‹ BackHN Continuity

Thread

Suppress vulnerabilities applying Kubernetes context to scans

8 points · 2 comments · alegrey91

Loading the complete thread in the background. This saved snapshot is available now. Refresh

  1. alegrey91 · · focus · HN ↗
    vex8s is an open source tool that analyzes Kubernetes workloads and generates VEX documents based on their SecurityContext.

    The idea is to distinguish vulnerabilities that are actually exploitable in a given deployment from those mitigated by Kubernetes security settings (for example, readOnlyRootFilesystem, dropped capabilities, non-root users, and read-only volume mounts).

    vex8s embeds a ML model trained on CVE data to predict vulnerability classes, then combines those predictions with the workload's security configuration to determine whether a vulnerability can be mitigated.

    I'm particularly interested in feedback on the decision logic and on whether this approach could be useful as part of a vulnerability scanning pipeline.

    GitHub: <a href="https:&#x2F;&#x2F;github.com&#x2F;alegrey91&#x2F;vex8s" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;alegrey91&#x2F;vex8s

    1. Grimburger · · focus · HN ↗
      This is very cool, why not directly test the exploitability direct with harmless pods on the cluster for verification? If it&#x27;s only model based as a defender I&#x27;d worry about how many % of misses arise. Even frontier models are going to miss some stuff, a programmatic gate seems prudent.

      Not trying to be negative, do think it&#x27;s a good approach youve got, but the modern reality of dealing with cve&#x27;s and compliance is to just fix them because it&#x27;s a massive headache trying to write exemptions for all the ones that don&#x27;t matter. Been my experience anyway.

      1. iou · · focus · HN ↗
        Before LLMs “just-patch-anyway” was a viable strategy because of the low volume. Now it’s amplified so much that taking that approach can introduce instability when the vulnerability was not accessible to you.

        Take the recent example of Copy&#x2F;Fail (CVE-2026-31431) if you were to evaluate it against your k8s seccomp and noticed that the argument to the syscall socket of AF_ALG is not allowed, then the vuln is not reachable in your pods.

        I’ve not used this tool (I plan to check it out), but I think contextual evaluation of CVEs is important in modern times.

        1. alegrey91 · · focus · HN ↗
          Let me know what do you think in case you decide to use it. The model is still far from being perfect, but it gives decent results considering I&#x27;m new to the ML topic.
      2. alegrey91 · · focus · HN ↗
        Hello, thanks for your feedback. The point of vex8s is to avoid fixing all the CVEs at the same time giving them less or more priority depending on their exposure. If you find there&#x27;s some protection, you can keep that CVE aside to focus more on other with higher priority.
Open on Hacker News to reply ↗

Unofficial Hacker News client; not affiliated with Y Combinator.