Method and module for detecting security vulnerabilities in a computer farm

Abstract

The invention relates to a computer-implemented detection method (EQn) for detecting the exploitability of a security vulnerability (CVEk) in a set of processes associated with a combination of namespaces, the method comprising, for a reference process of the set: - a step (F30) of initialising, on the basis of the reference process, and running a test process associated with the combination and a step of running a detection program (Pk), the step (F30) of running the program producing an indicator (IEKx) of the exploitability of the vulnerability in the set of processes; - a step (F40) of sending, to a security management device (CNode), at least one signal (Log) comprising the indicator.

Description

Method and module for detecting computer vulnerabilities in a computer park

[0001] The invention relates to the general field of securing computer programs.

[0002] The invention relates more particularly to a method for managing the IT security of an IT equipment infrastructure using IT vulnerability detection programs.

[0003] It should be remembered that the term vulnerability refers to a flaw in a computer process, this flaw allowing, if exploited, to bypass the security rules of the computer system on which the program of this process is executed. For example, the vulnerability CVE-2021-44228 called "Log4Shell" is present in the logging software component Log4J. The Log4J component is used by many applications using the Java language. This vulnerability allows a remote attacker in the most severe cases to have arbitrary code executed by the target machine. A technical means that allows an attacker to exploit this vulnerability is called an attack vector. Such a technical means is, for example, an instruction in a computer program.

[0004] To be exploited, such a vulnerability requires the presence of weak software and / or hardware resources or means. For example, exploiting a vulnerability may involve sending instructions to a particular server. If a process does not have the resources to send such instructions, then the vulnerability cannot be exploited in that process. Alternatively, the process may have such resources, in which case the vulnerability is exploitable provided that no security program blocks attacks aimed at exploiting the vulnerability.

[0005] The term process refers to an internal representation of a program running in the computer's memory. Each time a program is executed, one or more processes are created.

[0006] As is well known, security vulnerabilities are listed in a public list accessible at https: / / www.cve.org / in May 2022, with each vulnerability referenced in the list being identified by a unique CVE (Common Vulnerabilities and Exposures) identifier.

[0007] Thousands of CVE identifiers are issued each year, and a complex software program can be affected by hundreds of CVEs.

[0008] Managing CVEs to maintain the security of a fleet of IT equipment can therefore prove excessively complex.

[0009] The state of the art does not allow us to satisfactorily establish and identify exploitable flaws that could compromise computer security.

[0010] The invention aims to facilitate the management of the security of a computer fleet by detecting exploitable computer vulnerabilities on these computers. As a corollary, the invention makes it possible to strengthen the security of a computer fleet.

[0011] As explained below, the invention proposes to evaluate the exploitability of vulnerabilities at the level of namespace combinations.

[0012] In the context of the invention, hereinafter, "naming spaces" refer to kernel-level name spaces of an operating system.

[0013] Recall that a namespace isolates, in an abstraction, an instance of a global system resource for the processes associated with that namespace. Changes made to the system resource in a namespace are applied to all processes associated with that namespace, but are invisible to all other processes. Namespaces therefore provide a mechanism for resource isolation.

[0014] As is well known, the Linux operating system offers several namespaces (for example: Network, IPC (for Inter Process Communication in English), PID (for Process IDentifier in English), User…) to isolate sets of processes.

[0015] More specifically, and according to a first aspect, the invention relates to a detection method implemented by a computer to detect the exploitability of a computer vulnerability in a set of processes associated with a combination of namespaces, said method comprising, for a reference process of said set, steps of: - initialization from the reference process and execution of a test process associated with said combination and executing a detection program, the execution of said program producing an indicator of the exploitability of said vulnerability in said set of processes; - sending to a security management device at least one signal comprising said indicator.

[0016] Correlatively, the invention proposes a detection module in a computer for detecting the exploitability of a computer vulnerability in a set of processes associated with a combination of namespaces, said module comprising, for a reference process of said set: - a sub-module for initializing from the reference process and executing a test process associated with said combination and executing a detection program, the execution of said program producing an indicator of the exploitability of said vulnerability in said set of processes; - a sub-module for sending to a security management device at least one signal comprising said indicator.

