alegrey91
Joined 4 years ago
Karma
8
Submissions
14
Member since
Jun 24
Recent submissions
Comment · 1 month ago
Let me know what do you think in case you decide to use it.
The model is still far from being perfect, but it gives decent results considering I'm new to the ML topic.
Comment · 1 month ago
Hello, thanks for your feedback. The point of vex8s is to avoid fixing all the CVEs at the same time giving them less or more priority depending on their exposure. If you find there's some protection, you can keep that CVE aside to focus more on other with higher priority.
Comment · 1 month ago
vex8s is an open source tool that analyzes Kubernetes workloads and generates VEX documents based on their SecurityContext.
The idea is to distinguish vulnerabilities that are actually exploitable in a given deployment from those mitigated by Kubernetes security settings (for example, readOnlyRootFilesystem, dropped capabilities, non-root users, and read-only volume mounts).
vex8s embeds a ML model trained on CVE data to predict vulnerability classes, then combines those predictions with the workload's security configuration to determine whether a vulnerability can be mitigated.
I'm particularly interested in feedback on the decision logic and on whether this approach could be useful as part of a vulnerability scanning pipeline.
Comment · 7 months ago
If you run hardened containers (readOnlyRootFilesystem, runAsNonRoot, resource limits, etc.), you've probably noticed that trivy/grype still flag CVEs that aren't actually exploitable in your environment.
There's no standard way to say "this CVE doesn't apply to my deployment." vex8s bridges that gap. It uses an embedded ML model to classify each CVE by exploitation type (arbitrary file write, privilege escalation, resource exhaustion, etc.), then checks your Kubernetes manifest to determine if the settings already mitigate it. The output is an OpenVEX document that scanners like trivy can consume to suppress those CVEs.
Example: a CVE classified as arbitrary_file_write gets suppressed if your container has readOnlyRootFilesystem: true with all volume mounts set to read-only.
Paper with the full research: https://github.com/alegrey91/vex8s/blob/main/docs/environmet...
Would love feedback :)
Comment · 1 year ago
Hi everyone, I'm an Open source enthusiast and developer of github.com/alegrey91/harpoon. I wanted to share my lastest release and get your feedback!
What Is harpoon? harpoon is a cli that aims to capture the syscalls (as if they were fishes) from the execution flow (the river) of a single user-defined function.
Why I Built It? I wanted to automatically generate Seccomp profiles within the test pipelines of my projects. harpoon can helps with this by tracing syscalls from unit and integration tests. An example of this is implemented here: github.com/alegrey91/fwdctl
If you have any feedback/questions, I would be happy to reply :)
Comment · 3 years ago
Harpoon aims to capture the syscalls (as if they were fishes) from the execution flow (the river) of a single user-defined function.