Ignore Go compiler affecting CVE when Docker image only contains a binary compiled with Go

[sunwhawhang]

What happened:
Related to bug reported in #1370, quay.io/calico/kube-controllers:v3.20.0 image does not have Go compiler but only contains a binary that was compiled with the Go compiler and statically linked against the Go runtime library.

The issue was fixed in anchore/syft#2195, however, now it's reporting false positive CVE's that only affect to Go compiler itself: CVE-2023-29402, CVE-2023-29404 and CVE-2023-29405:

❯ grype quay.io/calico/kube-controllers:v3.20.0 -q | grep -E '29402|29403|29404|29405'
stdlib                               go1.15.2                                                                               go-module  CVE-2023-29405       Critical  
stdlib                               go1.15.2                                                                               go-module  CVE-2023-29404       Critical  
stdlib                               go1.15.2                                                                               go-module  CVE-2023-29402       Critical  
stdlib                               go1.15.2                                                                               go-module  CVE-2023-29403       High    

What you expected to happen:
It should only report CVE-2023-29403 since that's the only vulnerability that affects the runtime library:

❯ grype quay.io/calico/kube-controllers:v3.20.0 -q | grep -E '29402|29403|29404|29405'
stdlib                               go1.15.2                                                                               go-module  CVE-2023-29403       High    

How to reproduce it (as minimally and precisely as possible):
Run

grype quay.io/calico/kube-controllers:v3.20.0 -q | grep -E '29402|29403|29404|29405'

Anything else we need to know?:

Environment:

• Output of grype version:

  Application:         grype
  Version:             0.74.7
  BuildDate:           2024-02-26T18:24:14Z
  GitCommit:           987238519b8d6e302130ab715f20daed6634da68
  GitDescription:      v0.74.7
  Platform:            linux/amd64
  GoVersion:           go1.21.7
  Compiler:            gc
  Syft Version:        v0.105.1
  Supported DB Schema: 5
  

• OS (e.g: cat /etc/os-release or similar):

  NAME="Ubuntu"
  VERSION="18.04.5 LTS (Bionic Beaver)"
  ID=ubuntu
  ID_LIKE=debian
  PRETTY_NAME="Ubuntu 18.04.5 LTS"
  VERSION_ID="18.04"
  HOME_URL="https://www.ubuntu.com/"
  SUPPORT_URL="https://help.ubuntu.com/"
  BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
  PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
  VERSION_CODENAME=bionic
  UBUNTU_CODENAME=bionic
  

[wagoodman]

We don't have clear agreement on the team that CVE-2023-29402, CVE-2023-29404 and CVE-2023-29405 are false positives. Though these CVEs are not for the stdlib, the binary itself was compiled with the affected compiler. From a risk perspective, there is a non zero risk that the payload may have been modified based on those specific vulnerabilities. Someone might want to take note of these cases and replace assets with new builds from compilers that are not affected by those CVEs.

But! that being said, we also see the point that the package is for stdlib and it would be nice to know if the asset itself either contains the vulnerable code or not (which is less paranoid than if the binary was touched by an affected compiler).

I think it would be ideal to use the go vuln data to annotate the grype matches with affected golang packages and symbols. In this way you can use the grype report as a way to partition the golang vulns into "cmd/go" and "stdlib" CVEs.

If we think this is a good idea, I think we a proposal on how to best change the grype JSON output (and maybe table output) to make this apparent.

[willmurphyscode]

That is now what happens!

$ grype quay.io/calico/kube-controllers:v3.20.0 -q | grep -E '29402|29403|29404|29405|GO-2023-1840|NAME'
NAME                                 INSTALLED                                           FIXED IN                           TYPE       VULNERABILITY        SEVERITY  EPSS           RISK
stdlib                               go1.15.2                                            *1.19.10, 1.20.5                   go-module  GO-2023-1840         High      0.4% (34th)    0.3

Or if you want to only see CVEs (instead of the GO-2023-1840):

$ grype --by-cve quay.io/calico/kube-controllers:v3.20.0 -q | grep -E '29402|29403|29404|29405|GO-2023-1840|NAME'
NAME                                 INSTALLED                                           FIXED IN                           TYPE       VULNERABILITY        SEVERITY  EPSS           RISK
stdlib                               go1.15.2                                            *1.19.10, 1.20.5                   go-module  CVE-2023-29403       High      0.4% (34th)    0.3