[0017] Thus, the invention makes it possible to identify processes on which computer vulnerabilities can be exploited. In particular, the method makes it possible to identify processes having weaknesses that allow these vulnerabilities to be exploited. Such weaknesses result, for example, from particular software or hardware resources.

[0018] In this application, a namespace combination associated with a process is referred to as the set of namespaces associated with that process. For example, in a Linux system, a process may be associated with a namespace combination that currently (as of May 2022) contains 9 namespaces of distinct types.

[0019] In the following, the expressions "process associated with a combination of namespaces" and "process in a combination of namespaces" will be used interchangeably.

[0020] Each namespace combination in the computer can be identified automatically. The method advantageously makes it possible to determine an indicator of the exploitability of a vulnerability in an identified combination, without having to test this exploitability for each process in this namespace combination.

[0021] To detect the exploitability of a vulnerability (in particular a CVE vulnerability) in a combination of namespaces, the invention proposes to use a single process in this combination. This process is called the reference process of the combination since it is used to initialize a test process making it possible to implement the exploitability detection in this combination. The test process is for example created as a process identical to the reference process. By initialization of a process is meant here the creation followed by the triggering of the execution of this process.

[0022] The test process has access to the same resources allocated by the namespace combination as all other processes in that combination. In addition, the test process inherits the environment variables of the reference process upon creation.

[0023] In a particular embodiment of the detection method, said reference process is the basic process of said combination.

[0024] In this application, the term "base process of the combination" means the first process created in this combination.

[0025] The term "environment variables" refers to types of values ​​that can be used by processes. In particular, these values ​​can provide access to certain resources. For example, on a Linux system, the environment variable <path>corresponds to the list of the directory(ies) in which executable files are located. For example, a first set of processes is associated with the same value of the variable <path>, which will allow those processes to use the executable files located by that value without using absolute paths to those files. In this same example, a second set of processes is associated with a different value of the variable <path>. The first and second sets of processes will thus not have access to the same executable files.

[0026] From now on, we will use the expressions "environment variables of a process" and "values ​​of the environment variables of a process" interchangeably, for the sake of simplicity.

[0027] However, although at the time of its creation a given process in a namespace combination generally inherits the environment variables of the base process in that combination, the environment variables associated with that given process may change during its lifetime.

[0028] But the invention proposes to disregard this possible change, and to consider as an approximation, that if a vulnerability is exploitable with the environment variables of a process of a combination of namespaces (hereinafter, such a vulnerability will be designated as being exploitable in this process), then this vulnerability is exploitable with the environment variables of any process of the same combination of namespaces, including if these environment variables have changed during the life of this process.

[0029] Conversely, the invention proposes to consider as an approximation that if a vulnerability is not exploitable with the environment variables of a process of a combination of namespaces, then this vulnerability is not exploitable with the environment variables of any process of the same combination of namespaces.

[0030] The inventors found that changes to environment variables associated with a process during its lifetime were uncommon, and generally did not affect the exploitability of the vulnerability.

[0031] Thus, the detection by the testing process of the exploitability of the vulnerability is a reliable indicator of the actual exploitability of the vulnerability in the namespace combination.

[0032] The testing process runs a vulnerability exploitability detection program. The information generated by running the detection program indicates the exploitability of the vulnerability in the namespace combination. This information, in the form of an indicator, is fed back to a security management device and allows the user of this device to choose the appropriate security programs to install.

[0033] This indicator includes at least one piece of data that can identify the vulnerability, for example an identifier of this vulnerability.

[0034] In one embodiment of the invention, the security management device is a server. Thus, the invention can be implemented by a plurality of computers in a computer park, each of these computers being able to send back, to the security management server, information on the exploitability of a vulnerability in their respective namespace combinations.

[0035] In this case, the security management server can be controlled by a central administrator who has a security orchestration role on the computer fleet.

[0036] Thus, this embodiment of the detection method makes it possible to automatically and centrally identify which security programs to install and where to install them. A security program is understood to mean a program whose execution prevents the exploitation of a computer vulnerability.

