Vulnerability detection method and device, electronic equipment and readable storage medium

Abstract

The invention provides a vulnerability detection method and device, electronic equipment and a readable storage medium. The method comprises the following steps: acquiring first kernel driving information of a system and latest source code information corresponding to a kernel local version; kernel drive modification information is determined according to the first kernel drive information and second kernel drive information, and the second kernel drive information is information matched with the first kernel drive information in the latest source code information; second vulnerability modification information is determined according to the kernel drive modification information and the first vulnerability modification information, the first vulnerability modification information is all vulnerability modification information between the local version of the kernel and the latest version of the kernel, and the second vulnerability modification information comprises the first target drive file and the first modification information. According to the method, the vulnerability details related to the system can be obtained, the vulnerability condition of the system can be accurately obtained, and a basis is provided for better maintenance of a kernel.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and in particular, relates to a vulnerability detection method, device, electronic device and readable storage medium. Background Art

[0002] The Linux kernel consists of the following components: process management, memory management, file system, network protocol stack, device driver, system call, security module, interrupt processing. The Linux kernel is the core component of the Linux operating system, responsible for managing the computer's hardware resources, providing system call interfaces, scheduling processes, and managing memory.

[0003] The normal operation of the kernel is crucial to the stability and security of the system. Therefore, it is necessary to know the vulnerabilities of the kernel driver and maintain the kernel. Summary of the invention

[0004] The embodiments of the present application provide a vulnerability detection method, device, electronic device, readable storage medium and computer program product, which can solve the problem of difficulty in kernel maintenance.

[0005] In a first aspect, an embodiment of the present application provides a vulnerability detection method, comprising:

[0006] Obtain the system's first kernel driver information and the latest source code information corresponding to the kernel local version;

[0007] determining kernel driver modification information according to the first kernel driver information and the second kernel driver information, wherein the second kernel driver information is information matching the first kernel driver information in the latest source code information;

[0008] The second vulnerability modification information is determined based on the kernel driver modification information and the first vulnerability modification information, wherein the first vulnerability modification information includes all vulnerability modification information between the local kernel version and the latest kernel version, and the second vulnerability modification information includes each first target driver file and the first modification information.

[0009] In one embodiment, the method further comprises:

[0010] Generate patch information according to the second vulnerability modification information;

[0011] Determine third vulnerability modification information according to the second vulnerability modification information and the vulnerability detection information, wherein the vulnerability detection information is information obtained by detecting the system using a vulnerability detection library, and the third vulnerability modification information includes each second target driver file and the second modification information, and the second target driver file is the first target driver file to be repaired;

[0012] A repair solution is determined according to the patch information and the third vulnerability modification information.

[0013] In one embodiment, determining third vulnerability modification information according to the second vulnerability modification information and the vulnerability detection information includes:

[0014] For each of the first target driver files, searching the vulnerability detection information for the vulnerability detection information corresponding to the first target driver file;

[0015] If the vulnerability detection information corresponding to the first target driver file is found, the first target driver file is determined to be the second target driver file, and the second target driver file and the second modification information are obtained.

[0016] In one embodiment, determining the second vulnerability modification information according to the kernel driver modification information and the first vulnerability modification information includes:

[0017] Compare the kernel driver modification information with the first vulnerability modification information,

[0018] For each driver file, if the content of the driver file in the kernel driver modification information is the same as the content in the first vulnerability modification information, the driver file is determined to be the first target driver file, and the first target driver file and the first modification information are obtained.

[0019] In one embodiment, the same content means the same file path and modification point.

[0020] In one embodiment, the obtaining of the first kernel driver information of the system and the latest source code information corresponding to the local kernel version includes:

[0021] Get basic information and configuration information of the system;

[0022] According to the local version of the kernel in the basic information, obtaining the latest source code information from an external device;

[0023] The first kernel driver information is determined according to the configuration information.

[0024] In one embodiment, after obtaining the basic information and configuration information of the system, the method further includes:

[0025] Checking the basic information and the configuration information of the system to obtain risk information;

[0026] The risk information is displayed.

