kernel-cve-analysis

Android Kernel CVE Analysis

This skill queries the remote Dr. Binary MCP server's Android/AOSP kernel CVE database. It helps determine which kernel vulnerabilities affect a given version, build date, or branch — and which are actually exploitable (bug-inducing code present and fix absent).

When to Use This Skill

Use this skill when the user wants to:

• Look up details for a specific CVE (affected versions, fix, bug-inducing commit, branches)
• Enumerate CVEs affecting a specific AOSP kernel version
• Find CVEs affecting a kernel built at a specific date
• Find unpatched CVEs in a specific branch
• Identify exploitable CVEs for a branch at a point in time
• Browse the CVE database

Available Tools (remote MCP)

Tool	Use it when…	Arguments
get_cve_info	The user names a specific CVE	cve_id (e.g. "CVE-2024-12345")
query_cves_by_version	"Which CVEs affect kernel <version>?"	aosp_version, limit? (default 100)
query_cves_by_date	"Which CVEs affect a kernel built on <date>?"	commit_date, limit? (default 100)
query_cves_by_branch	"Which CVEs are unpatched in <branch>?"	branch, limit? (default 100)
find_exploitable_cves	"Which CVEs are exploitable in <branch> as of <date>?"	commit_date, branch, limit? (default 50)
list_all_cves	"Show me the CVEs in the database"	limit? (default 100)

Notes on each tool

• get_cve_info — returns a formatted report with type, severity, subcomponent, fixed-in version, affected version ranges, fix commits, and bug-inducing commits.
• query_cves_by_version — all CVEs affecting a specific AOSP kernel version (e.g. 5.10, 5.15).
• query_cves_by_date — CVEs affecting a kernel built at a specific commit date.
• query_cves_by_branch — unpatched CVEs in a branch (fixes not yet present in that branch).
• find_exploitable_cves — the flagship query: vulnerabilities present in a branch at a specific time where both the bug-inducing code exists and the fix is absent. Requires both commit_date and branch.
• list_all_cves — enumerate the database with basic info.

Workflow

1. Pick the right tool from the table above based on what the user gives you (a CVE id, a version, a date, a branch, or a branch+date pair).
2. For exploitability questions, you need both a branch and a date. If the user supplied only one, ask for the other before calling find_exploitable_cves.
3. Call the tool and summarize results: highlight severity, affected ranges, and patch status.
4. Drill down into individual CVEs with get_cve_info when the user wants details on a specific result.

Output Format

When reporting results, prefer a concise table (CVE id, severity, subcomponent, affected range / patch status) followed by a short narrative for the most important findings, and call out any exploitable CVEs explicitly.