start version number is used as the initial start version number after the vulnerability is fixed.

[0092] In practice, there may be three scenarios:

[0093] 1) The alternative starting version number is greater than the initial starting version number (when the initial impact range is less than a certain value, such as <2.0, the initial starting version number can be set to a negative number, such as -1): In this case, the initial impact range is a larger range. However, through the above steps, it was found that the version that is actually affected should start from the alternative starting version number. Therefore, the alternative starting version number is used as the initial starting version number after the vulnerability is fixed.

[0094] 2) Alternate starting version number equals initial starting version number: When the two are equal, it means that the starting version number of the initial scope of influence given by the public data source is accurate, so there is no need to correct the initial scope of influence.

[0095] 3) If the alternative starting version number is less than the initial starting version number: no correction is needed to the initial scope of influence. The fine-grained approach in this embodiment is only detailed to the file level, not to the code segment level.

[0096] For example: Vulnerability A is disclosed on the external network, affecting versions 1.0-2.0 of software m. Using this patented method, we found that the alternative starting version number is 0.5. However, the vulnerability is introduced by function f in the file, which was introduced in version 1.0. Therefore, it would be inaccurate to correct the version number to 0.5-2.0.

[0097] Example 2:

[0098] A patch-based vulnerability impact mitigation device, the device comprising:

[0099] The initial impact scope acquisition module is used to obtain the initial impact scope of the vulnerability from a public data source; the initial impact scope includes the initial version number;

[0100] The source file acquisition module is used to acquire the source files for which the patch for the vulnerability requires code modification.

[0101] The modification record acquisition module is used to acquire all modification records of the software package containing the source file.

[0102] The alternative starting version number determination module is used to determine the software version that first introduced the source file into the software as the alternative starting version number based on the modification record;

[0103] The impact scope correction module is used to compare the initial start version number and the alternative start version number. If the alternative start version number is greater than the initial start version number, the alternative start version number will be used as the initial start version number after the vulnerability is corrected.

[0104] It is understood that the patch-based vulnerability impact scope correction device provided in this embodiment of the invention corresponds to the above-mentioned vulnerability impact scope correction method. The explanation, examples, and beneficial effects of its contents can be referred to the corresponding contents in the vulnerability impact scope correction method, and will not be repeated here.

[0105] Example 3:

[0106] A computer-readable storage medium storing a computer program for correcting the scope of a vulnerability, wherein the computer program causes a computer to perform the following steps:

[0107] Obtain the initial impact scope of the vulnerability from a publicly available data source; the initial impact scope includes the initial version number;

[0108] Obtaining a patch for the aforementioned vulnerability requires modifying the source code files;

[0109] Retrieve all modification records of the software package containing the source file;

[0110] Based on the modification history, the software version that first introduced the source file into the software will be used as the alternative starting version number;

[0111] Compare the initial start version number and the alternative start version number. If the alternative start version number is greater than the initial start version number, then the alternative start version number is used as the initial start version number after the vulnerability is fixed.

[0112] Example 4:

[0113] An electronic device, comprising:

[0114] One or more processors;

[0115] Memory; and

[0116] One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including steps for performing the following:

[0117] Obtain the initial impact scope of the vulnerability from a publicly available data source; the initial impact scope includes the initial version number;

[0118] Obtaining a patch for the aforementioned vulnerability requires modifying the source code files;

[0119] Retrieve all modification records of the software package containing the source file;

[0120] Based on the modification history, the software version that first introduced the source file into the software will be used as the alternative starting version number;

[0121] Compare the initial start version number and the alternative start version number. If the alternative start version number is greater than the initial start version number, then the alternative start version number is used as the initial start version number after the vulnerability is fixed.

