SBOMproof：超越所谓的SBOM合规性，保障容器镜像的供应链安全
SBOMproof: Beyond Alleged SBOM Compliance for Supply Chain Security of Container Images
AI总结：
本研究评估了SBOM生成与漏洞扫描工具的互操作性，发现其不兼容导致漏洞漏报，并揭示了SBOM混淆漏洞，强调需提升SBOM准确性以保障容器供应链安全。
摘要：
供应链安全对于在云端大规模运行的现代应用极为重要。事实上，这些应用涉及大量异构微服务，其中也包括第三方软件。因此，安全漏洞在攻击者开始积极利用之前很难被识别和缓解。为此，各国政府最近出台了网络安全法规，要求供应商与最终用户或监管机构共享软件物料清单（SBOM）。只要SBOM准确且在不同工具间具有互操作性，即使无法访问软件组件的源代码，也可以利用它来识别该组件的安全漏洞。本研究通过对SBOM生成和漏洞扫描工具（包括开源软件和主要云服务提供商的云服务）进行全面评估来探讨这一问题。我们特别针对软件容器，并聚焦于Linux发行版中广泛用作基础镜像的操作系统包，因为这些包具有深远的安全影响。我们的研究结果表明，所考察的工具在很大程度上互不兼容，导致报告不准确以及大量未检测到的漏洞。我们揭示了SBOM混淆漏洞，这是这种碎片化生态系统的副产品，其中不一致的格式阻碍了跨工具可靠地进行漏洞检测。
英文摘要：
Supply chain security is extremely important for modern applications running at scale in the cloud. In fact, they involve a large number of heterogeneous microservices that also include third-party software. As a result, security vulnerabilities are hard to identify and mitigate before they start being actively exploited by attackers. For this reason, governments have recently introduced cybersecurity regulations that require vendors to share a software bill of material (SBOM) with end users or regulators. An SBOM can be employed to identify the security vulnerabilities of a software component even without access to its source code, as long as it is accurate and interoperable across different tools. This work evaluates this issue through a comprehensive study of tools for SBOM generation and vulnerability scanning, including both open-source software and cloud services from major providers. We specifically target software containers and focus on operating system packages in Linux distributions that are widely used as base images due to their far-reaching security impact. Our findings show that the considered tools are largely incompatible, leading to inaccurate reporting and a large amount of undetected vulnerabilities. We uncover the SBOM confusion vulnerability, a byproduct of such fragmented ecosystem, where inconsistent formats prevent reliable vulnerability detection across tools.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