[0037] The invention also allows the central administrator to avoid the need to manually consult each administrator of each computer so that each of them, for example, can manually and locally check whether a vulnerability is present in the software of their machine, and if so whether measures have been taken to render it harmless.

[0038] According to one embodiment of the detection method, the execution of the detection program comprises: - a determination of the presence of one or more means of exploiting said vulnerability in an environment defined by at least said combination of namespaces and the environment variables of said reference process; and, if one or more said means of exploiting are detected: - a test of exploiting said vulnerability with this or these means of exploiting.

[0039] In this embodiment, the evaluation, by the detection program, of the exploitability of the computer vulnerability is carried out in two stages.

[0040] In a first determination step, it is determined whether the resource(s) necessary to exploit the computer vulnerability are present in the process environment. The environment of a process includes the hardware and software resources accessible to the process to execute a program. In this case, it is defined at a minimum by the combination of namespaces and the environment variables with which this process is associated.

[0041] If this determination step does not result in the detection of any means to exploit the computer vulnerability, this means that the vulnerability is considered, due to the approximation mentioned above, as not present and therefore not exploitable in the combination of namespaces in which the detection program is executed.

[0042] However, if the presence of such means is detected, this does not necessarily imply that the vulnerability is actually exploitable. In particular, security programs can prevent the exploitation of the vulnerability.

[0043] Thus, in a second step, it is tested whether the vulnerability is actually exploitable. This step could, for example, correspond to the execution of an attack vector targeting the said vulnerability. If this attack vector is consumed, this means that the vulnerability is exploitable. Otherwise, the vulnerability is not exploitable.

[0044] In other words, in this example, a test attack is executed. The success or failure of this test attack determines whether the computer vulnerability is exploitable or not.

[0045] In a particular embodiment, the detection method comprises steps of: - receiving, from said security management device, an identifier of said vulnerability; - installing, in said computer, said detection program corresponding to said identifier.

[0046] Thus, the invention makes it possible to manage the selection of IT vulnerabilities to be detected with the security management device.

[0047] In the case where the security management device is a server connected to a computer park, executions of the detection programs on each computer can then be managed centrally, without requiring the contribution of the administrators of at least some computers in the park, which makes it possible to avoid the manual installation of detection programs on at least some, for example on all the machines in the park.

[0048] Furthermore, according to one embodiment of the method, the steps of initializing a test process and sending a signal to the security management device are performed for several reference processes respectively associated with several combinations of namespaces.

[0049] Therefore, the detection method can advantageously be carried out in parallel for all the namespace combinations of one or more computers, and thus ensure the security of all the processes of this or these computers.

[0050] In a particular mode of implementation of the detection method, the step of installing the detection program comprises sub-steps of: - sending, to a security server, a request comprising said vulnerability identifier; - receiving, in response to the request, said detection program.

[0051] This use of a security server advantageously saves memory space on the computer.

[0052] This embodiment also makes it possible to provide the computer with a database comprising a plurality of computer vulnerability exploitability detection programs which can be installed as needed, upon decision of the security management server.

[0053] Advantageously, this external database can be updated independently of the administrators of the computers in the park.

[0054] In a particular embodiment of the detection method, said at least one signal further comprises:- an identifier of said computer; and- data representative of said at least one combination.

[0055] This data allows a central administrator to map IT vulnerabilities and their exploitability.

[0056] According to one embodiment of the invention, the detection method is characterized in that said computer comprises a program for protection against the exploitation of said vulnerability and in that said protection program is neutralized during the execution of said detection program.

[0057] This embodiment allows for more precise assessment of vulnerabilities on the computer. In particular, it allows testing whether a given protection program effectively protects against the exploitation of a given computer vulnerability.

[0058] If several protection programs are installed, this also helps to identify ineffective protection programs.

[0059] According to a second aspect, the invention proposes an identification method implemented by a security management device, to identify the exploitability of a computer vulnerability in at least one computer, said method comprising steps of: - receiving from said at least one computer, a signal comprising an indicator of the exploitability of said vulnerability in a set of processes associated with a combination of namespaces of said at least one computer; - adding said signal to a list.

