Method and system for automatically repairing CVE vulnerabilities in Linux operating system

Abstract

The invention discloses a method and system for automatically repairing CVE vulnerabilities of a Linux operating system. The method automatically repairs unrepaired CVE vulnerabilities on code branches, including: configuring a branch list and querying the CVE vulnerability numbers that are unrepaired and have repair patch numbers to generate a list to be repaired; traversing the list to be repaired to create a repair task; obtaining the repair patch of the CVE vulnerability of the repair task in the upstream community, and storing the repair task in the list to be automatically repaired; traversing the list to be automatically repaired to obtain the dependent patch list of each element; traversing and recursively obtaining the dependent patch list and the repair patch list of all patches in the dependent patch list in the upstream branch; synchronizing the CVE repair patch and the corresponding dependent patch and repair patch in sequence, and correctly and orderly merging the patches into the local code branch in sequence. The invention can improve the timely rate of CVE vulnerability repair, and can also reduce a large amount of manpower costs.

Description

Technical Field

[0001] The present invention relates to operating system vulnerability repair technology, and in particular to a CVE vulnerability automatic repair method and system for a Linux operating system. Background Art

[0002] The kernel is the core part of the operating system, responsible for managing system resources and providing programs with interfaces to access hardware. It runs at the highest privilege level and is responsible for managing and allocating resources in a safe and fair manner. Vulnerabilities in the kernel may be exploited by malicious attackers, causing system damage, data leakage, or service interruption, posing potential threats to the security and stability of the system. In order to prevent potential risks, the Linux community and CVE officials usually release updates regularly to fix known vulnerabilities.

[0003] In order to meet different hardware support, application scenarios and security requirements, the kernel R&D team must promptly fix kernel vulnerabilities to ensure the overall security of the system and improve the reliability and stability of the system. Through a strict vulnerability repair process, the system security is maintained and security challenges are responded to in a timely manner, thus ensuring that the system remains secure and resilient in an ever-changing threat environment. If the vulnerability is repaired by purely manual methods, it will consume a lot of manpower.

[0004] The Chinese patent application with publication number CN112906008A proposes a kernel vulnerability repair method, device, server and system, wherein the method includes: sending a hot patch acquisition request to a server, wherein the hot patch acquisition request includes the kernel feature information of the terminal device; receiving the repair code returned by the server, wherein the repair code includes a loading strategy and a hot patch corresponding to the kernel feature information; the loading strategy provides the terminal device with a loading basis when loading the hot patch; verifying the hot patch, and after the verification passes, according to the loading strategy, loading the hot patch into the kernel of the operating system of the terminal device to repair the kernel vulnerability. The method repairs the kernel vulnerability in a timely manner, thereby improving the reliability of the operating system of the terminal device and saving system resources. However, it mainly monitors CVE vulnerabilities and submits patches, and does not involve the acquisition logic of the repair patch, and the hot patch solution when it is subsequently submitted to the customer.

[0005] The Chinese patent application with publication number CN116305140A discloses a method and system for identifying Git submissions that introduce Linux kernel vulnerabilities, the method comprising three steps: obtaining CVE vulnerability data of the Linux kernel, identifying Git submissions that repair Linux kernel vulnerabilities, and identifying Git submissions that introduce Linux kernel vulnerabilities. The Git submissions that repair Linux kernel vulnerabilities serve as a bridge between Linux kernel vulnerabilities and Git submissions that introduce Linux kernel vulnerabilities. By analyzing the characteristics of these Git submissions, it can help understand how Linux kernel vulnerabilities are introduced, thereby helping to improve the accuracy of Linux kernel vulnerability detection, reduce the possibility of introducing Linux kernel vulnerabilities, and improve the security of the Linux kernel. However, it is mainly aimed at the submission of a single repair patch, and there will be more manual processing situations, and the submitted patches may also introduce new problems, and the existing abnormal judgments are not processed.

[0006] In summary, in order to quickly and accurately fix kernel CVE vulnerabilities and deliver them to clients, a simpler and faster method is urgently needed. Summary of the invention

[0007] The technical problem to be solved by the present invention is as follows: In view of the above-mentioned problems in the prior art, a method and system for automatically repairing CVE vulnerabilities in a Linux operating system are provided, which can improve the timeliness of repairs and reduce a large amount of manpower costs.