[0122] In summary, compared with the prior art, the present invention has the following beneficial effects:

[0123] 1) This invention first obtains the initial impact range of the vulnerability, then finds the source file based on the vulnerability patch, and then finds all modification records of the software package containing the source file. It compares the software version that first introduced the source file into the software with the initial version number, and then modifies the impact range of the vulnerability. This can effectively increase the accuracy of vulnerability data, and can more accurately display the software version range affected by the vulnerability or increase the initial version of the software package affected by the vulnerability, effectively reducing the situation of false vulnerability reports.

[0124] It should be noted that, through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the prior art, can be embodied in the form of software products. These computer software products can be stored in computer-readable storage media, such as ROM / RAM, magnetic disks, optical disks, etc., and include several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or certain portions of the embodiments. In this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further restrictions, an element defined by the phrase "comprising a..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0125] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.< / language> < / edition> < / update> < / version> < / product> < / vendor> < / part>

Claims

1. A method for correcting the scope of a vulnerability's impact, characterized in that, The method includes: Obtain the initial impact scope of the vulnerability from a publicly available data source; the initial impact scope includes the initial version number; the publicly available data source is the vulnerability's CPE format data; Obtaining the patch for the vulnerability requires modifying the source code file; the patch content is in a standard format; when the patch is a patch file, the patch file is generated in the Linux system using the diff command, and then the patch command is used to patch the problematic program code, directly using the standard of the patch content to parse and filter out the source files that need to be modified; Retrieve all modification records of the software package containing the source file; Based on the modification history, the software version that first introduced the source file into the software is used as the candidate starting version number; when the source file is the kernel, the complete kernel source code is cloned, the first commit of a certain file is queried, all tags are viewed, the commits contained in each tag are viewed, the hash value of the first commit of the queried file is found, and it is determined which tag it belongs to, and the corresponding candidate starting version number is obtained. Compare the initial start version number and the alternative start version number. If the alternative start version number is greater than the initial start version number, then the alternative start version number is used as the initial start version number after the vulnerability is fixed. If the alternative starting version number is not greater than the initial starting version number, the initial impact range will not be modified.

2. The method for correcting the scope of vulnerability impact as described in claim 1, characterized in that, The patch includes code modification information; the modification record includes the modification time and the modification content.

3. A patch-based vulnerability impact range correction device, characterized in that, The device includes: The initial impact scope acquisition module is used to obtain the initial impact scope of the vulnerability from a public data source; the initial impact scope includes the initial version number; the public data source is the vulnerability's CPE format data; The source file acquisition module is used to acquire the source files of the code that need to be modified for the patch of the vulnerability; the content of the patch is in a standard format; when the patch is a patch file, the patch file is generated in the Linux system using the diff command, and then the patch command is used to patch the problematic program code, directly using the standard of the patch content to parse and filter out the source files of the code that need to be modified. The modification record acquisition module is used to acquire all modification records of the software package containing the source file. The alternative starting version number determination module is used to determine the software version that first introduced the source file into the software as the alternative starting version number based on the modification record; when the source file is the kernel, the complete kernel source code is cloned, the first commit of a certain file is queried, all tags are viewed, the commits contained in each tag are viewed, the hash value of the commit when the first commit of a certain file is queried is found, and it is determined which tag it belongs to, and the corresponding alternative starting version number is obtained. The impact scope correction module is used to compare the size of the initial start version number and the alternative start version number. If the alternative start version number is greater than the initial start version number, the alternative start version number is used as the initial start version number after the vulnerability is corrected. If the alternative start version number is not greater than the initial start version number, the initial impact scope is not corrected.

4. The patch-based vulnerability impact range correction device as described in claim 3, characterized in that, The patch includes code modification information; the modification record includes the modification time and the modification content.

5. A computer-readable storage medium, characterized in that, It stores a computer program for correcting the scope of a vulnerability, wherein the computer program causes a computer to perform the vulnerability scope correction method as described in any one of claims 1-2.

6. An electronic device, characterized in that, include: One or more processors; Memory; as well as One or more programs, wherein the one or more programs are stored in the memory and configured to be executed by the one or more processors, the programs including methods for performing vulnerability scope correction methods as described in any one of claims 1-2.

Images