Known CVE detection已知 CVE 检测
Does my kernel carry a published CVE that's unpatched? Static source / git checks — cvehound + kernel-cve-tool.内核里有没有已公开、还没修的 CVE？静态查源码 / git —— cvehound + kernel-cve-tool。
deterministic tools确定性工具主场A curated toolkit for detecting known CVEs, hardening config, and auditing code in Linux vendor / Android arm64 kernels. Six categories, three layers, one command to install every dependency. Clone it and you know exactly how to test — no guesswork. 给 Linux vendor / Android arm64 内核做已知 CVE 检测、配置加固、代码审计的一套开源工具编排。六类方法、三层检测、一条命令装齐依赖。拉下来就知道怎么测——不用猜。
It's several — with completely different tools. Mixing "scan for a known CVE" with "rate a bug's impact" is the number-one reason people pick the wrong tool. This repo splits the work into six clear categories and hands you the right tool for each, pre-wired. 它是好几件事，手段完全不同。把"扫已知 CVE"和"给漏洞定影响级别"混为一谈，是选错工具的头号原因。本库把它拆成六个清楚的类别，每类配好对应工具，直接可用。
①②③⑤⑥ are what this repo practices — all on kernels you own or are authorized to test, to find and fix. ④ is reference-only: paper impact-rating to prioritize fixes, no attack tooling. ①②③⑤⑥ 是本库实践的——全部对你拥有或获授权的内核做，目的是找出来并修掉。④ 是参考类：纸面影响评级给修复排优先级，不含攻击工具。
Does my kernel carry a published CVE that's unpatched? Static source / git checks — cvehound + kernel-cve-tool.内核里有没有已公开、还没修的 CVE？静态查源码 / git —— cvehound + kernel-cve-tool。
deterministic tools确定性工具主场Is my kernel config hard enough? Compare .config / cmdline / sysctl against the KSPP baseline — kernel-hardening-checker.内核配置够不够硬？拿 .config / cmdline / sysctl 对照 KSPP 加固基线 —— kernel-hardening-checker。
rule comparison规则比对Any bug nobody has found yet? LLM synthesizes syscall specs, syzkaller does the fuzzing — KernelGPT.有没有还没人发现的洞？LLM 合成 syscall 规格，syzkaller 实跑 fuzz —— KernelGPT。
LLM + fuzzerLLM 配 fuzzerHow bad is a found bug, fix it first or not? Paper rating from vulnerability-class knowledge. No attack tooling.查到的洞影响多大、要不要先修？靠漏洞类别知识做纸面评级。不放攻击工具。
human judgement人工判断Does this diff have a security issue? Claude reads C semantically — filters ① false positives, reviews backports.这段 diff 有没有安全问题？Claude 语义读 C —— 过滤 ① 假阳性、审 backport。
assists ①③辅助 ①③Only have a .ko / firmware, or must prove the shipped binary carries a bug? Ghidra / radare2 wired to Claude via MCP.只有 .ko / 固件，或要证明出厂二进制含 bug?Ghidra / radare2 经 MCP 接给 Claude。
assembly-level proof汇编级坐实Each layer runs independently and folds into one report. L1 is deterministic fact; L2 is an LLM hint you verify; L3 is measured behaviour on your own device. 三层各自独立可跑，并进一份报告。L1 是确定性事实；L2 是要你验证的 LLM 提示；L3 是自家设备上的实测行为。
bin/ksec. Deterministic facts, LLM hints and device measurements stay clearly separated.
三层检测经 bin/ksec 汇成一份报告。确定性事实、LLM 提示、设备实测，三者始终分开呈现。
install-deps.sh detects your package manager and installs coccinelle, the cross-compiler and the pip tools. Then point ksec at your kernel source and read the report.
install-deps.sh 认出你的包管理器，装 coccinelle、交叉编译器和 pip 工具。然后把 ksec 指向你的内核源码，读报告。
# 1) clone $ git clone …/linux-kernel-security-oss $ cd linux-kernel-security-oss # 2) one-command dependency install $ bash scripts/install-deps.sh # 3) pull the third-party tools $ bash scripts/clone-tools.sh # 4) scan your kernel, read the report $ export KERNEL=/path/to/your/kernel $ bin/ksec scan --kernel "$KERNEL" $ bin/ksec report --html
install-deps flags, ksec scan / report / audit / dynamic, the harness, and a per-category walkthrough.install-deps 参数、ksec scan / report / audit / dynamic、harness，以及每个类别的走查。
Open usage打开使用页 ARCHITECTUREThe three-layer model, how ksec skips missing tools, repo layout, and where LLM fits — honestly.三层模型、ksec 如何优雅跳过缺失工具、仓库布局，以及 LLM 的诚实定位。
Open architecture打开架构页 SOURCEdocs/00–08 method notes, bin/ksec, harness/, scripts/. MIT licensed.docs/00–08 方法笔记、bin/ksec、harness/、scripts/。MIT 许可。
Open on GitHub去 GitHub