[0008] In order to solve the above technical problems, the technical solution adopted by the present invention is:

[0009] A method for automatically repairing a CVE vulnerability of a Linux operating system includes the steps of automatically repairing an unrepaired CVE vulnerability on a code branch, specifically including:

[0010] Configure the branch list BranchList containing the code branches to be monitored, and configure the correspondence between the code branches and the local code paths;

[0011] Query the CVE vulnerability fix status in the branch list BranchList as unfixed, and the CVE vulnerability number CVE-ID with the fix patch number fixid, and generate a CVE vulnerability to be fixed list CI list ;

[0012] Traverse the list of CIs to be fixed list The CVE vulnerability number CVE-ID is used to create a corresponding repair task and generate a corresponding task number TaskNo for each CVE vulnerability number CVE-ID;

[0013] Get the corresponding patch C of the CVE vulnerability corresponding to the repair task in the upstream communityfix , save each repair task into the list to be automatically repaired QFA list middle;

[0014] Traverse the list of QFA to be automatically repaired list Get the dependency patch list L corresponding to each element dep ;

[0015] Traverse the dependency patch list L dep All patches in the repository, and recursively obtain the list of dependent patches L dep The repair patches and dependent patches of all patches in the upstream branch are obtained to obtain the repair patch list L fix ;

[0016] According to the dependency patch list L dep 、The corresponding patch for the CVE vulnerability in the upstream community C fix And the dependent patch list L dep List of fix patches for all patches in the upstream branch L fix , synchronize the CVE fix patch and the corresponding dependent patch and fix patch in turn, and merge the patches correctly and orderly into the local code branch in turn; if the merging fails or the dependent patch and fix patch exceed the preset level, an error message is output.

[0017] Furthermore, the function expression of the repair task is:

[0018] ,

[0019] In the above formula, The CVE vulnerability number CVE-ID corresponding to the CVE vulnerability, This is the code branch corresponding to the CVE vulnerability. The commitId is the commit number of the patch corresponding to the CVE vulnerability number CVE-ID in the upstream community. The repair task corresponding to the CVE vulnerability The task number TaskNo.

[0020] Further, traverse the list to be automatically repaired Get the dependency patch list corresponding to each element When , for any i-th element obtained by traversal The processing includes:

[0021] Get the i-th element The branch name in , according to the correspondence between the code branch and the local code path, obtain the corresponding local code path, and update the local code under the corresponding local code path;

[0022] Query to get the i-th element Properties The corresponding upstream warehouse, if the upstream warehouse exists Corresponding dependency patches , then the patch will be relied upon Add and generate dependency patch list ; If the upstream warehouse does not exist Corresponding dependency patches, generate dependency patch list is an empty set;

[0023] The i-th element Properties The corresponding repair patch is merged into the dependent patch set , so that the i-th element The corresponding dependency patch list .

[0024] Further, traverse the dependent patch list L dep All patches in the repository, and recursively obtain the list of dependent patches L dep The repair patches and dependent patches of all patches in the upstream branch are obtained to obtain the repair patch list L fix When including:

[0025] Update the code of the local code branch to keep it consistent with the remote branch;

[0026] Traverse the dependency patch list L dep All patches in the query dependency patch list L dep A collection of fixes for each patch in , for the patch set Each fix in Query its dependent patches to get the patches Corresponding dependency patch set , and then for the dependent patch set The dependent patches in the recursive query are used to query the repair patches and the dependent patches of the repair patches, and so on, until the repair patch query result is empty, and the recursively queried patches are added to the dependent patch list L dep The corresponding patch in the upstream branch has a patch list L fix middle.

[0027] Further, traverse the dependent patch list L dep All patches in the repository, and recursively obtain the list of dependent patches L dep The repair patches and dependent patches of all patches in the upstream branch are obtained to obtain the repair patch list L fix Before, including: Initialize dependency patch query deepest level and the maximum number of patches to submit ;

[0028] For repair patch set Each fix in Query its dependent patches to get the patches Corresponding dependency patch set , and then for the dependent patch set When recursively querying the fix patch and the dependent patches of the fix patch, the dependent patches in include:

[0029] If the number of levels of dependent patches queried reaches the maximum number of levels of dependent patches queried , then output the error message and obtain the list of QFA to be automatically repaired list The dependency patch list L corresponding to the next element in dep , to handle the next CVE vulnerability;

[0030] If the patch query result is empty and the number of levels of the queried dependent patches does not reach the maximum number of levels of the dependent patch query , then add the recursively queried patch to the dependent patch list L dep The corresponding patch in the upstream branch has a patch list L fix In the repair patch list L fix Is the number of patches to be submitted greater than the maximum number of patches to be submitted? ;

[0031] If the patch list L fix The number of patches to be submitted is less than the maximum number of patches to be submitted , then execute according to the dependent patch list L dep 、The corresponding patch for the CVE vulnerability in the upstream community C fix And the dependent patch list L dep List of fix patches for all patches in the upstream branch L fix , the steps of synchronizing the CVE repair patch and the corresponding dependent patch and repair patch in sequence;

[0032] If the patch list L fix The number of patches to be submitted is greater than the maximum number of patches to be submitted , then output the error message and obtain the list of QFA to be automatically repaired list The dependency patch list L corresponding to the next element in dep , to handle the next CVE vulnerability.

