Method and module for detecting security vulnerabilities in computer cluster

Abstract

The invention relates to a computer-implemented detection method (EQn) for detecting the availability of computer vulnerabilities (CVEk) in a set of processes associated with a namespace combination, the method comprises, for a reference process of the set:-a step (F30) of initializing and running a test process associated with the combination based on the reference process and a step of running a detection program (Pk), the step (F30) of running the program generating an indicator (IEXk) of availability of vulnerabilities in the set of processes; a step (F40) of transmitting at least one signal (Log) comprising the indicator to a security management device (Code).

Description

Background Art

[0001] The present invention relates to the general field of protecting computer programs.

[0002] More specifically, the present invention is directed to a method for managing computer security of a computer device infrastructure using a program for detecting computer vulnerabilities.

[0003] Recall that the term "vulnerability" refers to a flaw in a computer process that, if exploited, allows overriding the security rules of the computer system on which the program of the process is executed. For example, the vulnerability CVE-2021-44228, called "Log4Shell", exists in the logging software component Log4J. The component Log4J is used by many applications that use the Java language. The vulnerability, in the most severe case, allows a remote attacker to execute arbitrary code on the target machine. The technical means that allow an attacker to exploit the vulnerability are called attack vectors. Such technical means are, for example, instructions in a computer program.

[0004] In order to be exploited, such a vulnerability requires the presence of software and / or hardware resources or means with a weakness. For example, the exploitation of a vulnerability may correspond to sending instructions on a specific server. If a process does not have resources that allow such a sending, the vulnerability cannot be exploited in that process. Conversely, a process may have such resources, in which case the vulnerability is exploitable if there are no security procedures that block attacks aimed at exploiting the vulnerability.

[0005] The term process refers to the internal representation of a program running in the computer's memory. Each time a program is executed, one or more processes are created.

[0006] As known, the security flaws are listed in a public list accessible at https: / / www.cve.org / as of May 2022, with each vulnerability referenced in the list identified by a unique CVE (Common Vulnerabilities and Exposures) identifier.

[0007] Thousands of CVE identifiers are issued each year, and complex software may be affected by hundreds of CVEs.

[0008] Therefore, management of CVEs for maintaining security for a group of computer devices may be overly complex.

[0009] Existing techniques do not allow for the satisfactory establishment or identification of exploitable flaws that could compromise computer security. Summary of the invention

[0010] The present invention aims to facilitate the security management of a group of computers by detecting computer vulnerabilities that can be exploited on the computers. Therefore, the present invention enables the security of a group of computers to be strengthened.

[0011] As described below, the present invention proposes to evaluate the exploitability of vulnerabilities at the level of namespace combinations.

[0012] In the context of the present invention, a "namespace" hereinafter refers to a kernel-level namespace of an operating system.

[0013] Recall that a namespace abstractly isolates instances of global system resources for processes associated with that namespace. Modifications made to system resources in a namespace are applied to all processes associated with that namespace, but are not visible to all other processes. Thus, namespaces provide a resource isolation mechanism.

[0014] As is known, the Linux operating system proposes several namespaces (eg, network, IPC (inter-process communication), PID (process identifier), user, etc.) to isolate a set of processes.

[0015] More specifically, and according to a first aspect, the present invention relates to a computer-implemented detection method for detecting the exploitability of a computer vulnerability in a set of processes associated with a namespace combination, the method comprising the following steps for a reference process of the set:

[0016] - initializing and executing a test process associated with the combination according to the reference process and executing a detection program, the execution of which generates an indicator of the exploitability of the vulnerability in the set of processes;

[0017] - sending at least one signal comprising said indicator to a security management device.

[0018] Relatedly, the present invention proposes a detection module in a computer for detecting the exploitability of a computer vulnerability in a process set associated with a namespace combination, wherein the module includes, for a reference process of the set:

[0019] - a submodule for initializing and executing a test process associated with the combination according to the reference process and executing a detection program, the execution of which generates an indicator of the exploitability of the vulnerability in the set of processes;

[0020] - a submodule for sending at least one signal comprising said indicator to a security management device.