[0027] In a second aspect, an embodiment of the present application provides a vulnerability detection device, including:

[0028] An acquisition module, used to acquire the first kernel driver information of the system and the latest source code information corresponding to the local kernel version;

[0029] a vulnerability detection module, configured to determine kernel driver modification information according to the first kernel driver information and the second kernel driver information, wherein the second kernel driver information is information matching the first kernel driver information in the latest source code information;

[0030] It is also used to determine second vulnerability modification information based on the kernel driver modification information and the first vulnerability modification information, wherein the first vulnerability modification information is all vulnerability modification information between the local version of the kernel and the latest kernel version, and the second vulnerability modification information includes the first target driver file and the first modification information.

[0031] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements a method as described in any one of the above-mentioned first aspects when executing the computer program.

[0032] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method as described in any one of the above-mentioned first aspects is implemented.

[0033] In a fifth aspect, an embodiment of the present application provides a computer program product. When the computer program product is run on an electronic device, the electronic device executes any one of the methods described in the first aspect.

[0034] Compared with the prior art, the embodiments of the present invention have the following beneficial effects:

[0035] The embodiment of the present application obtains the latest source code information corresponding to the first kernel driver information of the system and the local version of the kernel; determines the kernel driver modification information according to the first kernel driver information and the second kernel driver information, the second kernel driver information being the information that matches the first kernel driver information in the latest source code information; determines the second vulnerability modification information according to the kernel driver modification information and the first vulnerability modification information, the first vulnerability modification information being all vulnerability modification information between the local version of the kernel and the latest kernel version, the second vulnerability modification information including each first target driver file and the first modification information, so as to obtain the vulnerability details related to the system itself, accurately know the vulnerability situation of the system, and provide a basis for better maintenance of the kernel.

[0036] It can be understood that the beneficial effects of the second to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0038] Figure 1 This is a first flow chart of a vulnerability detection method provided by an embodiment of the present application;

[0039] Figure 2 This is a second flow chart of the vulnerability detection method provided by an embodiment of the present application;

[0040] Figure 3 This is a third flow chart of the vulnerability detection method provided by an embodiment of the present application;

[0041] Figure 4 It is a structural diagram of a vulnerability detection device provided by an embodiment of the present application;

[0042] Figure 5 It is a schematic diagram of the structure of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0043] In the following description, specific details such as specific system structures, technologies, etc. are provided for the purpose of illustration rather than limitation, so as to provide a thorough understanding of the embodiments of the present application. However, it should be clear to those skilled in the art that the present application may also be implemented in other embodiments without these specific details. In other cases, detailed descriptions of well-known systems, devices, circuits, and methods are omitted to prevent unnecessary details from obstructing the description of the present application.

[0044] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0045] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0046] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0047] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", "third", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0048] References to "one embodiment" or "some embodiments" etc. described in the specification of this application mean that one or more embodiments of the present application include specific features, structures or characteristics described in conjunction with the embodiment. Therefore, the statements "in one embodiment", "in some embodiments", "in some other embodiments", "in some other embodiments", etc. that appear in different places in this specification do not necessarily refer to the same embodiment, but mean "one or more but not all embodiments", unless otherwise specifically emphasized in other ways. The terms "including", "comprising", "having" and their variations all mean "including but not limited to", unless otherwise specifically emphasized in other ways.

[0049] In one embodiment, Figure 1 This is a schematic diagram of the first flow chart of the vulnerability detection method provided by an embodiment of the present application. Figure 1 As shown, the method comprises:

[0050] S11: Acquire the first kernel driver information of the system and the latest source code information corresponding to the local kernel version.

[0051] In a possible implementation, step S11 includes:

[0052] S111: Obtain basic information and configuration information of the system.

[0053] S112: According to the local version of the kernel in the basic information, the latest source code information is obtained from an external device.

[0054] In the application, the local kernel version of the system is obtained from the basic information. According to the local kernel version, the latest kernel version source code of the local kernel version is obtained through the Linux kernel repository.

[0055] Specifically, you can visit the Linux kernel official website or find the latest kernel version source code in the Git repository.

[0056] S113: Determine first kernel driver information according to the configuration information.

[0057] In the application, the configuration information includes a configuration file, which records the system configuration collection used by the current system. The kernel driver file used by the current system is determined from the system configuration collection to obtain the first kernel driver information. The kernel driver file includes a driver code.

[0058] S12: Determine kernel driver modification information according to the first kernel driver information and the second kernel driver information.