[0033] Further, traverse the dependent patch list L dep All patches in the repository, and recursively obtain the list of dependent patches Ldep The repair patches and dependent patches of all patches in the upstream branch are obtained to obtain the repair patch list L fix After that, include:

[0034] Will rely on patch list L dep 、The corresponding patch for the CVE vulnerability in the upstream community C fix And the dependent patch list L dep List of fix patches for all patches in the upstream branch L fix Patch generation in the patch repair queue :

[0035] ,

[0036] In the above formula, ~ Fix queue for patches The patch information of the CVE to be automatically repaired in , and there is any patch information of the i-th CVE to be automatically repaired The expression is:

[0037] ,

[0038] In the above formula, The CVE vulnerability number CVE-ID corresponding to the CVE vulnerability, This is the code branch corresponding to the CVE vulnerability. The commitId is the commit number of the patch corresponding to the CVE vulnerability number CVE-ID in the upstream community. The repair task corresponding to the CVE vulnerability The task number TaskNo, The dependent patch list L corresponding to the CVE vulnerability dep , The dependent patch list L corresponding to the CVE vulnerability dep List of fixes for all patches in the upstream branch;

[0039] Fix the queue according to the patch The patch information of the CVE to be automatically repaired in the CVE repair patch and the corresponding dependent patch and repair patch are synchronized in sequence.

[0040] Furthermore, before the step of automatically repairing the unpatched CVE vulnerabilities on the code branch, the step of obtaining the unpatched CVE vulnerabilities on the locally maintained code branch includes:

[0041] Crawl CVE vulnerability data from the Internet;

[0042] The obtained CVE vulnerability data is combined to obtain the CVE vulnerability repair status of each branch of the local maintenance code, thereby obtaining the unrepaired CVE vulnerabilities on each branch of the local maintenance code.

[0043] Furthermore, the automatic repair of unpatched CVE vulnerabilities on the code branch also includes:

[0044] Push the code of each branch of the local maintenance code to the code review platform according to the preset patch submission rules;

[0045] The code review platform obtains the submitted fix patch set according to the patch submission rules, updates the CVE vulnerability repair status of the Linux operating system according to the fix patch set, and generates logs for inspection.

[0046] The present invention also proposes a CVE vulnerability automatic repair system for a Linux operating system, comprising a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute any one of the CVE vulnerability automatic repair methods for a Linux operating system.

[0047] The present invention also proposes a computer-readable storage medium, in which a computer program / instruction is stored. The computer program / instruction is programmed or configured to execute any one of the CVE vulnerability automatic repair methods for the Linux operating system through a processor.

[0048] The present invention also proposes a computer program product, comprising a computer program / instruction, wherein the computer program / instruction is programmed or configured to execute any one of the CVE vulnerability automatic repair methods for the Linux operating system through a processor.

[0049] Compared with the prior art, the present invention has the following advantages:

[0050] For unpatched vulnerabilities, the present invention performs dependency query of repair patches through the dependency patch list and the repair patch list of the upstream branch. It not only handles direct CVE vulnerability repairs, but also considers the dependency relationship of patches, ensuring that all related patches can be applied correctly and orderly, avoiding system instability or incomplete repair caused by patch dependency problems.

[0051] The present invention realizes a fully automated process from vulnerability identification, patch acquisition to patch application, greatly reduces the need for manual intervention, and improves repair efficiency and accuracy. BRIEF DESCRIPTION OF THE DRAWINGS

[0052] Figure 1 It is an overall flow chart of an embodiment of the present invention.

[0053] Figure 2This is a flow chart of automatic repair of CVE vulnerabilities in an embodiment of the present invention.

[0054] Figure 3 This is a flow chart of recursive query repair patch in an embodiment of the present invention. DETAILED DESCRIPTION

[0055] Before introducing the specific embodiments of the present invention, related terms are explained first.

[0056] Git: is an open source distributed version control system used to handle any project, small or large, agilely and efficiently.

