--- title: Security Record layout: base permalink: /security-track-record/ ---

gVisor Security Record

{% assign legend_cves = site.data['cve-track-record'].cves %} {% assign total_defended = 0 %} {% assign total_patched = 0 %} {% assign total_mitigatable = 0 %} {% assign total_vulnerable = 0 %} {% for item in legend_cves %} {% if item.exploitable_under_gvisor %} {% if item.patched == "PATCHED" %} {% assign total_patched = total_patched | plus: 1 %} {% elsif item.patched == "EXTERNAL_MITIGATION_REQUIRED" %} {% assign total_mitigatable = total_mitigatable | plus: 1 %} {% else %} {% assign total_vulnerable = total_vulnerable | plus: 1 %} {% endif %} {% else %} {% assign total_defended = total_defended | plus: 1 %} {% endif %} {% endfor %} {% assign legend_total = legend_cves | size %} {% assign pct_defended = total_defended | times: 100.0 | divided_by: legend_total | round %} {% assign pct_patched = total_patched | times: 100.0 | divided_by: legend_total | round %} {% assign pct_mitigatable = total_mitigatable | times: 100.0 | divided_by: legend_total | round %} {% assign pct_vulnerable = total_vulnerable | times: 100.0 | divided_by: legend_total | round %}

Vulnerabilities Defended by Year

An overview of high-impact Linux kernel vulnerabilities mitigated by gVisor over time.

Defended ({{ pct_defended }}%)
Patched ({{ pct_patched }}%)
Mitigatable ({{ pct_mitigatable }}%)
Vulnerable ({{ pct_vulnerable }}%)
{% assign valid_cves = site.data['cve-track-record'].cves %} {% assign grouped_cves = valid_cves | group_by_exp: "item", "item.date | slice: 0, 4" %} {% comment %} Current year + day-of-year (assuming 365-day years) for the ghost extrapolation. {% endcomment %} {% assign current_year = site.time | date: "%Y" %} {% assign day_of_year = site.time | date: "%j" | plus: 0 %} {% assign max_cves = 1 %} {% for group in grouped_cves %} {% assign group_size = group.items | size %} {% if group.name == current_year %} {% assign group_projected = group_size | times: 365.0 | divided_by: day_of_year | round %} {% assign group_days_remaining = 365 | minus: day_of_year %} {% assign group_projected_scaled = group_projected | times: 100 %} {% assign group_actual_threshold = group_size | times: 115 %} {% comment %} Only let the projection drive the scale when it is shown: >= 2 months left and >= 15% above the actual count. {% endcomment %} {% if group_projected_scaled >= group_actual_threshold and group_days_remaining >= 61 %} {% assign group_size = group_projected %} {% endif %} {% endif %} {% if group_size > max_cves %} {% assign max_cves = group_size %} {% endif %} {% endfor %} {% assign max_cves_float = max_cves | times: 1.0 %} {% for group in grouped_cves %} {% assign total = group.items | size %} {% assign saved_count = 0 %} {% assign patched_count = 0 %} {% assign mitigated_count = 0 %} {% assign vulnerable_count = 0 %} {% for item in group.items %} {% if item.exploitable_under_gvisor %} {% if item.patched == "PATCHED" %} {% assign patched_count = patched_count | plus: 1 %} {% elsif item.patched == "EXTERNAL_MITIGATION_REQUIRED" %} {% assign mitigated_count = mitigated_count | plus: 1 %} {% else %} {% assign vulnerable_count = vulnerable_count | plus: 1 %} {% endif %} {% else %} {% assign saved_count = saved_count | plus: 1 %} {% endif %} {% endfor %} {% assign total_percentage = total | times: 100.0 | divided_by: max_cves_float %} {% assign is_current_year = false %} {% assign projected = 0 %} {% assign projected_percentage = 0 %} {% if group.name == current_year %} {% assign projected = total | times: 365.0 | divided_by: day_of_year | round %} {% assign days_remaining = 365 | minus: day_of_year %} {% assign projected_scaled = projected | times: 100 %} {% assign actual_threshold = total | times: 115 %} {% comment %} Suppress the extrapolation when the year is nearly over (< 2 months left) or the projection is within 15% of the actual count. {% endcomment %} {% if projected_scaled >= actual_threshold and days_remaining >= 61 %} {% assign is_current_year = true %} {% assign projected_percentage = projected | times: 100.0 | divided_by: max_cves_float %} {% endif %} {% endif %} {% assign saved_ratio = saved_count | times: 100.0 | divided_by: total %} {% assign patched_ratio = patched_count | times: 100.0 | divided_by: total %} {% assign mitigated_ratio = mitigated_count | times: 100.0 | divided_by: total %} {% assign vulnerable_ratio = vulnerable_count | times: 100.0 | divided_by: total %}
{% if is_current_year %}
~{{ projected }}
{% endif %}
{{ saved_count }}/{{ total }}
{{ group.name }}
{% endfor %}

