mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
AnilAltinayandgVisor bot
b798569599
This change introduces a Go binary `update_cve_track_record` that can parse, update/insert, sort, and re-encode entries in the website's `_data/cve-track-record.yml`. The tool ensures proper formatting and sorting of CVE entries. A new `SKILL.md` file is also added, providing a step-by-step guide on how to use this tool to manage CVE entries, including gathering necessary details and running validation tests after updating the YAML file. PiperOrigin-RevId: 944802032
100 lines
2.9 KiB
JSON
100 lines
2.9 KiB
JSON
{
|
|
"$schema": "http://json-schema.org/draft-07/schema",
|
|
"type": "object",
|
|
"properties": {
|
|
"cves": {
|
|
"description": "List of CVE track record entries.",
|
|
"type": "array",
|
|
"items": {
|
|
"$ref": "#/definitions/cveEntry"
|
|
}
|
|
}
|
|
},
|
|
"required": [
|
|
"cves"
|
|
],
|
|
"additionalProperties": false,
|
|
"definitions": {
|
|
"cveEntry": {
|
|
"type": "object",
|
|
"properties": {
|
|
"date": {
|
|
"description": "The date of the CVE entry in YYYY-MM format.",
|
|
"type": "string"
|
|
},
|
|
"description": {
|
|
"description": "Vulnerability overview and impact.",
|
|
"type": "string"
|
|
},
|
|
"risk": {
|
|
"description": "The escalation vector or risk category (e.g. Pod-to-guest escalation, Information leakage, Denial of service, Local privilege escalation, Network policy bypass).",
|
|
"type": "string"
|
|
},
|
|
"scope": {
|
|
"description": "The target ecosystem scope affected by the CVE (e.g., All Linux VMs, All Linux containers, gVisor Sentry).",
|
|
"type": "string"
|
|
},
|
|
"cve": {
|
|
"description": "The CVE ID or GHSA ID, or empty string if none.",
|
|
"type": "string"
|
|
},
|
|
"cvss": {
|
|
"description": "The CVSS score.",
|
|
"type": [
|
|
"number",
|
|
"null"
|
|
]
|
|
},
|
|
"exploitable_under_gvisor": {
|
|
"description": "Whether the vulnerability is exploitable under gVisor (true if gVisor itself is vulnerable or if the vulnerability can escape the gVisor boundary; false if gVisor is immune, shields the host, or doesn't implement the vulnerable functionality).",
|
|
"type": "boolean"
|
|
},
|
|
"patched": {
|
|
"description": "The current mitigation status of a vulnerability that was initially exploitable under gVisor: PATCHED (fixed in gVisor), UNPATCHED (still vulnerable), or EXTERNAL_MITIGATION_REQUIRED (requires mitigation outside of gVisor, e.g. CPU microcode).",
|
|
"type": "string",
|
|
"enum": [
|
|
"PATCHED",
|
|
"UNPATCHED",
|
|
"EXTERNAL_MITIGATION_REQUIRED"
|
|
]
|
|
},
|
|
"mitigation_gap": {
|
|
"description": "Explanation as to why gVisor didn't save the day.",
|
|
"type": "string"
|
|
},
|
|
"vm_prevented": {
|
|
"description": "Whether the VM runtime prevented the exploit.",
|
|
"type": [
|
|
"boolean",
|
|
"null"
|
|
]
|
|
}
|
|
},
|
|
"required": [
|
|
"date",
|
|
"description",
|
|
"risk",
|
|
"scope",
|
|
"cve",
|
|
"cvss",
|
|
"exploitable_under_gvisor"
|
|
],
|
|
"if": {
|
|
"properties": {
|
|
"exploitable_under_gvisor": {
|
|
"const": true
|
|
}
|
|
}
|
|
},
|
|
"then": {
|
|
"required": [
|
|
"vm_prevented",
|
|
"mitigation_gap",
|
|
"patched"
|
|
]
|
|
},
|
|
"additionalProperties": false
|
|
}
|
|
}
|
|
}
|