[0057] commitId: Each commit in git generates a 40-bit hash value as a unique identifier.

[0058] deps: Dependency patch. Before submitting commit B, commit A must be submitted first, so A is the dependency patch of B.

[0059] fixes: a patch submitted after patch A is submitted to fix the problem in patch A.

[0060] fixId: The commitId that fixes the vulnerability.

[0061] CVE: The full English name is “Common Vulnerabilities & Exposures”.

[0062] git-deps: An open source Git tool that gets a list of dependent commitIds of a commId.

[0063] check-deps: A self-developed tool that uses the git-deps tool to query all unmerged dependency patches for a commitId.

[0064] git-fixes: A self-developed tool that can obtain the commitid of the fix patch corresponding to the current patch.

[0065] Embodiment 1

[0066] This embodiment proposes a method for automatically repairing CVE vulnerabilities in the Linux operating system. It obtains community CVE vulnerability data through data mining, monitors the repair status of each branch in real time, and performs dependency query of the repair patch for unrepaired vulnerabilities, query of the repair patch chain fixes, and then sorts the patches and pushes them to the code repository in the corresponding order. At the same time, a dependency library is established to speed up the processing time, and multiple vulnerabilities can be repaired in parallel on multiple branches at the same time. It avoids various legacy problems caused by manual repair, improves the agility and comprehensiveness of CVE vulnerability repair, and effectively guarantees the kernel security quality.

[0067] like Figure 1 As shown, the method of this embodiment includes the following steps:

[0068] First, obtain the unfixed CVE vulnerabilities on the locally maintained code branch, including:

[0069] S1. Capture CVE vulnerability data from the Internet;

[0070] S2. Acquire the CVE vulnerability repair status of each branch of the local maintenance code in combination with the acquired CVE vulnerability data;

[0071] Then, the unpatched CVE vulnerabilities on the code branch are automatically repaired, including:

[0072] S3: For the vulnerabilities with unfixed CVE status on the local branch, they are transferred to the automatic repair process and the repaired code is pushed to the code approval platform;

[0073] Finally, the code approval platform records and updates, including;

[0074] S4. The code review platform obtains the submitted patch set according to the preset patch submission rules, and updates the CVE vulnerability repair status of the Linux operating system according to the patch set to ensure the real-time status of the vulnerability;

[0075] S5. Record each operation process, generate and store detailed synchronization logs for inspection.

[0076] Each step is described in detail below.

[0077] Step S1 in this embodiment specifically obtains the CVE vulnerability list from the CVE official website file, and then obtains CVE vulnerability data from the CVE official website, Ubuntu, Red Hat, upstream communities and other official websites through data mining technology, performs data analysis and data cleaning, and saves the sorted data into the database.

[0078] Step S2 in this embodiment specifically combines the data processed by step S1 to analyze and sort out the CVE vulnerability status of each branch of the local maintenance code, and saves the vulnerability repair status to the database, thereby obtaining the unrepaired CVE vulnerabilities on each branch of the local maintenance code.

[0079] like Figure 2 As shown, step S3 of this embodiment specifically includes the following steps:

[0080] S31. Configure a branch list BranchList containing code branches to be monitored, and configure the correspondence between code branches and local code paths;

[0081] S32, query the branch list BranchList for CVE vulnerabilities whose repair status is not fixed and have a CVE vulnerability number CVE-ID with a repair patch number fixid, and generate a CVE vulnerability to be repaired list CI list ;

[0082] S33, traverse the list of CIs to be repaired list The CVE vulnerability number CVE-ID is used to create a corresponding repair task for each CVE vulnerability number CVE-ID, and generate a corresponding task number TaskNo;

[0083] S34. Obtain the corresponding fix patch C in the upstream community for the CVE vulnerability corresponding to the repair task through the self-developed git-fixes tool fix , each repair task Save to the list to be automatically repaired QFA list In the above example, the function expression of the repair task is:

[0084] ={ , , }

[0085] in, Indicates the list to be repaired The CVE vulnerability number CVE-ID of the i-th CVE vulnerability to be fixed in, Indicates the branch name corresponding to the CVE vulnerability number CVE-ID. Indicates the commitId of the patch corresponding to the CVE vulnerability number CVE-ID in the upstream community. The task number TaskNo representing the repair task created in step S33 with the CVE vulnerability number CVE-ID;

[0086] S35, traverse the list to be automatically repaired QFA list , get the dependency patch list L corresponding to each elementdep ;