[0021] Thus, the invention makes it possible to identify processes on which computer vulnerabilities can be exploited. In particular, the method makes it possible to identify processes having weaknesses that allow the exploitation of these vulnerabilities. Such weaknesses are caused, for example, by specific software or hardware resources.

[0022] In this application, a namespace combination associated with a process refers to a set of namespaces associated with the process. For example, in a Linux system, a process can be associated with a namespace combination that currently contains (as of May 2022) 9 namespaces of different types.

[0023] Hereinafter, the expressions "a process associated with a namespace combination" and "a process in a namespace combination" will be used interchangeably.

[0024] Each namespace combination of a computer may be automatically identified. The method advantageously makes it possible to determine an indicator of the exploitability of a vulnerability in the identified combination without having to test the exploitability for each process in the namespace combination.

[0025] In order to detect the exploitability of vulnerabilities (especially CVE vulnerabilities) in a namespace combination, the present invention proposes to use a single process in the combination. The process is called the reference process of the combination because it is used to initialize the test process so that the exploitability detection can be implemented in the combination. The test process is created as the same process as the reference process, for example. The initialization of the process here refers to triggering the execution of the process after creation.

[0026] The test process has access to the same resources allocated by the namespace composite as all other processes in that composite. In addition, the test process inherits the environment variables of the reference process when it is created.

[0027] In a specific embodiment of the detection method, the reference process is a basic process of the combination.

[0028] In this application, the term "basic process of a combination" means the first process created in the combination.

[0029] The term "environment variable" refers to a type of value that can be used by a process. In particular, these values ​​can give access to some resource. For example, on a Linux system, the environment variable <path>A list of directories corresponding to executable files. For example, the first process set and the variable <path>, which will allow these processes to use the executable files located by this value instead of using absolute paths to these files. In this same example, the second process set is associated with the variable <path>Therefore, the first set of processes and the second set of processes will not be able to access the same executable file.

[0030] In the following, for simplicity, the expressions "environment variable of a process" and "value of an environment variable of a process" will be used interchangeably.

[0031] However, although a given process of a namespace composite generally inherits the environment variables of the composite's base process upon its creation, the environment variables associated with the given process may change during its lifetime.

[0032] However, the present invention proposes to ignore such possible changes, and as an approximation, if a vulnerability can be exploited using the environment variables of a process of a namespace combination (hereinafter, such a vulnerability will be expressed as being exploitable in the process), then the vulnerability can be exploited using the environment variables of any process of the same namespace combination, including cases where these environment variables have changed during the life of the process.

[0033] Instead, the present invention proposes to consider, as an approximation, that if a vulnerability is not exploitable using the environment variables of a process of a namespace combination, then the vulnerability is not exploitable using the environment variables of any process of the same namespace combination.

[0034] The inventors have discovered that changes in environment variables associated with a process during its lifetime are uncommon and typically do not affect the exploitability of the vulnerability.

[0035] Therefore, the detection of exploitability of a vulnerability by the testing process is a reliable indicator of the actual exploitability of the vulnerability in the namespace combination.

[0036] The test process executes a program for detecting the exploitability of a vulnerability. The information generated by the execution of the detection program indicates the exploitability of the vulnerability in the namespace combination. This information is sent back to the security management device in the form of an indicator and specifically allows the user of the device to select an appropriate security program to be installed.

[0037] The indicator comprises at least one data allowing identification of the vulnerability, such as an identifier of the vulnerability.

[0038] In one embodiment of the present invention, the security management device is a server. Therefore, the present invention can be implemented by multiple computers in a group of computers, each of which can send back to the security management server information about the exploitability of vulnerabilities in their respective namespace combinations.

[0039] In this case, the security management server may be controlled by a central administrator who has the role of orchestrating security on a group of computers.

[0040] This embodiment of the detection method thus makes it possible to automatically and centrally identify which security programs are to be installed and where to install them.A security program is a program whose execution prevents the exploitation of computer vulnerabilities.

[0041] The invention also allows a central administrator to avoid the need to manually consult each administrator of each computer, allowing each administrator to, for example, manually and locally check whether there is a vulnerability in the software of their machine and if necessary whether measures have been taken to render it harmless.

