Comparison and Proposal of Vulnerability Management Approaches in Yocto-Based Linux for the EU CRA

Comparison and Proposal of Vulnerability Management Approaches in Yocto-Based Linux
for the EU CRA January 15, 2026 Akihiko Takahashi, Fujitsu Limited ©2026 Fujitsu Limited 1

$ whoami ⚫ Account ⚫ Qiita : @flying-pan ⚫ LinkedIn
: https://www.linkedin.com/in/ak ihiko-takahashi-26b1a52ab/ ⚫ Job Responsibilities ⚫ Developer of Linux Distributions for Edge Computing ⚫ Infrastructure Engineer for Cloud Fujitsu ltd Akihiko Takahashi ⚫ Community ⚫ OpenSSF SBOM Everywhere SIG ⚫ Japan Technical Jamboree ⚫ yocto project ⚫ OpenChain Japan WG ⚫ Technical Background ⚫ Hobby ⚫ Mini 4WD ⚫ Skiing ⚫ Jazz ©2026 Fujitsu Limited 3

Target Audience of This Presentation ⚫Main Target Audience ⚫Manufacturers subject
to EU CRA (Cyber Resilience Act) who are currently using Yocto Project. ⚫ (Rationale: This presentation aims to provide information that can assist them in considering their compliance requirements.) ⚫Secondary Target Audiences ⚫Manufacturers not subject to the CRA but using Yocto Project. ⚫ (Rationale: Vulnerability management principles often overlap, and this presentation may offer insightful information for them.) ⚫Anyone interested in the topic of embedded Linux security. ⚫ (Rationale: We aim to provide valuable information for a broad audience interested in this topic.) ©2026 Fujitsu Limited 4

Note ⚫This presentation does not give any legal advice about
EU CRA (Cyber Resilience Act). ⚫The presenter is not a legal expert and cannot take responsibility for any detailed interpretation of the law. ⚫The main purpose of this presentation is to focus on studying and comparing how to report security issues in Yocto Linux. Thank you for your understanding. ©2026 Fujitsu Limited 5

Agenda 1. Overview 2. Core Keywords 3. Designing Vulnerability-Aware Releases
4. Tools and Methods Overview 5. Evaluation of Tools and Methods 6. Conclusions ©2026 Fujitsu Limited 6

yocto ⚫The standard tool for generating embedded Linux ⚫Generates Linux
images, packages, SBOM, and VEX based on recipes, which serve as blueprints ⚫Recipes can also include CVE patches and Not Affected information ©2026 Fujitsu Limited yocto is a tool for generating Linux distributions, and it is also an OSS project 8

Article 14 Reporting obligations of manufacturers in CRA 1/3 ⚫Since
9/11/2026 Article 14 of EU Cyber Resilience Act ©2026 Fujitsu Limited 9

Article 14 Reporting obligations of manufacturers in CRA 2/3 ⚫Scope
⚫Manufacturers of products with digital elements. ⚫Reporting recipients ⚫Via the single reporting platform, simultaneously to: ⚫ the CSIRT designated as coordinator ⚫ ENISA. ⚫Covered events ⚫Actively exploited vulnerabilities in the product with digital elements. ⚫Severe incidents having an impact on the security of the product with digital elements ©2026 Fujitsu Limited 10

Article 14 Reporting obligations of manufacturers in CRA 3/3 ⚫Reporting
timeline (general) ⚫Early warning ≦ 24 h ⚫Initial notification ≦ 72 h ⚫Final report: ⚫ Final report ≦ 14 days after a fix for Actively Exploited vulnerabilities ⚫ Final report ≦ 1 month after we are notified of a severe incident. ⚫User notification obligation ⚫Inform affected (or all) users of risks and user-side mitigations (preferably machine-readable) ⚫CSIRT may notify if manufacturer fails. ©2026 Fujitsu Limited Article 64 Penalties Fines up to EUR 15,000,000 or 2.5% of the total worldwide annual turnover, whichever is higher. 11