[0087] S36. Traverse the dependent patch list L dep All patches in the repository, and recursively obtain the list of dependent patches L dep All patches in the upstream branch have fix patches and dependent patches, and the dependent patch list L is obtained dep List of fix patches L for each patch in the upstream branch fix ;

[0088] S37, according to the dependent patch list L dep 、The corresponding patch for the CVE vulnerability in the upstream community C fix And the dependent patch list L dep List of fix patches for all patches in the upstream branch L fix , synchronize the CVE fix patch and the corresponding dependent patch and fix patch in sequence, and merge the patches correctly and orderly into the local code branch in sequence; if the merging fails or the dependent patch and fix patch exceed the preset level, an error message is output and manual intervention is required;

[0089] S38. The code is automatically pushed to the code review platform for subsequent code verification operations.

[0090] In step S35 of this embodiment, the list to be automatically repaired is traversed Get the dependency patch list corresponding to each element When , for any i-th element obtained by traversal The processing includes:

[0091] S351. Get the automatic repair list The i-th element in The branch name in , according to the correspondence between the code branch in the branch list BranchList and the code local path, the corresponding code local path is obtained, and the local code under the corresponding code local path is updated;

[0092] S352. Use the self-developed check-deps tool to query and obtain the i-th element Properties The corresponding upstream warehouse, if the upstream warehouse exists The corresponding dependency patch of the dependency patch , then the patch will be relied upon Add and generate dependency patch list ; If the upstream warehouse does not exist Corresponding dependency patches, generate dependency patch list is an empty set, that is In this embodiment, the configuration variables of the check-deps tool specifically include: the deepest level of dependency patch query and the maximum number of patches to be submitted When querying the number of dependent patches of a patch, as long as the number of dependent patches of a patch reaches the deepest level of dependent patch query , the corresponding entire vulnerability processing logic is handed over to manual processing, and the CI list to be repaired is directly processed list The next vulnerability number CVE-ID in the maximum number of patches to be submitted After the query is completed, determine whether the number of patches to be submitted is greater than the maximum number of patches to be submitted. .

[0093] Use the self-developed check-deps tool to query and obtain the i-th element Properties In the corresponding upstream warehouse process, if the i-th element Properties Corresponding dependency patches The number is greater than the deepest level of dependency patch query , then continue to query to get the i+1th element Properties The corresponding upstream warehouse, while manually intervening to process the i-th element Corresponding list to be repaired The i-th CVE vulnerability to be fixed in .

[0094] Correspondingly, if the i-th element Properties Corresponding dependency patches The number is less than the deepest level of dependent patch query , then the patch will be relied upon Add and generate dependency patch list , and then determine the dependent patch list Is the number of dependent patches in greater than the maximum number of patches to be submitted? If it is less than, continue with the subsequent steps. If it is greater than, it means that the submitted patch exceeds the limit, and manual intervention is also required to process the i-th element. Corresponding list to be repaired The i-th CVE vulnerability to be fixed in ;

[0095] S353, will automatically repair the list The i-th element in Properties The corresponding repair patch is merged into the dependent patch set , the specific expression is as follows:

[0096] =

[0097] So as to get the automatic repair list The i-th element in The corresponding dependency patch list .

[0098] Step S36 of this embodiment is as follows: Figure 3 As shown, the following steps are included:

[0099] S361, set and initialize the deepest level of dependent patch query and the maximum number of patches to submit In this embodiment, the deepest level of the dependency patch query and the maximum number of patches to submit Configuration variables required for auto-repair;

[0100] S362. Update the code of the local code branch to keep it consistent with the remote branch;

[0101] S363. Pass configuration variables into the check-deps tool and , used to configure the relevant parameters of the check-deps tool, and use the self-developed git-fixs tool to traverse and obtain the dependency patch list L dep A collection of fixes for all patches in , if you successfully traverse to the repair patch set Fix patch in , use the check-deps tool to check the patch Query its dependent patches to get the patches Corresponding dependency patch set , and for the dependent patch set The dependent patches in the repository are recursively queried using the git-fixs tool and the check-deps tool respectively. For each dependent patch recursively queried, the same steps of querying the fix patch and the dependent patches of the fix patch are performed until the query result of the fix patch is empty, that is, When , the recursion ends;

[0102] During the recursive process, when using the check-deps tool to query dependent patches, it includes:

[0103] If the number of levels of dependent patches queried reaches the maximum number of levels of dependent patches queried , then output error information, hand over the corresponding CVE vulnerability to manual intervention, and jump to step S352 to obtain the list of QFA to be automatically repairedlist The dependency patch list L corresponding to the next element in dep , to handle the next CVE vulnerability;

