CVE bin tool integration, VEX support -> F20 replacement

[m-1-k-3]

• What kind of change does this PR introduce? (Bug fix, feature, docs update, ...)

Feature

• What is the current behavior? (You can also link to an open issue here)

F20 quite slow
No VEX support

• What is the new behavior (if this is a feature change)? If possible add a screenshot.

• cve-bin-tool main integration - closes cve-bin-tool supported #1439
• temp patching of cve-bin-tool (see https://github.com/EMBA-support-repos/cve-bin-tool)
• installer integration
• build new docker base image
• JSON builder for VEX
• s118 integration
• s26 fixes and integration
• VEX integration into main SBOM
• Make our VEX BSI compliant
• further VEX and F17 configuration via scan profiles (enable/disable addon metrics like EPSS, KEV, Exploits)
• remove F20 completely
• os_detector function from F50 is based on F20 results
• s36 module is based on F20

• Does this PR introduce a breaking change? (What changes might users need to make in their application due to this PR?)

This will replace the current F20 module

• Other information:

docker base image 1.5.1d needed
Currently work in progress
read only filesystem of our current docker base image is currently not working with cve-bin-tool

[m-1-k-3]

initial test results:

[*] Tue Feb  4 08:44:38 CET 2025 - F17_cve_bin_tool starting
[*] Tue Feb  4 09:20:07 CET 2025 - F17_cve_bin_tool finished
[*] Tue Feb  4 09:20:07 CET 2025 - F20_vul_aggregator starting
[*] Tue Feb  4 11:00:00 CET 2025 - F20_vul_aggregator finished

35minutes vs 1h:40minutes ... Feel free to test

[m-1-k-3]

VEX data can be viewed in the SBOM directory:

└─$ jq . ~/firmware-analysis/emba_logs_test1/SBOM/EMBA_sbom_vex_only.json

Currently it is not integrated into the final SBOM. Will come soon.

[m-1-k-3]

I think everything is in place to find further bugs ... please give it a try @BenediktMKuehne @beruhan @torabi12 @hands0meware @busby666 and others :)

[m-1-k-3]

The main performance boost can be seen if you enable/disable the VEX_METRICS parameter in the scan profiles:

• VEX_METRICS=1:

[*] Tue Feb 11 22:08:08 CET 2025 - F17_cve_bin_tool starting
[*] Tue Feb 11 22:18:22 CET 2025 - F17_cve_bin_tool finished
[!] Tue Feb 11 22:18:27 CET 2025 - Test ended on Tue Feb 11 22:18:27 CET 2025 and took about 0 days and 00:19:32 

• VEX_METRICS=0:

[*] Tue Feb 11 21:37:16 CET 2025 - F17_cve_bin_tool starting
[*] Tue Feb 11 21:38:53 CET 2025 - F17_cve_bin_tool finished
[!] Tue Feb 11 21:38:55 CET 2025 - Test ended on Tue Feb 11 21:38:55 CET 2025 and took about 0 days and 00:07:43 

On the other hand you will loose all the exploit details.

[m-1-k-3]

let's review this and bring it to master :) VEX SBOM and cve-bin-tool ahead ...

[torabi12]

I did an installation and it was perfect and did a default-scan.emba with an older DVR firmware from here:

https://www.up-4ever.net /ecs3xzneqmnw/Firmware_DVR_8CH_China_AHB6008R-MS_8MB.rar

VEX data was available in the report.
Thank you for the great update of emba. :)

The entire scan lasted for 00:27:08, super fast!

[m-1-k-3]

@torabi12 thank you for your testing effort