[0059] The second kernel driver information is information that matches the first kernel driver information in the latest source code information. Specifically, in the latest kernel version source code, a kernel driver file that matches the first kernel driver information is obtained to obtain the second kernel driver file.

[0060] In the application, the first kernel driver information is compared with the second kernel driver information to obtain all changes in the driver code from the local kernel version to the latest kernel version, and obtain kernel driver modification information. The kernel driver modification information includes the modified driver file and the modification point, and the modification point includes the modified part.

[0061] S13: Determine second vulnerability modification information according to the kernel driver modification information and the first vulnerability modification information.

[0062] Among them, the first vulnerability modification information includes all vulnerability modification information between the local kernel version and the latest kernel version. Specifically, all vulnerability modification information between the local kernel version and the latest kernel version is obtained from the Linux kernel repository, and the vulnerability modification information includes records submitted through Git, kernel release notes, or vulnerability reports released by kernel maintainers. That is, the first vulnerability modification information includes modification records of each driver file, and the modification record includes records of driver files being modified to the new version and then modified back to the original version during the kernel version update process, and records of driver files being updated during the kernel version update process.

[0063] The second vulnerability modification information includes each first target driver file and the first modification information. The first modification information of the first target driver file includes a modification point.

[0064] In a possible implementation, step S13 includes:

[0065] S131: Compare the kernel driver modification information with the first vulnerability modification information.

[0066] In the application, the driver file in the kernel driver modification information is compared with the driver file in the first vulnerability modification information, and the modification point and file path of the driver file in the kernel driver modification information are compared with the modification point and file path of the driver file in the first vulnerability modification information.

[0067] S132: For each driver file, if the content of the driver file in the kernel driver modification information is the same as the content in the first vulnerability modification information, determine that the driver file is the first target driver file, and obtain the first target driver file and the first modification information.

[0068] The same content means the file path and modification point are the same.

[0069] In the application, the same driver file and the same modification point of the driver file are found in the kernel driver modification information and the first vulnerability modification information, and the driver file is determined as the first target driver file. The first modification information includes the modification point and the modification reason.

[0070] If the content of the driver file in the kernel driver modification information is different from the content in the first vulnerability modification information, the driver file is marked to obtain a marked driver file, and the marked driver file is a driver file waiting for user confirmation whether to repair.

[0071] By marking the driver files, users are informed of the driver files that have been modified inconsistently, making it easier for users to determine whether manual intervention is required to accurately repair the system.

[0072] It is understandable that when facing different application environments, it is also possible to obtain vulnerability details related to the system itself and accurately know the vulnerability status of the system, which can prevent the occurrence of excessive detection scope or missed detection, and reduce maintenance difficulty; there is no need to change and repair all kernel driver vulnerability issues, reducing maintenance difficulty.

[0073] This embodiment obtains the latest source code information corresponding to the first kernel driver information of the system and the local version of the kernel; determines the kernel driver modification information according to the first kernel driver information and the second kernel driver information, the second kernel driver information being the information that matches the first kernel driver information in the latest source code information; determines the second vulnerability modification information according to the kernel driver modification information and the first vulnerability modification information, the first vulnerability modification information being all vulnerability modification information between the local version of the kernel and the latest kernel version, the second vulnerability modification information including each first target driver file and the first modification information, so as to obtain the vulnerability details related to the system itself, accurately know the vulnerability situation of the system, and provide a basis for better maintenance of the kernel.

[0074] In one embodiment, Figure 2 1 is a second flow chart of the vulnerability detection method provided by an embodiment of the present application. Figure 2 As shown, the method further includes:

[0075] S21: Generate patch information according to the second vulnerability modification information.

[0076] In the application, a kernel driver modification patch is generated according to the second vulnerability modification information, and patch information is obtained.

[0077] S22: Determine third vulnerability modification information according to the second vulnerability modification information and the vulnerability detection information.

[0078] The vulnerability detection information is information obtained by using the vulnerability detection library to detect the system. Specifically, according to the vulnerability information released by the vulnerability library, a detection script is obtained. Then, the detection script is used to detect the system, obtain the vulnerability that threatens the system, and according to the repair solution released by the vulnerability library, obtain the driver to be modified and the modification point, and obtain the vulnerability detection information.

[0079] The third vulnerability modification information includes each second target driver file and the second modification information, and the second target driver file is the first target driver file to be repaired.