[0104] If the patch query result is empty and the number of levels of the queried dependent patches does not reach the maximum number of levels of the dependent patch query , then the recursion ends;

[0105] S364, add the recursively queried patch to the dependent patch list L dep List of fix patches for all patches in the upstream branch L fix In the expression, the following is:

[0106] =

[0107] in, and Respectively represent the dependent patches and repair patches queried in each recursion; add the recursively queried patches to the dependent patch list L dep The corresponding patch in the upstream branch has a patch list L fix After that, determine the repair patch list L fix Is the number of patches to be submitted greater than the maximum number of patches to be submitted? If it is less than, continue with the subsequent steps. If it is greater than, it means that the submitted patch exceeds the limit, and an error message is also output. The corresponding CVE vulnerability is handed over to manual intervention, and the process jumps to step S352 to obtain the list of QFAs to be automatically repaired. list The dependency patch list L corresponding to the next element in dep , to handle the next CVE vulnerability;

[0108] S365, will rely on patch list L dep 、The corresponding patch for the CVE vulnerability in the upstream community C fix And the dependent patch list L dep List of fix patches for all patches in the upstream branch L fix Patch generation in the patch repair queue :

[0109] ,

[0110] In the above formula, ~ Fix queue for patches The patch information of the CVE to be automatically repaired in , and there is any patch information of the i-th CVE to be automatically repaired The expression is:

[0111] ,

[0112] In the above formula, The CVE vulnerability number CVE-ID corresponding to the CVE vulnerability, This is the code branch corresponding to the CVE vulnerability. The commitId is the commit number of the patch corresponding to the CVE vulnerability number CVE-ID in the upstream community. The repair task corresponding to the CVE vulnerability The task number TaskNo, The dependent patch list L corresponding to the CVE vulnerability dep , The dependent patch list L corresponding to the CVE vulnerability dep A list of fixes for all patches in the upstream branch.

[0113] Step S37 of this embodiment specifically includes:

[0114] S371, repair queue according to patch The patch information of the CVE to be automatically repaired in the synchro- nizes the CVE repair patch and the corresponding dependent patch and repair patch in turn. Specifically, the queue is traversed. , and Corresponding dependency patch list And the dependent patch list L dep List of fixes for all patches in the upstream branch Merge into a list of patches to be pushed ;

[0115] S372, merge the patches into the local code branch in order and correctly, specifically traversing the list of patches to be pushed , read each patch to be pushed , assemble its commit information Execute git cherry-pick on the branch to be merged , git commit -s --amend -m Will be merged into the patch Merge into the corresponding branch until the traversal is completed.

[0116] If the above patch set cannot be merged, the corresponding error message will be output in the corresponding task and manual intervention will be required.

[0117] Embodiment 2

[0118] This embodiment proposes a CVE vulnerability automatic repair system for a Linux operating system, including a microprocessor and a memory connected to each other, wherein the microprocessor is programmed or configured to execute the CVE vulnerability automatic repair method for a Linux operating system described in the first embodiment.

[0119] This embodiment also proposes a computer-readable storage medium, in which a computer program / instruction is stored. The computer program / instruction is programmed or configured to execute the CVE vulnerability automatic repair method for the Linux operating system described in this embodiment 1 through a processor.

[0120] This embodiment also proposes a computer program product, including a computer program / instruction, which is programmed or configured to execute the CVE vulnerability automatic repair method for the Linux operating system described in the first embodiment through a processor.

[0121] In summary, the present invention discloses a method and system for automatically repairing CVE vulnerabilities in a Linux operating system, which uses queue decoupling to process vulnerability information collection, patch query and integration, and patch push functions to improve processing efficiency, uses the git-deps tool to query dependencies, and uses the git-fixes tool to query fixes patches, and completely finds a list of related patches for a repair patch, thereby improving the success rate of submission, and updates the vulnerability status in real time, and associates tasks to achieve closed-loop monitoring of the vulnerability status.

[0122] Compared with the prior art, the advantages of the present invention are:

[0123] 1. It can automatically obtain CVE vulnerability data from various manufacturers and communities, perform data analysis, update the CVE vulnerability status of the local branch in real time, and realize real-time closed-loop tracking of all CVE vulnerabilities.

[0124] 2. By comparing and analyzing CVE vulnerability data and local branch code data, the corresponding repair patch set is obtained, and the overall repair process control of CVE vulnerabilities is automated. Combined with the existing patch sequence, the repair patch set is pushed to the local branch correctly and orderly; the overall repair process is traceable and backtrackable, with detailed process logs for inspection.

