Embedded Open Source Summit 2023

When an embedded product is released, it is certain to contain vulnerabilities that can allow threat actors to abuse the device. A responsible provider proactively tracks and fixes these vulnerabilities before they are abused. Vulnerability databases, like CVE, publish them, but it would take an unrealistic amount of time to track every entry in the CVE database. Fortunately, embedded build systems provide some tools that make tracking of vulnerabilities easier. Arnout has used both Buildroot and OpenEmbedded (yocto) to develop products. This talk explains the various tools that either of them provide to track vulnerabilities, and what this means from a practical perspective as a product developer. Shortcomings in the flow are highlighted, with ideas of how the build systems and other tools can be improved to make life easier for the embedded developer.