How to Check CVEs and Vulnerabilities in a Yocto Image

Yocto can check known CVEs for the recipes used to build an image. The useful workflow is:

  1. Enable the Yocto CVE checker.
  2. Build the image and read the generated report.
  3. Record the package version, CVE, status, and fix.
  4. Verify the final device image separately.

1) Enable CVE checking

Add this to build/conf/local.conf:

INHERIT += "cve-check"

# Optional: fail the build when an unresolved CVE is found.
# CVE_CHECK_DEFAULT_WHITELIST = "CVE-2024-0000"
# CVE_CHECK_IGNORE = "CVE-2024-0000"

Do not ignore a CVE just to make the build pass. Use an ignore entry only after checking that the issue does not affect the target, or that a documented mitigation exists.

2) Build the image

Run the normal image build. Replace core-image-minimal with your image recipe:

source oe-init-build-env build
bitbake core-image-minimal

To run the task explicitly for a recipe:

bitbake -c cve_check busybox

Find the generated CVE reports and logs:

find tmp -type f \( -iname '*cve*' -o -iname '*cve*json*' \) -print

The exact path depends on the Yocto release and configuration. Common locations are under tmp/deploy/cve/ and tmp/log/cve/.

3) Read the result

The report normally contains the recipe or package name, installed version, CVE identifier, severity, and a status such as Patched, Unpatched, or Ignored.

Useful commands for inspecting recipe versions and metadata are:

# Show the version selected for a recipe
bitbake -e openssl | grep -E '^(PV|PN|SRC_URI)='

# List packages known to the build's package data
oe-pkgdata-util list-pkgs | sort

# Show files belonging to one package
oe-pkgdata-util list-pkg-files openssl

The CVE checker is recipe-based. It may report a vulnerability for a recipe that is not installed in the final image, so compare the result with the image package list before treating it as a product finding.

4) Create a simple vulnerability log

Keep a reviewable log in your build artifacts or security issue tracker:

Package       Version       CVE             Severity  Status     Action
openssl       3.2.1         CVE-2024-5535   High      Unpatched  Upgrade recipe
busybox       1.36.1        CVE-2023-42364  Medium    Patched    Confirm patch
zlib          1.3.1         CVE-2023-45853  High      Ignored    Not affected on target

For every Unpatched result, check the upstream advisory and the Yocto recipe before deciding whether to upgrade, backport a patch, or apply a documented mitigation.

5) Verify packages on the target

The final root filesystem is the source of truth. On a running device, list installed packages using the package manager included in the image:

# RPM images
rpm -qa | sort

# Debian images
dpkg-query -W -f='${Package}\t${Version}\n' | sort

# IPK images
opkg list-installed | sort

Save the output with the firmware version, build ID, and scan date. Then compare those package names and versions with the CVE report. This catches differences caused by image features, package recommendations, and post-build changes.

6) Keep the database current

CVE results are only as current as the vulnerability database and recipe metadata. Update your Yocto layers and rebuild the CVE database regularly:

bitbake-layers show-layers
bitbake-layers show-recipes openssl
bitbake -c cve_check core-image-minimal

For release evidence, archive the CVE report, package list, build configuration, source revision, and the final image checksum together.

Quick checklist

  • Enable cve-check in the build configuration.
  • Build the exact image shipped to the device.
  • Review both Unpatched and Ignored findings.
  • Match CVE results against packages installed in the final image.
  • Save package name, version, CVE, severity, status, and action as a log.
  • Re-scan after layer, recipe, or image changes.