[CKC] Add CVE verification with --check-cves option #33

bmastbergen · 2025-10-14T14:33:24Z

Adds ability to verify that CVE references in PR commit messages correctly match the upstream commits they reference. Uses the kernel vulnerabilities database to cross-check CVE assignments against upstream commit hashes.

The --check-cves flag enables validation that detects three error conditions: mismatched CVE assignments between PR and upstream commits, CVE references to upstream commits with no CVE assignment, and failures accessing the vulnerabilities database. Output format matches existing checker patterns with support for both plain text and markdown modes.

Here is an example github comment from this code:
ctrliq/kernel-src-tree#616 (comment)

This was written by Claude BTW.

ciq-it-service-account · 2025-10-14T14:33:40Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Copilot

Pull Request Overview

This pull request adds CVE verification functionality to the kernel commit checker, allowing validation that CVE references in PR commit messages correctly match their upstream counterparts. The change enables cross-referencing with the kernel vulnerabilities database to detect mismatched, missing, or invalid CVE assignments.

Key changes:

Adds --check-cves flag to enable CVE validation against the vulnerabilities database
Implements automatic cloning/updating of the kernel vulns repository
Integrates CVE information into existing bugfix detection output

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

check_kernel_commits.py

Copilot

Pull Request Overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

check_kernel_commits.py

Copilot

Pull Request Overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 2 comments.

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-10-14T15:07:38Z

check_kernel_commits.py


+def extract_cve_from_message(msg):
+    """Extract CVE reference from commit message. Returns CVE ID or None.
+    Only matches 'cve CVE-2025-12345', ignores 'cve-bf' and 'cve-pre' variants."""


[nitpick] The docstring example uses CVE-2025-12345 which appears to be a future year. Consider using a more realistic example like CVE-2024-12345 or CVE-2023-12345.

Suggested change

Only matches 'cve CVE-2025-12345', ignores 'cve-bf' and 'cve-pre' variants."""

Only matches 'cve CVE-2024-12345', ignores 'cve-bf' and 'cve-pre' variants."""

The future is now copilot! Its 2025!

check_kernel_commits.py

Copilot

Pull Request Overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-10-14T16:54:53Z

check_kernel_commits.py

+def extract_cve_from_message(msg):
+    """Extract CVE reference from commit message. Returns CVE ID or None.
+    Only matches 'cve CVE-2025-12345', ignores 'cve-bf' and 'cve-pre' variants."""
+    match = re.search(r'(?<!\S)cve\s+(CVE-\d{4}-\d+)', msg, re.IGNORECASE)


The regex pattern uses a negative lookbehind (?<!\S) but the docstring mentions it ignores 'cve-bf' and 'cve-pre' variants. The current pattern would still match 'cve CVE-2025-12345' in 'somecve CVE-2025-12345'. Consider using word boundaries \\bcve\\s+ for clearer intent.

Suggested change

match = re.search(r'(?<!\S)cve\s+(CVE-\d{4}-\d+)', msg, re.IGNORECASE)

match = re.search(r'\bcve\s+(CVE-\d{4}-\d+)', msg, re.IGNORECASE)

Oh Co-Pilot, your contexted didn't even follow the comment directly above which you also whined about.

PlaidCat

This is too useful to block on a tree of if's

PlaidCat · 2025-10-17T14:38:51Z

check_kernel_commits.py

                        out_lines.append('    ' + line)
                    out_lines.append("")  # blank line

+            # Check CVE if enabled


I really hate this tree of if statements.

Can we make a ticket to clean this up ... ideally as a part of python mock testing ?

@PlaidCat Yees, I fully agree with you! On my list to refactor this when I migrate to 'kt'

roxanan1996

This script needs refactoring soon, as it becoming bigger and bigger but for now, it's fine.

One question: this does not cover the case where there are multiple commits upstream for a CVE but the pull requests does not include all of them, right?

check_kernel_commits.py

PlaidCat · 2025-10-17T15:16:22Z

This script needs refactoring soon, as it becoming bigger and bigger but for now, it's fine.

One question: this does not cover the case where there are multiple commits upstream for a CVE but the pull requests does not include all of them, right?