[0080] In a possible implementation, step S22 includes:

[0081] S221: For each first target driver file, searching for vulnerability detection information corresponding to the first target driver file in the vulnerability detection information.

[0082] In the application, the second vulnerability modification information is compared with the vulnerability detection information to determine whether the first target driver file is a driver file that affects the stable operation and security risks of the system.

[0083] S222: If the vulnerability detection information corresponding to the first target driver file is found, the first target driver file is determined to be the second target driver file, and the second target driver file and the second modification information are obtained.

[0084] In the application, if the vulnerability detection information corresponding to the first target driver file is found in the vulnerability detection information, it means that the first target driver file is a driver file that affects the stable operation and security risks of the system, and the first target driver file is determined to be the second target driver file. At the same time, the corresponding risk situation is recorded, such as: buffer overflow, deadlock and other vulnerability problem labels. Among them, the second modification information of the second target driver file includes the first modification information and the risk situation.

[0085] S23: Determine a repair solution based on the patch information and the third vulnerability modification information.

[0086] In the application, based on the patch information, the patch of each second target driver file is obtained, and a repair plan is formulated. The repair plan includes the modification point of each second target driver file and the problem type of the modification point.

[0087] In a possible implementation, the repair solutions provided by the vulnerability library are also considered when formulating the repair solution.

[0088] This embodiment provides corresponding vulnerability details and vulnerability repair solutions for identified vulnerabilities, so that users can obtain detailed system information, security status reports and repair methods, so that users can repair system problems, ensure the normal operation of the system, protect the stability of the system, and improve the security of the system.

[0089] In one embodiment, Figure 3 FIG. 1 is a third flow chart of a vulnerability detection method provided in an embodiment of the present application. Figure 3 As shown, after step S11, the following steps are also included:

[0090] S31: Check the basic information and configuration information of the system to obtain risk information.

[0091] Among them, basic information includes hardware information and software information. Hardware information includes CPU model, performance, memory capacity, usage, storage device disk type, capacity, usage, MAC (Medium Access Control) address, IP (Internet Protocol Address), connection status, etc. of the network interface. Software information includes operating system version, kernel version, installed software packages and their versions, system running services and process lists, etc., so that users can fully understand the system's operating environment.

[0092] Configuration information includes network configuration, user and permission settings, system environment variables, startup services, scheduled tasks, etc.

[0093] In the application, the system's basic information and configuration information are checked for vulnerability risks, sensitive information, system log analysis, environment, server, and network configuration, etc.

[0094] Among them, vulnerability risk checking includes checking basic information and configuration information through vulnerability detection script libraries and integrated security tools (for example: chkrookit (a backdoor detection tool in the Linux system, used to detect and remove potential backdoors), obtaining existing known security vulnerabilities, unpatched vulnerabilities and potential threat information, obtaining vulnerability list information and annotated responsive driver modification functions, and extracting vulnerability repair function sets.

[0095] Sensitive information checking includes checking the system's files and directories, obtaining existing unencrypted sensitive information (such as passwords, keys, configuration files, etc.), and providing detailed reports so that users can identify and protect this sensitive information.

[0096] System log analysis involves checking system log files for unusual login attempts, system errors, suspicious system activities, and potential security incidents.

[0097] The environmental check includes checking the users and their permission settings in the system, checking whether there are unauthorized super users or weak passwords, checking whether the system contains the tools used, checking the system memory information, checking whether there is enough memory space to install the required inspection tools, checking the basic configuration information, and obtaining the operating system version, kernel version, system load, and memory usage.

[0098] Server checks include checking permissions on system files and directories, and recording modification times.

[0099] Network configuration check includes checking network configuration, open ports, and firewall settings.

[0100] S32: Display risk information.

[0101] This application obtains risk information by checking the basic information and configuration information of the system, and comprehensively collects various detailed information of the system to obtain comprehensive risk information so that users can repair system problems and ensure the normal operation of the system.

[0102] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0103] Corresponding to the method described in the above embodiment, for the convenience of explanation, only the part related to the embodiment of the present application is shown.