[0060] Correlatively, the invention proposes an identification module in a security management device, for identifying the exploitability of a computer vulnerability in at least one computer, said module comprising:- a sub-module for receiving, from said at least one computer, a signal comprising an indicator of the exploitability of said vulnerability in a set of processes associated with a combination of namespaces of said at least one computer;- a sub-module for adding said signal to a list.

[0061] The invention provides a method for identifying, from a device (for example a server), a given computer vulnerability in a computer or a fleet of computers, as well as the combinations of namespaces in which this vulnerability can be exploited.

[0062] The steps of the identification method described above can be repeated for a plurality of given computer vulnerabilities.

[0063] This identification of IT vulnerabilities and their exploitability advantageously facilitates the orchestration of security on the computer fleet by a central administrator controlling the security management system.

[0064] To this end, the invention proposes to pool messages from computers in which one or more exploitable vulnerabilities have been detected, by adding these messages to a list.

[0065] This list allows the administrator to make decisions regarding security management in the computer fleet. For example, the presence of certain vulnerabilities in particular namespaces may prompt the installation of security programs to strengthen the security of processes associated with these namespaces.

[0066] According to one embodiment of the invention, the identification method comprises a step of sending to said at least one computer an identifier of said vulnerability.

[0067] This sending allows the administrator of the security management device to decide which detection programs will be executed on the computers in the computer park. Indeed, this embodiment allows, in one embodiment of the detection method described previously, to install and execute the detection program in response to the sending of the vulnerability identifier by the security management device.

[0068] Each of the methods described above can be implemented by a computer program.

[0069] Consequently, the invention also relates to a computer program on a recording medium, this program being capable of being implemented in a computer device or more generally in a computer. This program comprises instructions allowing the implementation of a method as described above.

[0070] This program may use any programming language, and may be in the form of source code, object code, or code intermediate between source code and object code, such as in a partially compiled form, or in any other desirable form.

[0071] The invention also relates to an information medium or a recording medium readable by a computer and / or a computer device, and comprising instructions of a computer program as mentioned above.

[0072] The information or recording medium may be any entity or device capable of storing programs. For example, the media may include a storage medium, such as a ROM, for example a CD ROM or a microelectronic circuit ROM, or a magnetic recording medium, for example a hard disk, or a flash memory.

[0073] On the other hand, the information or recording medium may be a transmissible medium such as an electrical or optical signal, which may be conveyed via an electrical or optical cable, by radio link, by wireless optical link or by other means.

[0074] The program according to the invention can in particular be downloaded from an Internet-type network.

[0075] Alternatively, the information or recording medium may be an integrated circuit in which a program is incorporated, the circuit being adapted to carry out or to be used in carrying out one of the methods as described above. Brief description of the appendices and figures

[0076] Other characteristics and advantages of the present invention will emerge from the description given below, with reference to the appended drawings which illustrate an exemplary embodiment thereof without any limiting character.

[0077] On the annexes:

[0078] [Appendix 1] Appendix 1 represents a first part of a detection program that can be used in a particular embodiment;

[0079] [Appendix 2] Appendix 2 represents a second part of a detection program that can be used in a particular embodiment;

[0080] In the figures:

[0081] represents detection and identification devices in accordance with a particular embodiment;

[0082] represents in the form of a flowchart the main steps of detection and identification methods which can be implemented in a particular embodiment;

[0083] represents the functional architecture of a detection module conforming to a particular embodiment of the invention;

[0084] represents the functional architecture of an identification module conforming to a particular embodiment of the invention. Detailed description

[0085] The invention represents a particular embodiment of the invention in which the detection and identification methods are implemented respectively by computers EQ1-EQ2 and a security management device CNode. In this embodiment, the security management device CNode has the hardware architecture of a computer server.

[0086] In this example, the invention is implemented for two computers EQ1 and EQ2, but the invention does not limit the number of computers. It can also be applied to a single computer or any number of computers, for example in a computer park.

[0087] For the sake of clarity, the details of the EQ2 computer are not detailed on the, but like the EQ1 computer it includes the components making it possible to implement the vulnerability exploitability detection method within the meaning of the invention.