Focus on Determining Actively exploited vulnerabilities ⚫Determine whether a vulnerability
is actively exploited ⚫Reporting & User notification ⚫Early warning ≦ 24 h ⚫Initial notification ≦ 72 h ⚫Vulnerability ≦ 14 days after a fix is available ⚫Notify users, providing the information in a machine-readable format ©2026 Fujitsu Limited In this study, we focus on identifying actively exploited vulnerabilities. 13

State transition diagram for release and vulnerability management ©2026 Fujitsu
Limited Release Daily run Deployed Potentially Actively Exploited Vulnerability is found by CI/CD Fixed Affected Build & Deploy CI/CD Fix Investigate Vulnerability Handle false positives Trace Vulnerability CI/CD Not Affected CI/CD : CI/CD : Manually Potentially Actively Exploited Vulnerability is not found 14

List of Implementation Methods A)yocto cve-check B)yocto-vex-check C)OWASP Dependency-Track D)sbom-cve-check(*)
(Investigating) ©2026 Fujitsu Limited (*)… https://github.com/bootlin/sbom-cve-check 16

yocto cve-check 1/2 ⚫Description It cross-checks each software component’s recipe
name and version information against a CVE database and generates reports per recipe as well as per image. ⚫Yocto standard feature ⚫Vulnerability data sources ⚫NVD Data Feeds ©2026 Fujitsu Limited yocto project official document (*) (*)…https://docs.yoctoproject.org/dev/dev-manual/vulnerabilities.html 17

yocto cve-check 2/2 ⚫ Input (Except for the vulnerability data
sources) ⚫Recipes ⚫ Output ⚫ Original format(.json) ⚫ False Positive Recording Area ⚫ Recipes ⚫ How to use ⚫ INHERIT += “cve-check” ⚫ NOTE ⚫ It cannot run at the same time as vex.bbclass. They are exclusive. ©2026 Fujitsu Limited 18

yocto-vex-check (*) yocto-vex-check 1/3 ⚫ Description This is a next-generation
standard feature in yocto. yocto-vex-check uses CVE information created by vex.bbclass and SPDX metadata created by create-spdx.bbclass in the yocto Project. It checks vulnerabilities quickly without running bitbake, and it helps you do an efficient security review. ⚫ Yocto standard feature (planned) ⚫ vex.bbclass (yocto-5.1 later) ⚫ yocto-vex-check (coming soon) ⚫ Vulnerability data sources ⚫ NVD Data Feeds ⚫ CVE ©2026 Fujitsu Limited (*)… https://ygreky.com/2025/02/yocto-vex-check/ 19

yocto-vex-check 2/3 ⚫ Input (Except for the vulnerability data sources)
⚫SPDX2.2 ⚫cve metadata by vex.bbclass ⚫ Output ⚫ OpenVEX(.json) ⚫ False Positive Recording Area ⚫ Recipes ⚫ OpenVEX (status (“not_affected”)) ⚫ How to use ⚫ INHERIT += “vex” ⚫ Run yocto-vex-check script(*) after bitbake ©2026 Fujitsu Limited (*)… https://gitlab.com/ygreky/public/yocto-vex-check 20

yocto-vex-check 3/3 ⚫ NOTE ⚫ This is the phase before
Yocto integration, and we are waiting for the official release. ⚫ There are several bugs. ⚫ In this investigation, vulnerability matching with NVD Data Feeds could not be performed due to errors. ⚫ It cannot run at the same time as cve-check.bbclass. They are exclusive. ©2026 Fujitsu Limited 21

OWASP Dependency-Track 1/2 ⚫ Description This platform imports CycloneDX data.
It centrally manages software components, such as libraries that the software depends on. It provides a UI to analyze these components and to show and reduce vulnerability risks across the whole software supply chain. ⚫ Not yocto standard feature ⚫ Vulnerability data sources ⚫ NVD ⚫ Dependency Track supports multiple vulnerability data sources, but in this approach, only NVD can be used. This is because create-spdx does not output PURL information, making it impossible to integrate with other data sources. ©2026 Fujitsu Limited 22