[0104] In one embodiment, Figure 4 Schematic diagram of the structure of a vulnerability detection device provided by an embodiment of the present application. Figure 4 As shown, the device shown includes:

[0105] An acquisition module 10 is used to acquire the first kernel driver information of the system and the latest source code information corresponding to the local kernel version;

[0106] The vulnerability detection module 11 is used to determine the kernel driver modification information according to the first kernel driver information and the second kernel driver information, wherein the second kernel driver information is information matching the first kernel driver information in the latest source code information;

[0107] It is also used to determine the second vulnerability modification information according to the kernel driver modification information and the first vulnerability modification information, the first vulnerability modification information is all vulnerability modification information between the local kernel version and the latest kernel version, and the second vulnerability modification information includes each first target driver file and the first modification information.

[0108] In one embodiment, a repair module is used to generate patch information based on second vulnerability modification information; determine third vulnerability modification information based on the second vulnerability modification information and vulnerability detection information, the vulnerability detection information is information obtained by detecting the system using a vulnerability detection library, the third vulnerability modification information includes each second target driver file and the second modification information, the second target driver file is the first target driver file to be repaired; determine a repair plan based on the patch information and the third vulnerability modification information.

[0109] In one embodiment, the repair module is specifically used to search for vulnerability detection information corresponding to the first target driver file in the vulnerability detection information for each first target driver file; if the vulnerability detection information corresponding to the first target driver file is found, the first target driver file is determined to be the second target driver file, and the second target driver file and the second modification information are obtained.

[0110] In one embodiment, the vulnerability detection module is specifically used to compare the kernel driver modification information with the first vulnerability modification information. For each driver file, if the content of the driver file in the kernel driver modification information is the same as the content in the first vulnerability modification information, the driver file is determined to be the first target driver file, and the first target driver file and the first modification information are obtained.

[0111] In one embodiment, the acquisition module is specifically used to acquire basic information and configuration information of the system; acquire the latest source code information from an external device according to the local kernel version in the basic information; and determine the first kernel driver information according to the configuration information.

[0112] In one embodiment, the device further comprises:

[0113] The risk detection module is used to check the basic information and configuration information of the system, obtain risk information, and display risk information.

[0114] Figure 5 This is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. Figure 5 As shown, the electronic device 2 of this embodiment includes: at least one processor 20 ( Figure 5 Only one is shown in the figure), a memory 21, and a computer program 22 stored in the memory 21 and executable on the at least one processor 20, wherein the processor 20 implements the steps of any of the above-mentioned method embodiments when executing the computer program 22.

[0115] The electronic device 2 may be a computing device such as a desktop computer, a notebook, a PDA, or a cloud server. The electronic device 2 may include, but is not limited to, a processor 20 and a memory 21. Those skilled in the art will appreciate that Figure 5 It is only an example of the electronic device 2 and does not constitute a limitation on the electronic device 2. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, it may also include input and output devices, network access devices, etc.

[0116] The processor 20 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or any conventional processor, etc.

[0117] In some embodiments, the memory 21 may be an internal storage unit of the electronic device 2, such as a hard disk or memory of the electronic device 2. In other embodiments, the memory 21 may also be an external storage device of the electronic device 2, such as a plug-in hard disk, a smart memory card (Smart Media Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. equipped on the electronic device 2. Further, the memory 21 may also include both an internal storage unit of the electronic device 2 and an external storage device. The memory 21 is used to store an operating system, an application program, a boot loader (BootLoader), data, and other programs, such as the program code of the computer program. The memory 21 may also be used to temporarily store data that has been output or is to be output.

[0118] It should be noted that the information interaction, execution process, etc. between the above-mentioned devices / units are based on the same concept as the method embodiment of the present application. Their specific functions and technical effects can be found in the method embodiment part and will not be repeated here.

[0119] The technicians in the relevant field can clearly understand that for the convenience and simplicity of description, only the division of the above-mentioned functional units and modules is used as an example for illustration. In practical applications, the above-mentioned function allocation can be completed by different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiment can be integrated in a processing unit, or each unit can exist physically separately, or two or more units can be integrated in one unit. The above-mentioned integrated unit can be implemented in the form of hardware or in the form of software functional units. In addition, the specific names of the functional units and modules are only for the convenience of distinguishing each other, and are not used to limit the scope of protection of this application. The specific working process of the units and modules in the above-mentioned system can refer to the corresponding process in the aforementioned method embodiment, which will not be repeated here.