[0088] The EQ1 and EQ2 computers comprise in particular a processor 10, a RAM type random access memory 11, a ROM type read-only memory 12, communication means 13 and a non-volatile rewritable memory, for example a hard disk 14.

[0089] Each computer EQn comprises a software system SYSn. In this example, the software system SYS1 of the computer EQ1 comprises:- a detection module MDET1 in accordance with the invention;- an administration tool ADM1 associated with administrator-level rights;- a first combination CNS of namespaces with which a basic process PrR is associated, i.e. the first process created in this combination of namespaces;- a second combination CNS' of namespaces with which a basic process PrR' is associated; and- a directory Rep for recording detection programs P1, Pk, Pm, and on which the programs P1 and Pk are recorded.

[0090] The test processes PrT and PrT' executing the program Pk in their respective associated namespace combinations CNS and CNS' are created during an implementation of the detection method.

[0091] The CNode security management device is equipped with means of communication 13' with the computers EQ1 and EQ2 and a COM module for communication with a user, for example an administrator of the set of computers EQ1-EQ2.

[0092] The CNode security management device also includes a MIDA identification module in accordance with the invention.

[0093] The flowchart represents an embodiment of the steps of a detection method and an identification method carried out jointly by the MDETn module of the EQn computer and the MIDA module of the security management device.

[0094] In the example represented by the, the implementation of the detection method by a single computer is represented. Such an example on a single computer EQn is represented for the sake of simplicity but is in no way limiting of the invention. In particular, the detection and identification methods can be implemented for several computers in parallel.

[0095] The MIDA module sends and receives signals or messages via the aforementioned communication means 13'. The MDETn module sends and receives signals or messages via the aforementioned communication means 13.

[0096] The computers EQ1 and EQ2 are configured to be able to communicate with a security server SRV_SEC via a communication network NET. This security server SRV_SEC comprises a database BD. This database BD comprises a set of vulnerability identifiers IF_CVE1, ID_CVEk, and ID_CVEm, each identifier being respectively associated with a detection program P1, Pk or Pm configured to produce an indicator of the exploitability of a vulnerability, when the corresponding detection program is executed by a test process within the meaning of the invention.

[0097] The Pk detection program is, for example, sent directly by the SRV_SEC server to an EQn computer in the form of an executable program, or is, in another example, sent in the form of a description file and then transformed into an executable file by the computer.

[0098] An example of a vulnerability identifier ID_CVEk is CVE-YYYY-IIII, where YYYY is the year of publication and IIII is a unique number.

[0099] In the embodiment shown in the, the steps of the detection methods carried out by the MDETn module of the EQn computer are as follows: - identification F0 of CNS-CNS' combinations of namespaces and the associated PrR-PrR' reference processes; - reception F10 of an identifier ID_CVEk of the CVEk vulnerability from the CNode security management device; - installation F20 of a program Pk for detecting the exploitability of the CVEk vulnerability, this installation comprising the sub-steps: (i) sending F201 to the SRV_SEC server of a request REQ comprising the identifier ID_CVEk; (ii) receiving F202, from the SRV_SEC server, the program Pk in response to sending F201; (iii) recording F203 of the program Pk in a directory Rep of the SYSn software system of the EQn computer;- initialization F30 of a test process PrT in the same combination of CNS namespaces as the reference process PrR, and execution of the program Pk by the test process PrT; and- sending F40 to the CNode device of a Log signal comprising an IPn identifier of the computer EQn, an ICNS identifier of the CNS combination of namespaces and an IEXk indicator of the exploitability of the CVEk vulnerability produced during the execution of the program Pk.;

[0100] In this embodiment, the program Pk comprises instructions for implementing: (i) a detection F301 of means of exploiting the CVEk vulnerability among resources, these resources being those allocated to the process which will execute this program Pk (test process within the meaning of the invention); and (ii) a test F302 of exploitability of the CVEk vulnerability if such means are detected.

[0101] In this embodiment, and jointly, the MIDA module of the CNode device performs the following steps according to an embodiment of the identification method: - sending E10 of the identifier ID_CVEk to the computer EQn; - receiving E40 of the Log signal from the computer EQn; and - adding E50 of the signal to a list.

