Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

update article with linux kernel vulns info (#32022)

Browse Source 
> Closes #31215
This commit is contained in:
Jahziel Villasana-Espinoza
2025-08-19 09:28:20 +09:00
committed by GitHub
parent 8246fa4fe2
commit 3c49123205
1 changed files with 7 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
articles/vulnerability-processing.md
+7 -3
View File
@@ -1,6 +1,6 @@
# Vulnerability processing
Vulnerability processing in Fleet detects vulnerabilities (CVEs) for the software installed on your hosts.
Vulnerability processing in Fleet detects vulnerabilities (CVEs) for the software installed on your hosts.
To see what software is covered, check out the [Coverage section](#coverage).
@@ -23,9 +23,13 @@ Fleet detects vulnerabilities for these software types:
Currently, only software names with all ASCII characters are supported. Vulnerabilities won't be detected for software with names featuring non-ASCII characters, such as Cyrillic, or software that has been renamed from its default name (e.g. "Chrome 2" instead of "Google Chrome"). For some software, Fleet uses [custom rules](https://github.com/fleetdm/fleet/blob/main/server/vulnerabilities/nvd/cpe_translations.json) to mitigate these issues on an app-by-app basis.
For Ubuntu Linux, kernel vulnerabilities with known variants (ie. `-generic`) are detected using OVAL. Custom kernels (unknown variants) are detected using NVD.
If you find that Fleet is incorrectly marking software as vulnerable (false positive) or missing a vulnerability (false negative), please file a [bug](https://github.com/fleetdm/fleet/issues/new?template=bug-report.md). When false positives are fixed, it may take two hours for the false positive to disappear after upgrading Fleet.
If you find that Fleet is incorrectly marking software as vulnerable (false positive) or missing a vulnerability (false negative), please file a [bug](https://github.com/fleetdm/fleet/issues/new?template=bug-report.md). When false positives are fixed, it may take two hours for the false positive to disappear after upgrading Fleet.
### Linux kernels
For Ubuntu, Debian, and Amazon Linux, kernel vulnerabilities with known variants (ie. `-generic` or `kernel`) are detected using OVAL. Custom kernels (unknown variants) are detected using NVD.
Linux kernel vulnerabilities are surfaced as OS-level vulnerabilities in the **Software > OS** page. Fleet shows the total number of vulnerability occurences across all hosts.
## Sources