OWASP Dependency-Track 2/2 ⚫ Input (Except for the vulnerability data
sources) ⚫ CycloneDX ⚫ Output ⚫ CycloneDX ⚫ False Positive Recording Area ⚫ In Dependency Track ⚫ How to use ⚫ Generate CycloneDX from the build results of Yocto and import it into Dependency Track. ⚫ NOTE ⚫ Yocto does not provide a standard feature to output CycloneDX. ⚫ In this approach, we examined the use of OpenSSF protobom/sbom-convert. ©2026 Fujitsu Limited 23

Verification Target for Evaluation ⚫Release products : Killer Gateway (*)
⚫Use cases : Data Collection Gateway for Smart Grid ⚫Hardware : Raspberry-pi4 ⚫yocto Version : yocto-5.1 ⚫Repositories : ⚫ poky ⚫ meta-raspberrypi ⚫ meta-openembedded ⚫ meta-killer-gateway (Original for this study) ⚫The number of packages :1,883 ©2026 Fujitsu Limited (*)…Please refer ossj2025-killer-gateway-repo-manifests 25

CI/CD Environment for Evaluation ⚫CI/CD ⚫Github Actions ⚫self-hosted-runner in Azure
Kubernetes Service (Actions Runner Controller) ⚫Build Machine (Worker node) ⚫vCPU : 16 ⚫Mem : 64 GiB ©2026 Fujitsu Limited 26

Definition of Terms ⚫AE Vul ⚫It is a short form
of “Actively Exploited Vulnerability.” ⚫Potentially Actively Exploited Vulnerability ⚫A vulnerability that may be categorized as an Actively Exploited Vulnerability, while still having the possibility of being a false positive. ⚫In this study, this classification is based on matching the vulnerability list of released products with CISA KEV and ENISA API data (details are provided below). ©2026 Fujitsu Limited 27

Scenario for Evaluation 1/4 ©2026 Fujitsu Limited 3/28 Release Fixed
Products 4/10 4/12 9/5 9/7 Release Products Potentially AE vulns Detection by CI/CD Potentially AE vul Detection by CI/CD Investigate AE vulns by manually False Positive Determination AE vulns Determination Initial notification Final report 9/10 Build & Deploy Products 9/12 9/26 ~ ~ ~ ~ Early warning Investigate AE vulns by manually 2025 Notify users Notify users ≦24h ≦72h ≦14d 28

Products 4/10 4/12 9/5 9/7 Release Products Potentially AE vulns Detection by CI/CD Potentially AE vul Detection by CI/CD Investigate AE vulns by manually False Positive Determination AE vulns Determination Initial notification Final report 9/10 Build & Deploy Products 9/12 9/26 ~ ~ ~ ~ Early warning Investigate AE vulns by manually 2025 Notify users Notify users ≦24h ≦72h ≦14d CVE-2024-53150, CVE-2024-53197 Kernel vulnerabilities The vulnerability codes are excluded due to the disabled kernel config. CVE-2025-38352 Kernel vulnerabilities Reference The number of Kernel vulnerabilities in NVD. 2023 : 610 2024 : 4433 2025 : 3218 (~2025/11) 29

Products 4/10 4/12 9/5 9/7 Release Products Investigate AE vulns by manually False Positive Determination AE vulns Determination Initial notification Final report 9/10 Build & Deploy Products 9/12 9/26 ~ ~ ~ ~ Early warning Investigate AE vulns by manually 2025 Notify users Notify users Potentially AE vulns Detection by CI/CD Potentially AE vul Detection by CI/CD Handle false positives Release Daily run Build & Deploy CI/CD Fix Investigate Vulnerability Trace Vulnerability CI/CD State transition ≦14d 30