[0042] According to one embodiment of the detection method, the execution of the detection program includes:

[0043] - determining the presence of one or more means for exploiting said vulnerability in an environment defined by at least said namespace combination and environment variables of said reference process;

[0044] And, if one or more of the exploits are detected:

[0045] - Test the exploitation of the vulnerability using this or these exploits.

[0046] In this embodiment, the detection program evaluates the exploitability of the computer vulnerability in two stages.

[0047] In a first determination step, it is determined whether the resource(s) required to exploit the computer vulnerability are present in the environment of the process. The environment of a process includes the hardware and software resources accessible to the process in order to execute the program. In this case, it is defined by at least a combination of namespaces and environment variables associated with the process.

[0048] If this determination step does not result in the detection of any means for exploiting a computer vulnerability, this means that due to the above mentioned approximation, the vulnerability is considered not to exist and is therefore not exploitable in the namespace combination in which the detection program is executed.

[0049] However, if the presence of such means is detected, this does not necessarily mean that the vulnerability is actually exploitable. In particular, security procedures may prevent the exploitation of the vulnerability.

[0050] Therefore, in a second step, it is tested whether the vulnerability is actually exploitable. This step may correspond, for example, to executing an attack vector against the vulnerability. If the attack vector is consumed, this means that the vulnerability is exploitable. Otherwise, the vulnerability is not exploitable.

[0051] In other words, in this example, a test attack is performed. The success or failure of the test attack determines whether the computer vulnerability is exploitable.

[0052] In a specific embodiment, the detection method comprises the following steps:

[0053] - receiving an identifier of the vulnerability from the security management device;

[0054] - installing the detection program corresponding to the identifier in the computer.

[0055] Thus, the present invention enables management of the selection of computer vulnerabilities to be detected by a security management device.

[0056] In the case where the security management device is a server connected to a group of computers, the execution of the detection program on each computer can be managed centrally without the need for contribution from administrators of at least some of the computers in the group, which makes it possible to avoid manual installation of the detection program on at least some machines (for example, on all machines in the group).

[0057] Furthermore, according to one embodiment of the method, the steps of initializing the test process and sending a signal to the security management device are performed for a plurality of reference processes respectively associated with a plurality of namespace combinations.

[0058] Thus, the detection method can advantageously be performed in parallel for a set of namespace combinations of one or more computers and thus ensure the security of the computer or a set of processes of these computers.

[0059] In a specific embodiment of the detection method, the step of installing the detection program includes the following sub-steps:

[0060] - sending a request including an identifier of the vulnerability to a security server;

[0061] - In response to said request, receiving said detection procedure.

[0062] This use of a secure server advantageously makes it possible to save memory space on the computer.

[0063] This embodiment also makes it possible to provide a computer with a database including a plurality of programs for detecting the exploitability of computer vulnerabilities, which database can be installed as needed according to the decision of the security management server.

[0064] Advantageously, the external database can be updated independently of administrators of the computers in the group.

[0065] In a specific embodiment of the detection method, the at least one signal further comprises:

[0066] - an identifier of the computer; and

[0067] - data representing said at least one combination.

[0068] This data specifically allows central administrators to map computer vulnerabilities and their exploitability.

[0069] According to an embodiment of the present invention, the detection method is characterized in that the computer includes a protection program for preventing the vulnerability from being exploited, and the protection program is neutralized during the execution of the detection program.

[0070] This embodiment makes it possible to more accurately assess vulnerabilities on a computer. In particular, it makes it possible to test whether a given protection program effectively prevents the exploitation of a given computer vulnerability.

[0071] If several protectors are installed, this also makes it possible to identify invalid protectors.

[0072] According to a second aspect, the present invention provides an identification method implemented by a security management device to identify the exploitability of a computer vulnerability in at least one computer, the method comprising the following steps:

[0073] - receiving a signal from the at least one computer, the signal comprising an indicator of exploitability of the vulnerability in a set of processes associated with a namespace combination of the at least one computer;

[0074] - Add said signal to the list.

[0075] Relatedly, the present invention proposes an identification module in a security management device, for identifying the exploitability of a computer vulnerability in at least one computer, the module comprising:

[0076] - a submodule for receiving a signal from the at least one computer, the signal comprising an indicator of exploitability of the vulnerability in a set of processes associated with a namespace combination of the at least one computer;

[0077] - a submodule for adding said signal to a list.