[0120] An embodiment of the present application further provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0121] An embodiment of the present application provides a computer program product. When the computer program product runs on an electronic device, the electronic device can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0122] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above-mentioned embodiment method, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium, and the computer program can implement the steps of the above-mentioned various method embodiments when executed by the processor. Among them, the computer program includes computer program code, and the computer program code can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium can at least include: any entity or device that can carry the computer program code to the camera / terminal device, recording medium, computer memory, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), electric carrier signal, telecommunication signal and software distribution medium. For example, a USB flash drive, a mobile hard disk, a magnetic disk or an optical disk. In some cases, the computer-readable medium cannot be an electric carrier signal and a telecommunication signal.

[0123] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0124] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0125] In the embodiments provided in the present application, it should be understood that the disclosed devices / network equipment and methods can be implemented in other ways. For example, the device / network equipment embodiments described above are merely schematic. For example, the division of the modules or units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0126] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0127] The embodiments described above are only used to illustrate the technical solutions of the present application, rather than to limit them. Although the present application has been described in detail with reference to the aforementioned embodiments, a person skilled in the art should understand that the technical solutions described in the aforementioned embodiments may still be modified, or some of the technical features may be replaced by equivalents. Such modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application, and should all be included in the protection scope of the present application.

Claims

1. A vulnerability detection method, characterized in that: include: Obtain the system's first kernel driver information and the latest source code information corresponding to the kernel local version; determining kernel driver modification information according to the first kernel driver information and the second kernel driver information, wherein the second kernel driver information is information matching the first kernel driver information in the latest source code information; The second vulnerability modification information is determined based on the kernel driver modification information and the first vulnerability modification information, wherein the first vulnerability modification information includes all vulnerability modification information between the local kernel version and the latest kernel version, and the second vulnerability modification information includes each first target driver file and the first modification information.

2. The method according to claim 1, characterized in that Also includes: Generate patch information according to the second vulnerability modification information; Determine third vulnerability modification information according to the second vulnerability modification information and the vulnerability detection information, wherein the vulnerability detection information is information obtained by detecting the system using a vulnerability detection library, and the third vulnerability modification information includes each second target driver file and the second modification information, and the second target driver file is the first target driver file to be repaired; A repair solution is determined according to the patch information and the third vulnerability modification information.

3. The method according to claim 2, characterized in that The determining, according to the second vulnerability modification information and the vulnerability detection information, third vulnerability modification information includes: For each of the first target driver files, searching the vulnerability detection information for the vulnerability detection information corresponding to the first target driver file; If the vulnerability detection information corresponding to the first target driver file is found, the first target driver file is determined to be the second target driver file, and the second target driver file and the second modification information are obtained.

4. The method according to any one of claims 1 to 3, characterized in that: The determining the second vulnerability modification information according to the kernel driver modification information and the first vulnerability modification information includes: Compare the kernel driver modification information with the first vulnerability modification information, For each driver file, if the content of the driver file in the kernel driver modification information is the same as the content in the first vulnerability modification information, the driver file is determined to be the first target driver file, and the first target driver file and the first modification information are obtained.

5. The method according to claim 4, characterized in that: The same content means the file path and modification point are the same.

6. The method according to claim 5, characterized in that The obtaining of the first kernel driver information of the system and the latest source code information corresponding to the local kernel version includes: Get basic information and configuration information of the system; According to the local version of the kernel in the basic information, obtaining the latest source code information from an external device; The first kernel driver information is determined according to the configuration information.

7. The method according to claim 6, characterized in that After obtaining the basic information and configuration information of the system, the following steps are also included: Checking the basic information and the configuration information of the system to obtain risk information; The risk information is displayed.

8. A vulnerability detection device, characterized in that: include: An acquisition module, used to acquire the first kernel driver information of the system and the latest source code information corresponding to the local kernel version; a vulnerability detection module, configured to determine kernel driver modification information according to the first kernel driver information and the second kernel driver information, wherein the second kernel driver information is information matching the first kernel driver information in the latest source code information; It is also used to determine the second vulnerability modification information based on the kernel driver modification information and the first vulnerability modification information, wherein the first vulnerability modification information is all vulnerability modification information between the local version of the kernel and the latest kernel version, and the second vulnerability modification information includes each first target driver file and the first modification information.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images