Scanning COS images with Oval vulnerability feed

COS provides an Open Vulnerability and Assessment Language (OVAL) vulnerability feed, which is a structured, machine-readable dataset for all supported COS releases. You can use the feed to evaluate packages installed on a COS system for security issues.

You can access the OVAL feed at gs://cos-oval-vulnerability-feed. The feed depends on the cos-package-info.json file, which lists installed packages on an image. This file is located at /etc directory on your VM instances.

Scanning COS VM instances with Oval feed

You can use the OVAL feed to scan any COS instance. For example, assume you want to scan an instance running the COS-109 image:

  1. Download the Oval feed for your instance. Make sure you choose the correct milestone. For the current example, it is 109:

    gcloud storage cp gs://cos-oval-vulnerability-feed/cos-109.oval.xml.tar.gz .

  2. Extract the downloaded Oval feed:

    tar xf cos-109.oval.xml.tar.gz

  3. Copy cos-package-info.json from your VM instance, in this case my-cos-instance:

    gcloud compute scp my-cos-instance:/etc/cos-package-info.json .

  4. Use your preferred Security Content Automation Protocol (SCAP) compliant tool that can process Oval feed. In this case, we use OpenSCAP:

    oscap oval eval --report report.html cos-109.oval.xml

Note that the cos-package-info.json file and the COS Oval feed need to be in the same directory. If not, update the path of the cos-package-info.json in the COS Oval feed file.

How to fix vulnerabilities reported by the scanner

The feed lists all the vulnerabilities fixed in the latest COS image. As such, you can fix all open vulnerabilities reported by the scanner on your system by updating to the latest COS image for that particular milestone.