[0078] The present invention proposes a method for identifying a given computer vulnerability in a computer or a computer group and a namespace combination that can exploit the vulnerability from a device (such as a server).

[0079] The steps of the above identification method may be repeated for a plurality of given computer vulnerabilities.

[0080] This identification of computer vulnerabilities and their exploitability advantageously enables the orchestration of security on a group of computers to be facilitated by a central administrator controlling a security management device.

[0081] To this end, the invention proposes to aggregate messages from computers for which one or more exploitable vulnerabilities have been detected by adding these messages to a list.

[0082] The list specifically allows administrators to make decisions regarding security management within a group of computers. For example, the presence of a few vulnerabilities in a particular namespace can encourage the installation of security programs to strengthen the security of processes associated with those namespaces.

[0083] According to one embodiment of the present invention, the identification method comprises the step of sending an identifier of the vulnerability to the at least one computer.

[0084] This transmission allows the administrator of the security management device to decide which detection programs will be executed on computers in a group of computers. In fact, in one embodiment of the above detection method, the embodiment allows the installation and execution of the detection program in response to the security management device sending the vulnerability identifier.

[0085] The above methods can be implemented by computer programs.

[0086] Therefore, the present invention also relates to a computer program on a recording medium, which program can be implemented in a computer device or more generally in a computer. The program comprises instructions for implementing the method as described above.

[0087] The program may use any programming language, and be in the form of source code, object code, or a code intermediate between source code and object code, such as a partially compiled form, or in any other desired form.

[0088] The present invention also relates to an information medium or a recording medium readable by a computer and / or a computer device and comprising instructions of a computer program as described above.

[0089] The information or recording medium may be any entity or device capable of storing the program. For example, the medium may include storage means, such as ROM, such as CD ROM or microelectronic circuit ROM, or magnetic recording means, such as a hard disk or flash memory.

[0090] On the other hand, the information or recorded medium may be a transmissible medium such as an electric or optical signal, which may be transmitted via an electrical or optical cable, by a radio link, by a wireless optical link or by other means.

[0091] The program according to the invention can in particular be downloaded from a network such as the Internet.

[0092] Alternatively, the information or recording medium may be an integrated circuit in which the program is embodied, the circuit being suitable for executing or for executing one of the methods described above. BRIEF DESCRIPTION OF THE DRAWINGS

[0093] Other characteristics and advantages of the invention will emerge from the following description, given with reference to the accompanying drawing, which shows, without any limitation, an exemplary embodiment of the invention.

[0094] About the Appendix:

[0095] [Appendix 1] Appendix 1 shows the first part of the detection procedure that can be used in a specific embodiment;

[0096] [Appendix 2] Appendix 2 shows the second part of the detection procedure that can be used in a specific embodiment;

[0097] In the attached picture:

[0098] [ Figure 1 ] represents a detection and identification device according to a specific embodiment;

[0099] [ Figure 2 ] represents in the form of a flow chart the main steps of a detection and identification method that can be implemented in a specific embodiment;

[0100] [ Figure 3 ] represents the functional architecture of the detection module according to a specific embodiment of the present invention;

[0101] [ Figure 4 ] represents the functional architecture of the identification module according to a specific embodiment of the present invention. DETAILED DESCRIPTION

[0102] [ Figure 1 ] represents a specific embodiment of the present invention, wherein the detection and identification methods are implemented by computers EQ1-EQ2 and security management device CNode, respectively. In this embodiment, the security management device CNode has the hardware architecture of a computer server.

[0103] In this example, the invention is performed for two computers EQ1 and EQ2, but the invention is not limited to the number of computers. It can also be applied to a single computer or any number of computers, such as in a computer group.

[0104] For clarity, in [ Figure 1 ] The details of the computer EQ2 are not described in detail, but like the computer EQ1, the computer EQ2 includes components that make it possible to implement the vulnerability exploitability detection method within the meaning of the present invention.

[0105] The computers EQ1 and EQ2 specifically include a processor 10 , a random access memory type RAM 11 , a read-only memory type ROM 12 , a communication device 13 , and a nonvolatile rewritable memory such as a hard disk 14 .