[0102] In one embodiment, the steps of initializing a test process F30 and sending F40 by the computer EQn are repeated or performed in parallel for one or more other namespace combinations.

[0103] In particular, in one embodiment, these steps F30 and F40 are performed for all the CNS-CNS' combinations of namespaces identified during step F0. In a particular embodiment of the invention in the context of a Linux operating system (registered trademark), a combination of namespaces per container is typically obtained.

[0104] In one embodiment, the identified namespace combinations are all namespace combinations accessible via administrator-level rights of the EQn computer, these rights being provided by the ADMn module of the computer.

[0105] In one embodiment, these namespace combinations are obtained by obtaining the list of namespaces and the associated processes, accessible via administrator rights. For each namespace thus obtained, a single process, among the processes associated with this namespace, is selected as a reference process. For each selected reference process, the different namespaces associated with this process are identified. As explained above, the different namespaces associated with a process form the namespace combination with which this process is associated. Consequently, the namespace combinations and the reference processes respectively associated with these combinations are thus identified.

[0106] In one embodiment, each reference process PrR-PrR' of a CNS-CNS' namespace combination is the base process of that combination, i.e., the first process created in that combination.

[0107] The basic process of a namespace can be identified, for example, using the lsns command in the case of a Linux system.

[0108] In the remainder of the description, in one embodiment, the initialization step F30 of a test process PrT from a reference process PrR associated with a CNS combination is described. This step makes it possible to detect the exploitability of the CVEk vulnerability in the CNS namespace combination. In particular, step F30 makes it possible to indicate whether the resources allocated to the processes of this CNS combination make it possible to exploit the CVEk vulnerability.

[0109] The test process PrT is initialized in the same CNS namespace combination as the reference process PrR. In one embodiment, the test process PrT is created such that it has the same environment variables as the reference process. For this purpose, the test process PrT is for example created as identical to the reference process, and thus generally inherits its environment variables.

[0110] For example, in a Linux system, the test process PrT is initialized with the fork() function applied to the reference process.

[0111] The PrT test process executes a Pk detection program that detects the exploitability of the CVEk vulnerability. In one embodiment, this program is composed of two parts.

[0112] The first part Script1 k , the execution of which corresponds to step F301, checks whether the test process has the means to implement an attack exploiting the CVEk vulnerability. These means correspond, among other things, to the resources isolated by the combination of CNS namespaces as well as the resources made accessible by the environment variables of the PrT test process.

[0113] Even if such means are present, the vulnerability may not be effectively exploitable. For example, security programs may be implemented in the CNS namespace combination, such that an attack aimed at exploiting the CVEk vulnerability would be blocked. Whether such an attack is blocked or not, i.e., the actual exploitability of the vulnerability, is determined by the second part of the Pk detection program.

[0114] The second part Script2 k of the Pk program, whose execution corresponds to step F302, tests the exploitability of the CVEk vulnerability. This part aims to exploit the vulnerability similar to an attack, but without harmful consequences on the EQn computer.

[0115] The CVE-2021-3156 vulnerability is an example of how to run a detection program. This vulnerability, which affects the sudo command, is particularly critical given that sudo is used in a wide variety of environments. When a command is issued with sudo, the command arguments are first concatenated, and metacharacters are escaped with a backslash (e.g., "\" becomes "\\"). When a special character, such as [,{,(,\, or ^, is read as a normal character rather than a special character, it may be preceded by a backslash \. This is called escaping a character.

[0116] In particular, the escaping described here is not performed when sudo is run via the sudoedit -s symlink. Therefore, if an argument to the sudoedit command ends with a single backslash, and arguments are not escaped by sudo, the program will copy characters outside the bounds of the memory buffer, resulting in a buffer overflow.

[0117] Appendices 1 and 2 correspond respectively to the first and second parts Script1 k and Script2 k of the Pk detection program in the case where the CVEk vulnerability is the CVE-2021-3156 vulnerability. In this example, the Pk detection program is coded in bash language, which in no way represents a limitation of the invention. The invention allows the use of any programming language allowing a person skilled in the art to code a detection program in accordance with the invention.

