Android Kernel CVE Analysis
This skill queries the remote Dr. Binary MCP server's Android/AOSP kernel CVE database. It helps determine which kernel vulnerabilities affect a given version, build date, or branch — and which are actually exploitable (bug-inducing code present and fix absent).
When to Use This Skill
Use this skill when the user wants to:
- Look up details for a specific CVE (affected versions, fix, bug-inducing commit, branches)
- Enumerate CVEs affecting a specific AOSP kernel version
- Find CVEs affecting a kernel built at a specific date
- Find unpatched CVEs in a specific branch
- Identify exploitable CVEs for a branch at a point in time
- Browse the CVE database
Available Tools (remote MCP)
| Tool |
Use it when… |
Arguments |
get_cve_info |
The user names a specific CVE |
cve_id (e.g. "CVE-2024-12345") |
query_cves_by_version |
"Which CVEs affect kernel <version>?" |
aosp_version, limit? (default 100) |
query_cves_by_date |
"Which CVEs affect a kernel built on <date>?" |
commit_date, limit? (default 100) |
query_cves_by_branch |
"Which CVEs are unpatched in <branch>?" |
branch, limit? (default 100) |
find_exploitable_cves |
"Which CVEs are exploitable in <branch> as of <date>?" |
commit_date, branch, limit? (default 50) |
list_all_cves |
"Show me the CVEs in the database" |
limit? (default 100) |
Notes on each tool
get_cve_info — returns a formatted report with type, severity, subcomponent, fixed-in version, affected version ranges, fix commits, and bug-inducing commits.query_cves_by_version — all CVEs affecting a specific AOSP kernel version (e.g. 5.10, 5.15).query_cves_by_date — CVEs affecting a kernel built at a specific commit date.query_cves_by_branch — unpatched CVEs in a branch (fixes not yet present in that branch).find_exploitable_cves — the flagship query: vulnerabilities present in a branch at a specific time where both the bug-inducing code exists and the fix is absent. Requires both commit_date and branch.list_all_cves — enumerate the database with basic info.
Workflow
- Pick the right tool from the table above based on what the user gives you (a CVE id, a version, a date, a branch, or a branch+date pair).
- For exploitability questions, you need both a branch and a date. If the user supplied only one, ask for the other before calling
find_exploitable_cves.
- Call the tool and summarize results: highlight severity, affected ranges, and patch status.
- Drill down into individual CVEs with
get_cve_info when the user wants details on a specific result.
Output Format
When reporting results, prefer a concise table (CVE id, severity, subcomponent, affected range / patch status) followed by a short narrative for the most important findings, and call out any exploitable CVEs explicitly.
1---2name: kernel-cve-analysis3description: Query the Android/AOSP kernel CVE database to look up a specific CVE, find CVEs affecting a kernel version or build date, find unpatched CVEs in a branch, or identify exploitable vulnerabilities. Use this skill when the user asks about Android kernel CVEs, AOSP kernel vulnerabilities, which CVEs affect a kernel version/branch/build, whether a kernel is patched, or which vulnerabilities are exploitable. Trigger for phrases like "CVEs in kernel 5.10", "is android13-5.15 patched", "exploitable CVEs in <branch>", or "look up CVE-2024-XXXXX".4---56# Android Kernel CVE Analysis78This skill queries the remote Dr. Binary MCP server's Android/AOSP kernel CVE database. It helps determine which kernel vulnerabilities affect a given version, build date, or branch — and which are actually exploitable (bug-inducing code present *and* fix absent).910## When to Use This Skill1112Use this skill when the user wants to:13- Look up details for a specific CVE (affected versions, fix, bug-inducing commit, branches)14- Enumerate CVEs affecting a specific AOSP kernel version15- Find CVEs affecting a kernel built at a specific date16- Find unpatched CVEs in a specific branch17- Identify exploitable CVEs for a branch at a point in time18- Browse the CVE database1920## Available Tools (remote MCP)2122| Tool | Use it when… | Arguments |23| --- | --- | --- |24| `get_cve_info` | The user names a specific CVE | `cve_id` (e.g. `"CVE-2024-12345"`) |25| `query_cves_by_version` | "Which CVEs affect kernel `<version>`?" | `aosp_version`, `limit?` (default 100) |26| `query_cves_by_date` | "Which CVEs affect a kernel built on `<date>`?" | `commit_date`, `limit?` (default 100) |27| `query_cves_by_branch` | "Which CVEs are unpatched in `<branch>`?" | `branch`, `limit?` (default 100) |28| `find_exploitable_cves` | "Which CVEs are exploitable in `<branch>` as of `<date>`?" | `commit_date`, `branch`, `limit?` (default 50) |29| `list_all_cves` | "Show me the CVEs in the database" | `limit?` (default 100) |3031### Notes on each tool3233- **`get_cve_info`** — returns a formatted report with type, severity, subcomponent, fixed-in version, affected version ranges, fix commits, and bug-inducing commits.34- **`query_cves_by_version`** — all CVEs affecting a specific AOSP kernel version (e.g. `5.10`, `5.15`).35- **`query_cves_by_date`** — CVEs affecting a kernel built at a specific commit date.36- **`query_cves_by_branch`** — unpatched CVEs in a branch (fixes not yet present in that branch).37- **`find_exploitable_cves`** — the flagship query: vulnerabilities present in a branch at a specific time where both the bug-inducing code exists *and* the fix is absent. Requires **both** `commit_date` and `branch`.38- **`list_all_cves`** — enumerate the database with basic info.3940## Workflow41421. **Pick the right tool** from the table above based on what the user gives you (a CVE id, a version, a date, a branch, or a branch+date pair).432. **For exploitability questions**, you need both a branch and a date. If the user supplied only one, ask for the other before calling `find_exploitable_cves`.443. **Call the tool** and summarize results: highlight severity, affected ranges, and patch status.454. **Drill down** into individual CVEs with `get_cve_info` when the user wants details on a specific result.4647## Output Format4849When reporting results, prefer a concise table (CVE id, severity, subcomponent, affected range / patch status) followed by a short narrative for the most important findings, and call out any exploitable CVEs explicitly.
DeepBitsTechnology