[0106] Each computer EQn includes a software system SYSn. In this example, the software system SYS1 of the computer EQ1 includes:

[0107] - a detection module MDET1 according to the invention;

[0108] -Administrative tools ADM1 associated with administrator-level privileges;

[0109] a first group CNS of namespaces associated with a basic process PrR, ie the first process created in this group of namespaces;

[0110] - a second namespace composition CNS' associated with the elementary process PrR'; and

[0111] - A directory Rep for recording detection programs P1, Pk, Pm, and programs P1 and Pk are recorded on the directory Rep.

[0112] During implementation of the instrumentation method, test processes PrT and PrT' are created that execute the program Pk in their respective associated namespace combinations CNS and CNS'.

[0113] The security management device CNode is equipped with means 13 ′ for communicating with the computers EQ1 and EQ2 and with a module COM for communicating with a user, for example an administrator of the set of computers EQ1 - EQ2 .

[0114] The security management device CNode also comprises an identification module MIDA according to the invention.

[0115] [ Figure 2 ] is a flowchart representing an embodiment of the steps of the detection method and the identification method jointly performed by the module MDETn of the computer EQn and the module MIDA of the security management device.

[0116] exist[ Figure 2 In the example shown in ], the detection method is shown to be implemented by a single computer. This example on a single computer EQn is shown for simplicity, but is by no means a limitation of the present invention. In particular, the detection and identification method can be implemented in parallel for several computers.

[0117] The module MIDA sends and receives signals or messages via the aforementioned communication means 13 ′. The module MDETn sends and receives signals or messages via the aforementioned communication means 13 ′.

[0118] The computers EQ1 and EQ2 are configured to be able to communicate with a security server SRV_SEC via a communication network NET. The security server SRV_SEC comprises a database BD. The database BD comprises a set of identifiers IF_CVE1, ID_CVEk and ID_CVEm of vulnerabilities, each of which is associated with a detection program P1, Pk or Pm respectively, which detection program P1, Pk or Pm is configured to generate an indicator of the exploitability of the vulnerability when the corresponding detection program is executed by a test process within the meaning of the present invention.

[0119] The detection program Pk is sent directly to the computer EQn by the server SRV_SEC in the form of an executable program, for example, or in another example, is sent in the form of a description file and then converted into an executable file by the computer.

[0120] The vulnerability identifier ID_CVEk has, for example, the form of CVE-AAAA-IIII, where AAAA is the year of publication and IIII is a unique number.

[0121] exist[ Figure 2 In the embodiment represented in FIG. 1 , the steps of the detection method executed by the module MDETn of the computer EQn are as follows:

[0122] - Identify the combination CNS-CNS' of the F0 namespace and the associated reference process PrR-PrR';

[0123] - Receive the identifier ID_CVEk of the F10 vulnerability CVEk from the security management device CNode;

[0124] -Install the exploitability detection program Pk for the F20 vulnerability CVEk. The installation includes the following sub-steps:

[0125] (i) Sending F201 a request REQ including the identifier ID_CVEk to the server SRV_SEC;

[0126] (ii) receiving F202 a program Pk from the server SRV_SEC in response to sending F201 ;

[0127] (iii) recording F203 program Pk in directory Rep of software system SYSn of computer EQn;

[0128] - Initialize F30 the test process PrT in the same namespace combination CNS as the reference process PrR, and execute the program Pk through the test process PrT; and

[0129] - Sending a F40 Log signal to the device CNode, the Log signal comprising the identifier IPn of the computer EQn, the identifier ICNS of the namespace group CNS and the indicator IEXk of the exploitability of the vulnerability CVEk generated during the execution of the program Pk.

[0130] In this embodiment, the program Pk includes instructions for implementing the following operations:

[0131] (i) detecting the means used by F301 to exploit the vulnerability CVEk in the resources allocated to the process that will execute the program Pk (the test process within the meaning of the invention); and

[0132] (ii) If such means are detected, the exploitability of the F302 vulnerability CVEk is tested.

[0133] In this embodiment, and collectively, the module MIDA of the device CNode performs the following steps according to one embodiment of the identification method:

[0134] - Sending the E10 identifier ID_CVEk to the computer EQn;

[0135] - Receive E40 Log signal from computer EQn; and

[0136] - Added signal E50 to the list.

