Checking Device Sensors for Common Vulnerabilities and Exposures (CVEs)

Stellar Cyber sensors include a built-in CVE Checker that lets you check a device sensor's underlying operating system and installed packages against a set of known CVEs, directly from the CLI. This lets your security team assess exposure and apply available remediations without relying on third-party scanners or reaching out to Stellar Cyber Customer Success.

You run the CVE Checker using the exec cve command family from the Sensor CLI Access window or the sensor's local CLI. See the following sections for details:

• About the CVE Checker

• Supported CVEs

• exec cve summary

• exec cve check

• exec cve patch

• exec cve update

• Limitations

This feature has been verified on Modular Sensors running Ubuntu 22.04.

About the CVE Checker

The CVE Checker checks the sensor against CVEs that affect components of its underlying Ubuntu operating system, such as OpenSSH, the Linux kernel, snapd, and PackageKit. Each check reports a verdict of not vulnerable, vulnerable, or vulnerable but mitigated. CVEs that require an existing local foothold to exploit (rather than being reachable remotely) are called out with a Not Remotely Exploitable label so you can prioritize remote exposures first.

To determine patch status, the CVE Checker resolves patch data in the following order:

1. A live query to the Ubuntu Security API.

2. Locally cached patch data, if the live query is unavailable.

3. Hardcoded baseline data bundled with the CVE Checker.

Because of this fallback, the CVE Checker produces a result even on sensors with no internet access. Use exec cve update to refresh the CVE Checker (and its bundled baseline data) from your managing DP.

Supported CVEs

Run exec cve summary at any time to see the exact list of CVEs your sensor's CVE Checker currently supports; new CVEs can be added to the CVE Checker over time via exec cve update. As of this writing, the following CVEs are supported:

¹ CVE-2024-6387 has no CVE Checker-driven patch. Refer to Limitations.
² CVE-2026-43284 shares its kernel module remediation with CVE-2026-43500; patch either CVE to remediate both.

exec cve summary

Use exec cve summary to list every CVE the CVE Checker supports, along with its severity and a one-line description. For example:

Sensor> exec cve summary
Supported CVEs:
  CVE-2021-44228 (Critical 10.0)  Log4Shell — Apache Log4j2 JNDI RCE
  CVE-2023-48795 (Medium 5.9)     Terrapin — SSH prefix truncation (MITM)
  CVE-2024-6387 (Critical 8.1)    regreSSHion — sshd race condition RCE
  CVE-2024-39894 (High 7.5)       ObscureKeystrokeTiming — sshd keystroke timing leak
  CVE-2026-3888 (High 7.8)        snap-confine LPE to root [Not Remotely Exploitable]
  CVE-2026-31431 (High 7.8)       Copy Fail — kernel AF_ALG/authencesn LPE [Not Remotely Exploitable]
  CVE-2026-43284 (High 7.8)       Dirty Frag — kernel ESP/XFRM paged-frag LPE [Not Remotely Exploitable]
  CVE-2026-43500 (High 7.8)       Dirty Frag — kernel rxrpc paged-frag LPE [Not Remotely Exploitable]
  CVE-2026-35386 (High 8.1)       OpenSSH < 10.3 cluster (35385/86/87/88/414)
  CVE-2026-41651 (High)           PackageKit 1.0.2-1.3.4 privilege flaw [Not Remotely Exploitable]

exec cve check

Use exec cve check to run vulnerability checks. The syntax is as follows:

exec cve check {all | result | <CVE-ID>}

• all – Runs every supported CVE check in sequence and saves a combined JSON report to /var/log/aella/cve_scan_result.json on the sensor.

• <CVE-ID> – Runs the check for a single CVE (for example, CVE-2024-6387). Tab completion is available for supported CVE IDs.

• result – Displays the most recently saved JSON report without re-running any checks.

Run exec cve check ? (or any unsupported argument) to see the exact list of CVE IDs your sensor currently recognizes.

When run from the Sensor CLI Access window (remote CLI), exec cve check runs as a background job and returns a Job started banner immediately instead of printing output directly. Retrieve the result with show cli job; refer to Running Long-Duration CLI Commands for details. The example below shows the local CLI, where the command still runs synchronously and prints its banner directly.

Each check prints a banner reporting system information, the checks performed, and a final verdict. For example:

Sensor> exec cve check CVE-2021-44228
============================================================
CVE-2021-44228 (Log4Shell) — Apache Log4j2 RCE Checker
============================================================
── System Information
[INFO] OS               : Ubuntu 22.04.5 LTS
[INFO] Hostname         : modular200.4
[INFO] Date             : Sun May 17 18:05:58 UTC 2026
── Java Runtime Detection
[INFO] Java is NOT installed on this system
── Log4j Library Discovery
[INFO] Scanning filesystem for log4j-core-*.jar files...
[PASS] No log4j-core JAR files found on the system
============================================================
FINAL VERDICT
============================================================
NOT VULNERABLE
No Apache Log4j2 library found — system is not affected by Log4Shell.
Reference : https://nvd.nist.gov/vuln/detail/CVE-2021-44228
Confirmed : modular200.4 on 2026-05-17 18:05:59 UTC by Ubuntu Security
[INFO] Combined report: /var/log/aella/cve_scan_result.json
JSON report saved to /var/log/aella/cve_scan_result.json