Products 4/10 4/12 9/5 9/7 Release Products Investigate AE vulns by manually False Positive Determination AE vulns Determination Initial notification Final report 9/10 Build & Deploy Products 9/12 9/26 ~ ~ ~ ~ Early warning Investigate AE vulns by manually 2025 Notify users Notify users Potentially AE vulns Detection by CI/CD Potentially AE vul Detection by CI/CD Handle false positives Release Daily run Build & Deploy CI/CD Fix Investigate Vulnerability Trace Vulnerability CI/CD State transition ≦24h ≦72h ≦14d 31

Evaluation Results 1/3 ©2026 Fujitsu Limited Item yocto cve-check yocto-vex-check
OWASP Dependency-Track Run time of “Build & Deploy” step 60 min 60 min 60 min Run time of “Trace Vulnerability” step 13.5 min (*) 2 min (*) - Vulnerability data sources • NVD Data Feeds • NVD Data Feeds • CVE • NVD Data Feeds Output Vulnerability format • cve-check original format (.json) • OpenVEX (.json) • Not investigated (*)… We do not include the time to download the vulnerability DB in the measurement. 33

OWASP Dependency-Track Pros • Lower CI/CD setup cost than the other option • “Vulnerability Tracing” step is 7× faster than cve-check • Two vulnerability sources: NVD and CVE • Can make OpenVEX • Rich UI • Many features Cons • You must run bitbake each time to check vulnerabilities • You must keep the Yocto cache • This is the phase before Yocto integration (waiting for official release) • The supported SPDX version is 2.2, which is outdated. • Hard to convert yocto results to CycloneDX for Dependency-Track (no stable path today; sbom-convert has issues) • Cannot pass recipe patches or CVE_STATUS (Ignored / Fixed) into Dependency-Track 34

OWASP Dependency-Track Can use now? Yes No No If works as planned ★★☆ ★★★ ★★☆ NOTE - • RFC stage (waiting for official release) • Best choice after release • No stable way to make CycloneDX (when using sbom-convert) 35

まとめ ⚫ビルド・デプロイ段階から、リリースされた成果物に対して Actively Exploited Vulnerabilityの検出を定期的に監視するまでの、3つのアプローチを紹介しました。 ⚫今回比較した中で、現時点で実現可能な手段はyocto cve-check、将来性があるのがyocto-vex-checkです。 ⚫それぞれのアプローチで課題があります。
©2026 Fujitsu Limited 37

References ⚫ yocto PROJECT ⚫ https://www.yoctoproject.org/ ⚫ Cyber Resilience Act
⚫ https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act ⚫ OpenSSF protobom/sbom-convert ⚫ https://github.com/protobom/sbom-convert ⚫ yocto-vex-check ⚫ https://gitlab.com/ygreky/public/yocto-vex-check ⚫ OWASP Dependency-Track ⚫ https://owasp.org/www-project-dependency-track/ ⚫ sbom-cve-check ⚫ https://github.com/bootlin/sbom-cve-check ⚫ ossj2025-killer-gateway-repo-manifests ⚫ https://github.com/ubinux/ossj2025-killer-gateway-repo-manifests ©2026 Fujitsu Limited 40

Process Flow for Determining Actively Exploited Vulnerabilities of 3Methods ©2026
Fujitsu Limited Trace Vulnerability Build & Deploy yocto bitbake SPDX2.2 NVD cve metadata sstate-cache Manifest yocto bitbake cve-check yocto-vex- check Conversion Recipes Fixed CycloneDX1.5 Potentially AE Vul check Potentially AE list cve Open VEX CycloneDX VEX protobom/ sbom-convert SPDX2.2 Manifest update SPDX version SPDX2.3 Download cache Remove some fields Fix CycloneDX CycloneDX 1.5 SPDX2.3 Fixed CycloneDX1.5 START END Manufacturer CISA KEV ENISA API 42

Comparison and Proposal of Vulnerability Manage...

Comparison and Proposal of Vulnerability Management Approaches in Yocto-Based Linux for the EU CRA

More Decks by Linux Foundation Japan

Other Decks in Technology

Featured

Transcript