[0137] In one embodiment, the steps of initiating the test process F30 and sending F40 by the computer EQn are repeated or performed in parallel for one or more other namespace combinations.

[0138] In particular, in one embodiment, these steps F30 and F40 are performed for all namespace combinations CNS-CNS' identified during step F0. In a particular implementation of the invention in the context of the Linux operating system (registered trademark), a namespace combination is typically obtained for each container.

[0139] In one embodiment, the identified namespace combinations are all namespace combinations accessible via administrator-level privileges of the computer EQn, which privileges are provided by the module ADMn of the computer.

[0140] In one embodiment, these namespace combinations are obtained from obtaining a list of namespaces and related processes, which can be accessed via administrator privileges. For each namespace so obtained, a single process among the processes associated with the namespace is selected as a reference process. For each selected reference process, a different namespace associated with the process is identified. As described above, the different namespaces associated with a process form a namespace combination associated with the process. Therefore, the namespace combinations and reference processes respectively associated with these combinations are identified.

[0141] In one embodiment, each reference process PrR-PrR' of the namespace combination CNS-CNS' is a base process of the combination, ie, the first process created in the combination.

[0142] For example, in the case of a Linux system, the command lsns can be used to identify the base process of the namespace.

[0143] In the rest of the description, a step of initializing F30 a test process PrT according to a reference process PrR associated with a composite CNS is described in one embodiment. This step makes it possible to detect the exploitability of a vulnerability CVEk in the namespace composite CNS. In particular, step F30 makes it possible to indicate whether the resources allocated to the processes of this composite CNS make it possible to exploit the vulnerability CVEk.

[0144] The test process PrT is initialized in the same namespace combination CNS as the reference process PrR. In one embodiment, the test process PrT is created so that it has the same environment variables as the reference process. For this purpose, the test process PrT is, for example, created to be the same as the reference process and therefore usually inherits its environment variables.

[0145] For example, in a Linux system, the test process PrT is initialized with the function fork() applied to the reference process.

[0146] The test process PrT executes a detection program Pk that makes it possible to detect the exploitability of the vulnerability CVEk. In one embodiment, the program consists of two parts.

[0147] It executes the first part Script1 corresponding to step F301 k Check whether the test process has means for implementing an attack that exploits the vulnerability CVEk. These means correspond in particular to resources isolated by the namespace combination CNS and resources accessible by the environment variables of the test process PrT.

[0148] Even if such means exist, the vulnerability may not be effectively exploited. For example, a security program may be set in the namespace composition CNS so that an attack aimed at exploiting the vulnerability CVEk will be blocked. Whether such an attack is blocked, in other words, the effective exploitability of the vulnerability, is determined by the second part of the detection program Pk.

[0149] It executes the second part Script2 of the program Pk corresponding to step F302 k Test the exploitability of vulnerability CVEk. This part aims to exploit the vulnerability similarly to the attack, but without harmful consequences to the computer EQn.

[0150] The example of the vulnerability CVE-2021-3156 makes it possible to illustrate the execution of the detection program. This vulnerability affecting the sudo command is particularly critical, considering that the sudo command is used in a wide variety of environments. When a command is sent with sudo, the command's arguments are first concatenated and metacharacters are escaped with a backslash (for example, "\" becomes "\\"). When a special character, such as [, {, (, \, or ^, is read as a normal character instead of as a special character, it can be preceded by a backslash \, which is called an escape character.

[0151] In particular, when sudo is executed through the symbolic link sudoedit -s, the escaping described here is not performed. Therefore, if the argument to the sudoedit command ends with a single backslash, the argument is not escaped by sudo, and the program will copy characters outside the memory buffer limit, which will cause a buffer overflow.

[0152] Appendix 1 and 2 correspond to the first and second parts of the detection program Pk Script1 when the vulnerability CVEk is the vulnerability CVE-2021-3156 k and Script2 k In this example, the detection program Pk is coded in the bash language, which in no way represents a limitation of the invention. The invention makes it possible to use any programming language that allows a person skilled in the art to code a detection program according to the invention.

