[petra303]

In my company, the security team isn’t technical. They see CVE, find a vulnerable system, it gets flagged. We have to patch it.

We patched for a CVE last week that a malicious usb sound card device could be use the gain root.

On a Vm? Is that something we really need to worry about??

[chelmzy]

Its the same at most orgs. Very rare for a vuln remediation program to utilize a truly risk based approach. They would have to trawl through and understand thousands of vulns and the context of your org. There's probably a market for some tool to accomplish this if the larger players haven't attempted already.

[lousken]

They see their dashboard, when the number is high, they want to get the number low as fast as possible. If the number is close to zero, they want to see zero. It is that simple.

They do not care if the issue is in a piece of code that is never executed and would require full access to the machine. It is there and tool X reports it.

Even security audits are terrible, when they don't find anything major they start reporting stuff that few percent of companies have implemented just to stuff their reports, it is ridiculous.

[simoneree]

On a headless VM, almost certainly it's not a worry, since that bug needs a physical port and the driver binding to a plugged-in device (so basically it's never reached). You could even prove it running lsmod showing the module is not loaded (so "not applicable"). Unfortunately the CVSS score doesn't carry reachability information, and not just for the kernel CVEs.

[dboreham]

It's asymmetric warfare. It costs them little to demand a false positive be acted upon, but costs you plenty to refute it.

[thewebguyd]

This is the rot that's happening in cybersec. Before we even had security teams as a dedicated role, sysadmins mostly handled security, and we would evaluate each CVE and determined if it even was applicable.

Then companies started hiring paper pushers into security roles and discretion no longer mattered, it just became a game of "Check the box" with no regard for what is actually running in prod, or whether you're actually vulnerable.

Same shit with auditors. I deal with PCI and it's a fight to explain why the "compensating controls" work to a non technical auditor. If it doesn't check the box exactly, good luck.