Kernel Cve Analysis

---
name: kernel-cve-analysis
description: Query the Android/AOSP kernel CVE database to look up a specific CVE, find CVEs affecting a kernel version or build date, find unpatched CVEs in a branch, or identify exploitable vulnerabilities. Use this skill when the user asks about Android kernel CVEs, AOSP kernel vulnerabilities, which CVEs affect a kernel version/branch/build, whether a kernel is patched, or which vulnerabilities are exploitable. Trigger for phrases like "CVEs in kernel 5.10", "is android13-5.15 patched", "exploitable CVEs in <branch>", or "look up CVE-2024-XXXXX".
---

# Android Kernel CVE Analysis

This skill queries the remote Dr. Binary MCP server's Android/AOSP kernel CVE database. It helps determine which kernel vulnerabilities affect a given version, build date, or branch — and which are actually exploitable (bug-inducing code present *and* fix absent).

## When to Use This Skill

Use this skill when the user wants to:
- Look up details for a specific CVE (affected versions, fix, bug-inducing commit, branches)
- Enumerate CVEs affecting a specific AOSP kernel version
- Find CVEs affecting a kernel built at a specific date
- Find unpatched CVEs in a specific branch
- Identify exploitable CVEs for a branch at a point in time
- Browse the CVE database

## Available Tools (remote MCP)

| Tool | Use it when… | Arguments |
| --- | --- | --- |
| `get_cve_info` | The user names a specific CVE | `cve_id` (e.g. `"CVE-2024-12345"`) |
| `query_cves_by_version` | "Which CVEs affect kernel `<version>`?" | `aosp_version`, `limit?` (default 100) |
| `query_cves_by_date` | "Which CVEs affect a kernel built on `<date>`?" | `commit_date`, `limit?` (default 100) |
| `query_cves_by_branch` | "Which CVEs are unpatched in `<branch>`?" | `branch`, `limit?` (default 100) |
| `find_exploitable_cves` | "Which CVEs are exploitable in `<branch>` as of `<date>`?" | `commit_date`, `branch`, `limit?` (default 50) |
| `list_all_cves` | "Show me the CVEs in the database" | `limit?` (default 100) |

### Notes on each tool

- **`get_cve_info`** — returns a formatted report with type, severity, subcomponent, fixed-in version, affected version ranges, fix commits, and bug-inducing commits.
- **`query_cves_by_version`** — all CVEs affecting a specific AOSP kernel version (e.g. `5.10`, `5.15`).
- **`query_cves_by_date`** — CVEs affecting a kernel built at a specific commit date.
- **`query_cves_by_branch`** — unpatched CVEs in a branch (fixes not yet present in that branch).
- **`find_exploitable_cves`** — the flagship query: vulnerabilities present in a branch at a specific time where both the bug-inducing code exists *and* the fix is absent. Requires **both** `commit_date` and `branch`.
- **`list_all_cves`** — enumerate the database with basic info.

## Workflow

1. **Pick the right tool** from the table above based on what the user gives you (a CVE id, a version, a date, a branch, or a branch+date pair).
2. **For exploitability questions**, you need both a branch and a date. If the user supplied only one, ask for the other before calling `find_exploitable_cves`.
3. **Call the tool** and summarize results: highlight severity, affected ranges, and patch status.
4. **Drill down** into individual CVEs with `get_cve_info` when the user wants details on a specific result.

## Output Format

When reporting results, prefer a concise table (CVE id, severity, subcomponent, affected range / patch status) followed by a short narrative for the most important findings, and call out any exploitable CVEs explicitly.