[0118] Execution of the Script1 code k in appendix 1 checks for the presence of the sudoedit symbolic link to execute the sudo binary and logs a "Might be vulnerable" message in an "interface" file if this presence is detected.

[0119] Execution of the Script2 code k in Appendix 2 launches the execution of the "exploit" file, which corresponds to the use of the sudoedit command with a single backslash. If this execution fails, for example because of a security program blocking any use of the sudoedit command with a backslash, no message is produced. Otherwise, a "Vulnerable" message is recorded in the "interface" file.

[0120] Following execution of the Pk detection program, the "interface" file contains an IEXk indicator of the exploitability of the CVEk vulnerability. If this IEXk indicator contains the message "Might be vulnerable" but does not contain the message "Vulnerable", then it indicates that means to exploit the CVEk vulnerability are available to processes in the CNS namespace combination, but that this vulnerability is not actually exploitable. If the IEXk indicator contains "Vulnerable", it indicates that the CVEk vulnerability is indeed exploitable, and allows us to infer that such a vulnerability must be addressed, for example by installing an additional security program, adding upstream network protection, or disabling the vulnerable functionality upstream.If the IEXk indicator does not contain either of the two messages mentioned above, then it indicates that the means to exploit the CVEk vulnerability are not accessible to processes in the CNS namespace combination.

[0121] Additionally, the IEXk flag contains information that identifies the CVEk vulnerability being tested, such as the ID_CVEk identifier. This information can be placed in the header of this flag.

[0122] It should be noted that the above example in no way limits the possible contents of an exploitability indicator in accordance with the invention. Any content giving a clear indication of the exploitability of the vulnerability may be chosen by a person skilled in the art.

[0123] In another example of a vulnerability, the attack vector is network-based. In other words, an attack exploiting this vulnerability is sent from the network to the IP address used by the process. Such an attack vector can be reproduced locally with the second part of the detection program by sending network traffic to the local IP address 127.0.0.1.

[0124] The exploitability indicator IEXk as well as an IPn identifier of the computer EQn and an ICNS identifier of the CNS combination of namespaces are sent in the form of a Log signal, during step F40, to the security management device CNode.

[0125] The Log signal is then received by the MIDA module of the CNode security management device which adds it to an LVNS list.

[0126] In one embodiment, the steps described above are performed in parallel for a plurality of namespace combinations in each of these computers.

[0127] Further, in one embodiment, the steps described above are implemented for a plurality of CVE1-CVEm vulnerabilities and their corresponding P1-Pm detection programs.

[0128] The LVNS list thus constructed indicates in which namespace combinations and on which computers different given vulnerabilities can be exploited. This list then constitutes a vulnerability map on a computer fleet. It allows a central administrator to manage the security of the computer fleet. In particular, the central administrator can, from the LVNS list, determine in which namespaces to install security programs.

[0129] Larepresents the functional architecture of a module MDETn for detecting the exploitability of a vulnerability, in accordance with a particular embodiment of the invention. It comprises: - a sub-module MD0 for identifying a plurality of combinations of namespaces and the reference processes respectively associated; - a sub-module MD10 for receiving an identifier of a computer vulnerability; - a sub-module MD20 for installing a program for detecting the exploitability of a vulnerability; - a sub-module MD30 for creating a test process executing a program for detecting the exploitability of the vulnerability producing an indicator of this exploitability; - a sub-module MD40 for sending, to a security management device, a signal comprising this indicator.

[0130] The represents the functional architecture of a MIDA module for identifying the exploitability of a vulnerability in a CNS combination of namespaces of an EQn computer, in accordance with a particular embodiment of the invention. It comprises: - a sub-module MS10 for sending an identifier of a computer vulnerability; - a sub-module MS40 for receiving a signal comprising an indicator IEXk of the exploitability of the vulnerability, an ICNS identifier of the CNS combination and an IPn identifier of the EQn computer; - a sub-module MS50 for recording the signal in a list.