Vulnerability Defense Database

This curated record is not a comprehensive list of all vulnerabilities, but focuses on high-impact CVEs relevant to production Kubernetes environments, specifically tracking critical threats highlighted in official Google Kubernetes Engine (GKE) security bulletins.

{% for group in grouped_cves %}
{% assign quarter_groups = group.items | group_by_exp: "item", "item.date | slice: 5, 2 | plus: 2 | divided_by: 3 | prepend: 'Q'" %} {% for q_group in quarter_groups %}
{% for item in q_group.items %}
{% if item.cve != nil and item.cve != '' %} {{ item.cve }} {% else %} No CVE assigned {% endif %} {% if item.cvss != nil %} {% comment %} CVSS chip: 11-color green→yellow→orange→red palette indexed by the rounded score (0-10), with a per-swatch readable text color. {% endcomment %} {% assign cvss_index = item.cvss | round %} {% if cvss_index < 0 %}{% assign cvss_index = 0 %}{% endif %} {% if cvss_index > 10 %}{% assign cvss_index = 10 %}{% endif %} {% assign cvss_bg_palette = "#2f6b4d,#3d8a5e,#82b481,#b9cf94,#d8e0a6,#eee9c2,#e8d3a2,#e0ad82,#d07a5e,#c0564d,#9c4a48" | split: "," %} {% assign cvss_fg_palette = "#ffffff,#ffffff,#333333,#333333,#333333,#333333,#333333,#333333,#ffffff,#ffffff,#ffffff" | split: "," %} {{ item.cvss }} {% endif %}
{% if item.exploitable_under_gvisor %} {% if item.patched == "PATCHED" %} Patched {% elsif item.patched == "EXTERNAL_MITIGATION_REQUIRED" %} External mitigation required {% else %} Vulnerable {% endif %} {% else %} Defended {% endif %}
{% comment %} Render markdown-style `backticks` as monospace. Segments between paired backticks (odd split indices) become . {% endcomment %} {% assign desc_parts = item.description | split: '`' %} {% capture rendered_description %}{% for desc_part in desc_parts %}{% assign part_parity = forloop.index0 | modulo: 2 %}{% if part_parity == 1 %}{{ desc_part }}{% else %}{{ desc_part }}{% endif %}{% endfor %}{% endcapture %}

{{ rendered_description }}

{% if item.exploitable_under_gvisor and item.mitigation_gap != nil and item.mitigation_gap != '' %}
Mitigation Gap: {{ item.mitigation_gap }}
{% endif %} {% if item.exploitable_under_gvisor and item.vm_prevented != nil %}
VM Runtime Prevented: {% if item.vm_prevented %}Yes{% else %}No{% endif %}
{% endif %}
Escalation Vector: {{ item.risk }}
Scope: {{ item.scope }}
{% endfor %}
{% endfor %}
{% endfor %}