  In vulnerability assessments, software component-based CVE attribution is a
common method to identify possibly vulnerable systems at scale. However, such
version-centric approaches yield high false-positive rates for binary
distributed Linux kernels in firmware images. Not filtering included vulnerable
components is a reason for unreliable matching, as heterogeneous hardware
properties, modularity, and numerous development streams result in a plethora
of vendor-customized builds. To make a step towards increased result
reliability while retaining scalability of the analysis method, we enrich
version-based CVE matching with kernel-specific build data from binary images
using automated static firmware analysis. We open source an attribution
pipeline that gathers kernel configuration and target architecture to dry build
the present kernel version and filter CVEs based on affected file references in
record descriptions. In a case study with 127 router firmware images, we show
that in comparison to naive version matching, our approach identifies 68% of
all version CVE matches as false-positives and reliably removes them from the
result set. For 12% of all matches it provides additional evidence of issue
applicability. For 19.4%, our approach does not improve reliability because
required file references in CVEs are missing.