[0153] Code Script1 in Appendix 1 k The implementation of sudo checks for the presence of a symbolic link sudoedit used for the execution of the binary sudo and, if its presence is detected, logs the message "Might be vulnerable" in the "interfaces" file.

[0154] Code Script2 in Appendix 2 k The execution of starts the execution of the "exploit" file, which corresponds to the use of the sudoedit command with a single backslash. If this execution fails, for example because the security program blocks any use of the sudoedit command with a backslash, no message is generated. Otherwise, the message "Vulnerable" is logged in the "interface" file.

[0155] After the execution of the detection program Pk, the file "interface" contains an indicator IEXk of the exploitability of the vulnerability CVEk. If this indicator IEXk contains the message "Might be vulnerable" but does not contain the message "Vulnerable", it indicates that means for exploiting the vulnerability CVEk are available to the processes of the namespace combination CNS, but the vulnerability is not actually exploitable. If the indicator IEXk contains "Vulnerable", it indicates that the vulnerability CVEk is actually exploitable and allows to infer that such vulnerability must be addressed, for example by installing additional security programs, by adding network protection in advance, or by disabling vulnerable functions in advance. If the indicator IEXk does not contain any of the above messages, it indicates that means for exploiting the vulnerability CVEk are not accessible to the processes of the namespace combination CNS.

[0156] Furthermore, the indicator IEXk contains information identifying the tested vulnerability CVEk, for example an identifier ID_CVEk. This information can be placed in particular in a header in the indicator.

[0157] It should be noted that the above examples in no way limit the possible content of the exploitability indicator according to the present invention. A person skilled in the art may select any content that gives a clear indication of the exploitability of a vulnerability.

[0158] In another example of a vulnerability, the attack vector is of a network type. In other words, the attack that exploits the vulnerability is sent from the network to the IP address used by the process. Such an attack vector can be reproduced locally with the second part of the detection program by sending network traffic on the local IP address 127.0.0.1.

[0159] During a step F40 , the availability indicator IEXk and the identifier IPn of the computer EQn and the identifier ICNS of the namespace group CNS are sent to the security management device CNode in the form of a Log signal.

[0160] The Log signal is then received by the module MIDA of the security management device CNode, which adds it to the LVNS list.

[0161] In one embodiment, the above steps are performed in parallel for multiple namespace combinations in each of the computers.

[0162] Furthermore, in one embodiment, the above steps are set for multiple vulnerabilities CVE1-CVEm and their corresponding detection programs P1-Pm.

[0163] The LVNS list constructed in this way indicates in which namespace combinations and in which computers different given vulnerabilities can be exploited. This list then constitutes a map of the vulnerabilities on the computer group. It allows the central administrator to manage the security of the computer group. In particular, the central administrator can determine from the LVNS list in which namespaces to install security programs.

[0164] [ Figure 3 ] represents the functional architecture of a module MDETn for detecting the exploitability of a vulnerability according to a specific embodiment of the present invention. It comprises:

[0165] - Submodule MD0, for identifying multiple namespace combinations and corresponding associated reference processes;

[0166] - a submodule MD10 for receiving an identifier of a computer vulnerability;

[0167] - Submodule MD20, used to install a program for detecting the exploitability of a vulnerability;

[0168] - a submodule MD30 for creating a test process that executes a program for detecting the exploitability of a vulnerability and thereby generating an indicator of the exploitability;

[0169] - Submodule MD40, used to send a signal including the indicator to the security management device.

[0170] [ Figure 4 ] represents the functional architecture of a module MIDA for identifying the exploitability of vulnerabilities in a namespace set CNS of a computer EQn according to a specific embodiment of the invention. It comprises:

[0171] - Submodule MS10, for sending an identifier of a computer vulnerability;

[0172] - a submodule MS40 for receiving a signal comprising an indicator of exploitability of a vulnerability IEXk, an identifier ICNS of a combination CNS and an identifier IPn of a computer EQn;

[0173] - Submodule MS50 for recording the signal in a list.