[0125] Those skilled in the art should understand that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the present application can take the form of a computer program product implemented on one or more computer-readable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code. The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the process Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing device to work in a specific way, so that the instructions stored in the computer-readable memory produce a product including an instruction device, which implements the functions specified in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 These computer program instructions can also be loaded onto a computer or other programmable data processing device, so that a series of operation steps are executed on the computer or other programmable device to produce a computer-implemented process, so that the instructions executed on the computer or other programmable device provide for implementing the process in the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0126] The above is only a preferred embodiment of the present invention, and the protection scope of the present invention is not limited to the above embodiments. All technical solutions under the concept of the present invention belong to the protection scope of the present invention. It should be pointed out that for ordinary technicians in this technical field, some improvements and modifications without departing from the principle of the present invention should also be regarded as the protection scope of the present invention.

Claims

1. A method for automatically repairing a CVE vulnerability in a Linux operating system, characterized in that: Includes steps to automatically fix unpatched CVE vulnerabilities on code branches, including: Configure the branch list BranchList containing the code branches to be monitored, and configure the correspondence between the code branches and the local code paths; Query the CVE vulnerability fix status in the branch list BranchList as unfixed, and the CVE vulnerability number CVE-ID with the fix patch number fixid, and generate a CVE vulnerability to be fixed list CI list ; Traverse the list of CIs to be fixed list The CVE vulnerability number CVE-ID is used to create a corresponding repair task and generate a corresponding task number TaskNo for each CVE vulnerability number CVE-ID; Get the corresponding patch C of the CVE vulnerability corresponding to the repair task in the upstream community fix , save each repair task into the list to be automatically repaired QFA list middle; Traverse the list of QFA to be automatically repaired list Get the dependency patch list L corresponding to each element dep ; Traverse the dependency patch list L dep All patches in the repository, and recursively obtain the list of dependent patches L dep The repair patches and dependent patches of all patches in the upstream branch are obtained to obtain the repair patch list L fix ; According to the dependency patch list L dep 、The corresponding patch for the CVE vulnerability in the upstream community C fix And the dependent patch list L dep List of fix patches for all patches in the upstream branch L fix , synchronize the CVE fix patch and the corresponding dependent patch and fix patch in turn, and merge the patches correctly and orderly into the local code branch in turn; if the merging fails or the dependent patch and fix patch exceed the preset level, an error message is output.

2. The method for automatically repairing a CVE vulnerability of a Linux operating system according to claim 1, characterized in that: The functional expression of the repair task is: ， In the above formula, The CVE vulnerability number CVE-ID corresponding to the CVE vulnerability, This is the code branch corresponding to the CVE vulnerability. The commitId is the commit number of the patch corresponding to the CVE vulnerability number CVE-ID in the upstream community. The repair task corresponding to the CVE vulnerability The task number TaskNo.

3. The method for automatically repairing a CVE vulnerability of a Linux operating system according to claim 2, characterized in that: Traverse the list of automatic repairs to be performed Get the dependency patch list corresponding to each element When , for any i-th element obtained by traversal The processing includes: Get the i-th element The branch name in , according to the correspondence between the code branch and the local code path, obtain the corresponding local code path, and update the local code under the corresponding local code path; Query to get the i-th element Properties The corresponding upstream warehouse, if the upstream warehouse exists Corresponding dependency patches , then the patch will be relied upon Add and generate dependency patch list ; If the upstream warehouse does not exist Corresponding dependency patches, generate dependency patch list is an empty set; The i-th element Properties The corresponding repair patch is merged into the dependent patch set , thus getting the i-th element The corresponding dependency patch list .

4. The method for automatically repairing a CVE vulnerability of a Linux operating system according to claim 1, characterized in that: Traverse the dependency patch list L dep All patches in the repository, and recursively obtain the list of dependent patches L dep The repair patches and dependent patches of all patches in the upstream branch are obtained to obtain the repair patch list L fix When including: Update the code of the local code branch to keep it consistent with the remote branch; Traverse the dependency patch list L dep All patches in the query dependency patch list L dep A collection of fixes for each patch in , for the patch set Each fix in Query its dependent patches to get the patches Corresponding dependency patch set , and then for the dependent patch set The dependent patches in the recursive query are used to query the repair patches and the dependent patches of the repair patches, and so on, until the repair patch query result is empty, and the recursively queried patches are added to the dependent patch list L dep The corresponding patch in the upstream branch has a patch list L fix middle.