[0131] [Annex. 1]

[0132] ret=$(which sudoedit)if [ ! –z $ret ]thenecho "Might be vulnerable to $CVEID">>interfacefi

[0133] [Annex. 2]

[0134] If [ $(echo "pwd"| . / exploit) = $(pwd) ] ; then ; echo "Vulnerable" >> ${interface}; fi< / path> < / path> < / path>

Claims

A detection method implemented by a computer (EQn) to detect the exploitability of a computer vulnerability (CVEk) in a set of processes associated with a combination of namespaces (CNS), said method comprising, for a reference process (PrR) of said set, the steps of: - initialization (F30) from the reference process (PrR) and execution of a test process (PrT) associated with said combination (CNS) and executing a detection program (Pk), the execution (F30) of said program (Pk) producing an indicator (IEXk) of the exploitability of said vulnerability (CVEk) in said set of processes; - sending (F40) to a security management device (CNode) at least one signal (Log) including said indicator (IEXk). Method according to claim 1 wherein said reference process (PrT) is the basic process of said combination (CNS). A method according to claim 1 or 2 wherein the execution of the detection program (Pk) comprises: - a determination (F301) of the presence of one or more means of exploiting said vulnerability (CVEk) in an environment defined by at least said combination of namespaces and at least one environment variable of said reference process (PrR); and, if one or more of said means of exploiting are detected: - an exploitation test (F302) of said vulnerability (CVEk) with this or these means of exploiting. A method according to any one of claims 1 to 3 comprising the steps of: - receiving (F10), from said security management device (CNode), an identifier (ID_CVEk) of said vulnerability (CVEk); - installing (F20), in said computer (EQn), said detection program (Pk) corresponding to said identifier (ID_CVEk). A method according to claim 4 in which said installation step (F20) comprises substeps of: - sending (F201), to a security server (SRV_SEC), a request (REQ) containing said identifier (ID_CVEk) of the vulnerability (CVEk); - receiving (F202), in response to the request (REQ), said detection program (Pk). A method according to any one of claims 1 to 5, characterized in that said computer (EQn) includes a protection program (PMk) against the exploitation of said vulnerability (CVEk) and in that said protection program (PMk) is neutralized during the execution of said detection program (Pk). Detection method according to any one of claims 1 to 6 wherein said initialization (F30) and sending (F40) steps are performed for each of the reference processes associated with a plurality of namespace combinations. Identification method implemented by a security management device (CNode), to identify the exploitability of a computer vulnerability (CVEk) in at least one computer (EQn), said method comprising steps of:- receiving (E40) from said at least one computer (EQn), a signal (Log) including an indicator (IEXk) of the exploitability of said vulnerability (CVEk) in a set of processes associated with a combination (CNS) of namespaces of said at least one computer (EQn);- adding (E50) to a list (LVNS) of said signal (Log). Identification method according to claim 8, wherein the security management device (CNode) performs at least one action among: - an installation of at least one security program in at least one namespace; - a treatment of said vulnerability; - a disabling of a vulnerable functionality; - an implementation of a mitigation policy. A detection module (MDETn) in a computer (EQn) for detecting the exploitability of a computer vulnerability (CVEk) in a set of processes associated with a combination of namespaces (CNS), said module comprising, for a reference process (PrR) of said set: - an initialization submodule (MD30) from the reference process (PrR) and execution of a test process (PrT) associated with said combination (CNS) and executing a detection program (Pk), the execution of said program (Pk) producing an indicator (IEXk) of the exploitability of said vulnerability (CVEk) in said set of processes; - a sending submodule (MD40) to a security management device (CNode) of at least one signal (Log) including said indicator (IEXk). Identification module (MIDA) in a security management device (CNode), to identify the exploitability of a computer vulnerability (CVEk) in at least one computer (EQn), said module comprising: - a receiving sub-module (MS40), from said at least one computer (EQn), of a signal (Log) including an indicator (IEXk) of the exploitability of said vulnerability (CVEk) in a set of processes associated with a combination (CNS) of namespaces of said at least one computer (EQn); - an appending sub-module (MS50) to a list of said signal (Log). Computer program comprising instructions which, when the program is executed by a computer, implements steps of a process according to any one of claims 1 to 8. Recording medium, readable by a computer (EQn) and / or a computing device (CNode), comprising a computer program according to claim 12.

Images