Do you have an example of this since Kernel.org became the CNA.
I believe this is an artifact of the past when kernel.org had no control over CVEs cut against it.

it might be useful to some pre 2023 but we have no way of validating those within the kernel.org/vulns project (they're a bit of a mess)

Adds ability to verify that CVE references in PR commit messages correctly match the upstream commits they reference. Uses the kernel vulnerabilities database to cross-check CVE assignments against upstream commit hashes. The --check-cves flag enables validation that detects three error conditions: mismatched CVE assignments between PR and upstream commits, CVE references to upstream commits with no CVE assignment, and failures accessing the vulnerabilities database. Output format matches existing checker patterns with support for both plain text and markdown modes.

bmastbergen · 2025-10-17T16:42:08Z

Addressed comments from @roxanan1996

I agree with both of you that this script could use some refactoring. Lets get it in and checking PRs then fix it up. Thanks!

Copilot AI review requested due to automatic review settings October 14, 2025 14:33

Copilot AI reviewed Oct 14, 2025

View reviewed changes

check_kernel_commits.py Outdated Show resolved Hide resolved

check_kernel_commits.py Outdated Show resolved Hide resolved

bmastbergen force-pushed the ckc-add-cve-checking branch from 15e9a3a to 00cab6a Compare October 14, 2025 14:44

bmastbergen requested a review from Copilot October 14, 2025 14:47

Copilot AI reviewed Oct 14, 2025

View reviewed changes

check_kernel_commits.py Outdated Show resolved Hide resolved

bmastbergen force-pushed the ckc-add-cve-checking branch from 00cab6a to da974d3 Compare October 14, 2025 15:02

bmastbergen requested a review from Copilot October 14, 2025 15:07

Copilot AI reviewed Oct 14, 2025

View reviewed changes

bmastbergen requested a review from Copilot October 14, 2025 16:54

Copilot AI reviewed Oct 14, 2025

View reviewed changes

bmastbergen requested review from PlaidCat, kerneltoast, roxanan1996 and shreeya-patel98 October 17, 2025 14:19

PlaidCat previously approved these changes Oct 17, 2025

View reviewed changes

roxanan1996 reviewed Oct 17, 2025

View reviewed changes

check_kernel_commits.py Outdated Show resolved Hide resolved

check_kernel_commits.py Show resolved Hide resolved

check_kernel_commits.py Show resolved Hide resolved

bmastbergen dismissed PlaidCat’s stale review via dabfdef October 17, 2025 16:38

bmastbergen force-pushed the ckc-add-cve-checking branch from da974d3 to dabfdef Compare October 17, 2025 16:38

bmastbergen requested review from PlaidCat and roxanan1996 October 17, 2025 16:40

roxanan1996 approved these changes Oct 17, 2025

View reviewed changes

bmastbergen merged commit 66d35bd into mainline Oct 17, 2025

bmastbergen deleted the ckc-add-cve-checking branch October 17, 2025 18:02

	Only matches 'cve CVE-2025-12345', ignores 'cve-bf' and 'cve-pre' variants."""
	Only matches 'cve CVE-2024-12345', ignores 'cve-bf' and 'cve-pre' variants."""

	match = re.search(r'(?<!\S)cve\s+(CVE-\d{4}-\d+)', msg, re.IGNORECASE)
	match = re.search(r'\bcve\s+(CVE-\d{4}-\d+)', msg, re.IGNORECASE)

[CKC] Add CVE verification with --check-cves option #33

[CKC] Add CVE verification with --check-cves option #33

Uh oh!

Conversation

bmastbergen commented Oct 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ciq-it-service-account commented Oct 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Oct 14, 2025

Choose a reason for hiding this comment

Uh oh!

bmastbergen Oct 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Copilot AI Oct 14, 2025

Choose a reason for hiding this comment

Uh oh!

PlaidCat Oct 16, 2025

Choose a reason for hiding this comment

Uh oh!

PlaidCat left a comment

Choose a reason for hiding this comment

Uh oh!

PlaidCat Oct 17, 2025

Choose a reason for hiding this comment

Uh oh!

roxanan1996 Oct 17, 2025

Choose a reason for hiding this comment

Uh oh!

roxanan1996 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

PlaidCat commented Oct 17, 2025

Uh oh!

bmastbergen commented Oct 17, 2025

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

5 participants

bmastbergen commented Oct 14, 2025 •

edited

Loading

ciq-it-service-account commented Oct 14, 2025 •

edited

Loading

bmastbergen Oct 14, 2025 •

edited

Loading