[0174] [Appendix 1]

[0175] ret=$(which sudoedit)

[0176] if[! -z $ret]

[0177] then

[0178] echo "Might be vulnerable to $CVEID" >> interface

[0179] fi

[0180] [Appendix 2]

[0181] If [$(echo "pwd" |. / exploit) = $(pwd)]; then; echo "Vulnerable" >> ${interface}; fi< / path> < / path> < / path>

Claims

1. A detection method implemented by a computer (EQn) for detecting the exploitability of a computer vulnerability (CVEk) in a set of processes associated with a namespace combination (CNS), the method comprising the following steps for a reference process (PrR) of the set: - initializing (F30) and executing a test process (PrT) associated with said set (CNS) according to said reference process (PrR) and executing a detection program (Pk), the execution (F30) of said program (Pk) generating an indicator (IEXk) of the exploitability of said vulnerability (CVEk) in said set of processes; - sending (F40) at least one signal (Log) comprising said indicator (IEXk) to a security management device (CNode).

2. The detection method according to claim 1, wherein: The reference process (PrT) is the basic process of the combination (CNS).

3. The detection method according to claim 1 or 2, wherein: The execution of the detection program (Pk) comprises: - determining (F301) the presence of one or more means for exploiting said vulnerability (CVEk) in an environment defined by at least said combination of namespaces and at least one environment variable of said reference process (PrR); And, if one or more of the exploits are detected: - Testing the exploitation of the vulnerability (CVEk) using this or these exploits (F302).

4. The detection method according to any one of claims 1 to 3, comprising the following steps: - receiving (F10) an identifier (ID_CVEk) of said vulnerability (CVEk) from said security management device (CNode); - installing (F20) in said computer (EQn) said detection program (Pk) corresponding to said identifier (ID_CVEk).

5. The detection method according to claim 4, wherein: The installation step (F20) includes the following sub-steps: - sending ( F201 ) a request (REQ) comprising said identifier (ID_CVEk) of said vulnerability (CVEk) to a security server (SRV_SEC); - In response to said request (REQ), receiving (F202) said detection procedure (Pk).

6. The detection method according to any one of claims 1 to 5, characterized in that: The computer (EQn) comprises a protection program (PMk) preventing the exploitation of the vulnerability (CVEk), and the protection program (PMk) is disabled during the execution of the detection program (Pk).

7. The detection method according to any one of claims 1 to 6, wherein The initializing (F30) and sending (F40) steps are performed for each of the reference processes associated with a plurality of namespace combinations.

8. A method for identifying, by a security management device (CNode), the exploitability of a computer vulnerability (CVEk) in at least one computer (EQn), the method comprising the following steps: - receiving (E40) a signal (Log) from said at least one computer (EQn), said signal (Log) comprising an indicator (IEXk) of exploitability of said vulnerability (CVEk) in a set of processes associated with a namespace group (CNS) of said at least one computer (EQn); - Add (E50) the signal (Log) to the list (LVNS).

9. The identification method according to claim 8, wherein: The security management device (CNode) performs at least one of the following actions: - installing at least one security program in at least one namespace; - Address the vulnerabilities described; -Disable the vulnerable functionality; - Implement mitigation strategies.

10. A detection module (MDETn) in a computer (EQn) for detecting the exploitability of a computer vulnerability (CVEk) in a set of processes associated with a namespace combination (CNS), the module comprising, for a reference process (PrR) of the set: - a submodule for initializing (MD30) and executing, according to said reference process (PrR), a test process (PrT) associated with said set (CNS), and executing a detection program (Pk), the execution of which generates an indicator (IEXk) of the exploitability of said vulnerability (CVEk) in said set of processes; - a submodule for sending (MD40) at least one signal (Log) comprising said indicator (IEXk) to a security management device (CNode).

11. An identification module (MIDA) in a security management device (CNode) for identifying the exploitability of a computer vulnerability (CVEk) in at least one computer (EQn), the module comprising: - a submodule for receiving (MS40) a signal (Log) from said at least one computer (EQn), said signal (Log) comprising an indicator (IEXk) of exploitability of said vulnerability (CVEk) in a set of processes associated with a namespace group (CNS) of said at least one computer (EQn); - a submodule (MS50) for adding said signal (Log) to a list.

12. A computer program comprising instructions which, when executed by a computer, implement the steps of the method according to any one of claims 1 to 8.

13. A recording medium readable by a computer (EQn) and / or a computer device (CNode), comprising the computer program according to claim 12.

Images