5. The method for automatically repairing a CVE vulnerability of a Linux operating system according to claim 4, characterized in that: Traverse the dependency patch list L dep All patches in the repository, and recursively obtain the list of dependent patches L dep The repair patches and dependent patches of all patches in the upstream branch are obtained to obtain the repair patch list L fix Before, including: Initialize dependency patch query deepest level and the maximum number of patches to submit ; For repair patch set Each fix in Query its dependent patches to get the patches Corresponding dependency patch set , and then for the dependent patch set When recursively querying the fix patch and the dependent patches of the fix patch, the dependent patches in include: If the number of levels of dependent patches queried reaches the maximum number of levels of dependent patches queried , then output the error message and obtain the list of QFA to be automatically repaired list The dependency patch list L corresponding to the next element in dep , to handle the next CVE vulnerability; If the patch query result is empty and the number of levels of the queried dependent patches does not reach the maximum number of levels of the dependent patch query , then add the recursively queried patch to the dependent patch list L dep The corresponding patch in the upstream branch has a patch list L fix In the repair patch list L fix Is the number of patches to be submitted greater than the maximum number of patches to be submitted? ; If the patch list L fix The number of patches to be submitted is less than the maximum number of patches to be submitted , then execute according to the dependent patch list L dep 、The corresponding patch for the CVE vulnerability in the upstream community C fix And the dependent patch list L dep List of fix patches for all patches in the upstream branch L fix , the steps of synchronizing the CVE repair patch and the corresponding dependent patch and repair patch in sequence; If the patch list L fix The number of patches to be submitted is greater than the maximum number of patches to be submitted , then output the error message and obtain the list of QFA to be automatically repaired list The dependency patch list L corresponding to the next element in dep , to handle the next CVE vulnerability.

6. The method for automatically repairing a CVE vulnerability of a Linux operating system according to claim 1, characterized in that: Traverse the dependency patch list L dep All patches in the repository, and recursively obtain the list of dependent patches L dep The repair patches and dependent patches of all patches in the upstream branch are obtained to obtain the repair patch list L fix After that, include: Will rely on patch list L dep 、The corresponding patch for the CVE vulnerability in the upstream community C fix And the dependent patch list L dep List of fix patches for all patches in the upstream branch L fix Patch generation in the patch repair queue : ， In the above formula, ~ Fix queue for patches The patch information of the CVE to be automatically repaired in , and there is any patch information of the i-th CVE to be automatically repaired The expression is: ， In the above formula, The CVE vulnerability number CVE-ID corresponding to the CVE vulnerability, This is the code branch corresponding to the CVE vulnerability. The commitId is the commit number of the patch corresponding to the CVE vulnerability number CVE-ID in the upstream community. The repair task corresponding to the CVE vulnerability The task number TaskNo, The dependent patch list L corresponding to the CVE vulnerability dep , The dependent patch list L corresponding to the CVE vulnerability dep List of fixes for all patches in the upstream branch; Fix the queue according to the patch The patch information of the CVE to be automatically repaired in the CVE repair patch and the corresponding dependent patch and repair patch are synchronized in sequence.

7. The method for automatically repairing a CVE vulnerability of a Linux operating system according to claim 1, characterized in that: Before automatically repairing the unfixed CVE vulnerabilities on the code branch, the steps of obtaining the unfixed CVE vulnerabilities on the locally maintained code branch include: Crawl CVE vulnerability data from the Internet; The obtained CVE vulnerability data is combined to obtain the CVE vulnerability repair status of each branch of the local maintenance code, thereby obtaining the unrepaired CVE vulnerabilities on each branch of the local maintenance code.

8. The method for automatically repairing a CVE vulnerability of a Linux operating system according to claim 1, characterized in that: Automatic fixes for unpatched CVE vulnerabilities on code branches also include: Push the code of each branch of the local maintenance code to the code review platform according to the preset patch submission rules; The code review platform obtains the submitted fix patch set according to the patch submission rules, updates the CVE vulnerability repair status of the Linux operating system according to the fix patch set, and generates logs for inspection.

9. A CVE vulnerability automatic repair system for a Linux operating system, comprising a microprocessor and a memory connected to each other, characterized in that: The microprocessor is programmed or configured to execute the CVE vulnerability automatic repair method for the Linux operating system as described in any one of claims 1 to 8.

10. A computer-readable storage medium having a computer program / instruction stored therein, characterized in that: The computer program / instruction is programmed or configured to execute the CVE vulnerability automatic repair method for the Linux operating system as described in any one of claims 1 to 8 through a processor.

Images