Metraipolis › archive › dc_032ee9247e7e

Inferring 1-Minimal Trigger Configurations for Assessing Linux Kernel CVE Triggerability — arXiv:2608.15225

Source: arXiv (en)
Original: https://arxiv.org/abs/2608.15225
License (as archived): CC0-1.0
Archived: 2026-10-18T19:33:51.954Z
SHA-256 of the archived text: c1665fb8475dbe6b9e493c01520adff003e693db9135c1bfee7c8464ab101798
Stable URL of this page: https://metraipolis.com/documento/dc_032ee9247e7e

How to cite

Inferring 1-Minimal Trigger Configurations for Assessing Linux Kernel CVE Triggerability — arXiv:2608.15225 — arXiv (en), https://arxiv.org/abs/2608.15225 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_032ee9247e7e (Metraipolis archive dc_032ee9247e7e, sha256 c1665fb8475dbe6b9e493c01520adff003e693db9135c1bfee7c8464ab101798)

BibTeX

@misc{dc032ee9247e7e,
  title = {Inferring 1-Minimal Trigger Configurations for Assessing Linux Kernel CVE Triggerability — arXiv:2608.15225},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2608.15225},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_032ee9247e7e; sha256 c1665fb8475dbe6b9e493c01520adff003e693db9135c1bfee7c8464ab101798},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2608.15225. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Vendors assessing Linux kernel CVEs need to know whether a bug is triggerable under production-tailored configurations, not merely whether a version is affected, yet upstream reproducers and vulnerability databases rarely provide configuration-level context. We study minimal trigger-configuration inference: given a CVE entry and a target kernel version (optionally a baseline .config), we synthesize a Kconfig-satisfiable option set that remains effective after make olddefconfig and, when a reproducer is available, still triggers under a specified evaluation protocol; we then prune it to a 1-minimal (subset-minimal) boundary for evaluation. Our framework FCC links vulnerability cues to build-system symbols, completes implicit prerequisites under olddefconfig feedback to avoid silent rollback, and performs runtime-validated minimization guided by dependency topology. We evaluate on KernJC and KernelCTF, totaling 88 CVEs across multiple kernel versions. On the 88-CVE set, FCC improves the post-make olddefconfig configuration success rate from 62.5% (55/88) to 96.6% (85/88) over an olddef-only injection baseline; on the KernJC set, FCC reduces the average candidate set size by 78.7% compared to KernJC (Avg. 14.72 vs. 69.00 options per CVE). A stage-wise analysis of time and token costs shows that Stage I dominates overhead, while CVE-focused evidence selection substantially reduces this cost. By returning an effective and auditable 1-minimal configuration boundary, FCC helps vendors scope triggerability against their deployment configurations with a clear, tool-supported decision line.

Tema degli esploratori: fiducia digitale e crittografia (retro-catalogo arXiv: annunci del 2026-08-18 in cs.CR).
Categorie arXiv: Cryptography and Security (cs.CR).
Pagina del lavoro: https://arxiv.org/abs/2608.15225 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-18T19:01:59.110Z dalla pagina https://arxiv.org/catchup/cs.CR/2026-08-18?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).