基于 Kubernetes 安全上下文的漏洞可利用性过滤
问题概述
在 Kubernetes 环境中，传统漏洞扫描会把被安全上下文（如只读文件系统、受限权限）缓解的漏洞标记为可利用，导致大量噪声。需要一种工具能够结合安全上下文和 ML 预测，区分真正可利用的漏洞并减少误报。
痛点标签
- Kubernetes 安全上下文导致漏洞扫描产生大量误报
待验证问题
- 目前的漏洞扫描流程中是否已经使用了安全上下文信息？
- 您是否希望将此类过滤功能集成到现有的 CI/CD 安全管道？
- 对模型预测的准确率和可解释性有什么期望？
证据
原话
vex8s is an open source tool that analyzes Kubernetes workloads and generates VEX documents based on their SecurityContext.The idea is to distinguish vulnerabilities that are actually exploitable in a given deployment from those mitigated by Kubernetes security settings (for example, readOnlyRootFilesystem, dropped capabilities, non-root users, and read-only volume mounts).vex8s embeds a ML model trained on CVE data to predict vulnerability classes, then combines those predictions with the workload's security configuration to determine whether a vulnerability can be mitigated.I'm particularly interested in feedback on the decision logic and on whether this approach could be useful as part of a vulnerability scanning pipeline.GitHub: https://github.com/alegrey91/vex8s
免责声明：本卡片由 AI 从社区讨论中提炼，属于「痛点证据」，是需求分析与验证的起点，不等同于「已验证的市场需求」。AI 存在分析局限，关键决策前请打开上方原始讨论人工复核。