Running exec cve check result displays the saved JSON report, which includes an overall_verdict for the sensor plus a per-CVE results array. Each entry's verdict field is one of not_vulnerable, vulnerable, vulnerable_mitigated, or vulnerable_not_remote_exploitable. For example (trimmed for length):

Sensor> exec cve check result
{
  "scanner_version": "1.0.0",
  "scan_date": "2026-05-17T18:05:35Z",
  "hostname": "modular200.4",
  "os": "Ubuntu 22.04.5 LTS",
  "overall_verdict": "vulnerable_mitigated",
  "results": [
    {
      "cve": "CVE-2021-44228",
      "verdict": "not_vulnerable",
      "java_installed": "not_found",
      "log4j_jars_found": 0,
      "vulnerable_jars": 0,
      "findings": []
    },
    {
      "cve": "CVE-2026-31431",
      "verdict": "vulnerable_mitigated",
      "kernel": "5.15.0-161-generic",
      "modules_present": true,
      "modprobe_state": "install_neutered",
      "af_alg_probe": "blocked",
      "findings": [
        "algif_aead and authencesn modules are present on disk",
        "Mitigated by modprobe configuration (install_neutered) — kernel itself remains unpatched"
      ]
    }
    // ...additional per-CVE entries omitted
  ]
}

exec cve patch

Use exec cve patch to apply an available remediation. Not every supported CVE has a patch available; refer to the Supported CVEs table to see which do. The syntax is as follows:

exec cve patch {all | <CVE-ID>}

Like exec cve check, exec cve patch runs as a background job when invoked from the Sensor CLI Access window (remote CLI) — this applies to both single-CVE and all patch runs. The CLI returns a Job started banner immediately; use show cli job to check progress and retrieve the final output. Refer to Running Long-Duration CLI Commands for details. Over the local CLI, the command still runs synchronously and prints its output directly, as shown in the local-CLI examples below.

• <CVE-ID> – Applies the remediation for a single patchable CVE. For example, from the local CLI:

  Sensor> exec cve patch CVE-2026-43500
  Patching CVE-2026-43500...
  Patch for CVE-2026-43500 applied successfully.

• all – Applies every available patch in sequence, continuing past any individual failure, and prints a summary at the end. For example, from the local CLI:

  Sensor> exec cve patch all
  ============================================================
  CVE patch summary
  ============================================================
  CVE-2026-41651   OK
  CVE-2026-35386   OK
  CVE-2026-43500   OK
  CVE-2026-31431   OK

From the Sensor CLI Access window, the same exec cve patch all command instead returns immediately, and you poll the job for progress and the final result:

modular200.4 > exec cve patch all
Job started: bf5aba8c5b224007ad6f8f0cc79380b0
Use 'show cli job bf5aba8c' to retrieve status and output.
modular200.4 > show cli job bf5aba8c
Job: bf5aba8c5b224007ad6f8f0cc79380b0
Command: exec cve patch all
Status: running
Started: 2026-05-25 03:37:55
Duration: 39s (still running)
--- Output ---
============================================================
Applying patch for CVE-2026-41651
============================================================
Patching CVE-2026-41651...
...

modular200.4 > show cli job bf5aba8c
Job: bf5aba8c5b224007ad6f8f0cc79380b0
Command: exec cve patch all
Status: success
Started: 2026-05-25 03:37:55
Finished: 2026-05-25 03:39:51
Duration: 1m56s
--- Output ---
...
============================================================
CVE patch summary
============================================================
CVE-2026-41651   OK
CVE-2026-35386   OK
CVE-2026-43500   OK
CVE-2026-31431   OK

Run exec cve patch ? to see the current list of patchable CVE IDs for your sensor.

exec cve update

Use exec cve update to download the latest version of the CVE Checker from your managing DP, which receives updates through the standard Stellar Cyber release pipeline. Run this command periodically to pick up newly added CVE checks. For example:

Sensor> exec cve update
Downloading cve-scanner.sh for sensor version 6.6.0_026a1e5 via http_sync
cve checker updated successfully (version=1.0.0).

Limitations

• The kernel-level LPEs (CVE-2026-31431, CVE-2026-43284, and CVE-2026-43500) are mitigated by blocking or unloading the vulnerable kernel module rather than by patching the kernel itself. The kernel remains unpatched until you perform a full kernel upgrade; refer to the exec os update kernel-and-package command for that.

• CVE-2024-6387 (regreSSHion) has no CVE Checker-driven patch. Remediation requires upgrading the openssh-server package through standard Ubuntu package management. The CVE Checker also checks the sshd LoginGraceTime setting as an additional mitigation, but does not change it automatically, since setting LoginGraceTime to 0 has its own trade-offs (it can expose sshd to a denial-of-service condition).

• Live patch lookups against the Ubuntu Security API require internet access from the sensor. Sensors without internet access still produce results using cached or hardcoded baseline data, as described in About the CVE Checker.