# software dark matter

Software dark matter is the set of security-critical files in a software artifact that are unaccounted for by associated package metadata, creating visibility gaps for SBOM and security-scanning tools.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## How libuv CVE-2024-24806 can evade scanners and expose internal services

DevFeed: [How libuv CVE-2024-24806 can evade scanners and expose internal services](<https://devfeed.tech/articles/unpacking-libuv-s-cve-2024-24806-software-dark-matter-will-go-under-the-radar-not-in-chainguard-images-tho-13306.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/unpacking-libuvs-cve-2024-24806-software-dark-matter-will-go-under-the-radar-not-in-chainguard-images-tho>)

Published: 2024-02-16T00:00:00Z

Content type: opinion

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [software dark matter](<https://devfeed.tech/topics/software-dark-matter.md>), [Security](<https://devfeed.tech/topics/security.md>), [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Containers](<https://devfeed.tech/topics/containers.md>), [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>)

Tags: [container](<https://devfeed.tech/tags/container.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2024-24806](<https://devfeed.tech/tags/cve-2024-24806.md>), [false-negative](<https://devfeed.tech/tags/false-negative.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [libuv](<https://devfeed.tech/tags/libuv.md>), [sbom](<https://devfeed.tech/tags/sbom.md>), [security](<https://devfeed.tech/tags/security.md>), [security-research](<https://devfeed.tech/tags/security-research.md>), [software-dark-matter](<https://devfeed.tech/tags/software-dark-matter.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>)

### AI overview

The article examines CVE-2024-24806, a libuv vulnerability caused by hostname truncation without a terminating null byte when the hostname exceeds 256 characters. It explains how the flaw can enable SSRF and unauthorized access to internal APIs, including in multi-pod Kubernetes environments, and why vendored or bundled components may evade scanners and SBOM tools.

### Source excerpt

Uncover Chainguard's approach to detecting and neutralizing hidden threats like CVE-2024-24806 in container environments.

## Make SBOMs, not GuessBOMs: Why we need to shift left on SBOM generation

DevFeed: [Make SBOMs, not GuessBOMs: Why we need to shift left on SBOM generation](<https://devfeed.tech/articles/make-sboms-not-guessboms-why-we-need-to-shift-left-on-sbom-generation-13142.md>)

Original publisher: [Read original article](<https://www.chainguard.dev/unchained/make-sboms-not-guessboms-why-we-need-to-shift-left-on-sbom-generation>)

Published: 2023-01-26T00:00:00Z

Content type: article

Language: en

Sources: [Chainguard: Unchained](<https://devfeed.tech/sources/chainguard-unchained.md>)

Topics: [software bill of materials](<https://devfeed.tech/topics/software-bill-of-materials.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [software dark matter](<https://devfeed.tech/topics/software-dark-matter.md>), [vulnerability management](<https://devfeed.tech/topics/vulnerability-management.md>), [Reverse Engineering](<https://devfeed.tech/topics/reverse-engineering.md>), [Containers](<https://devfeed.tech/topics/containers.md>)

Tags: [apko](<https://devfeed.tech/tags/apko.md>), [chainguard-images](<https://devfeed.tech/tags/chainguard-images.md>), [container-security](<https://devfeed.tech/tags/container-security.md>), [guessbom](<https://devfeed.tech/tags/guessbom.md>), [melange](<https://devfeed.tech/tags/melange.md>), [reverse-engineering](<https://devfeed.tech/tags/reverse-engineering.md>), [sbom](<https://devfeed.tech/tags/sbom.md>), [sboms](<https://devfeed.tech/tags/sboms.md>), [sca](<https://devfeed.tech/tags/sca.md>), [shift-left](<https://devfeed.tech/tags/shift-left.md>), [software-composition-analysis](<https://devfeed.tech/tags/software-composition-analysis.md>), [software-dark-matter](<https://devfeed.tech/tags/software-dark-matter.md>), [software-supply-chain](<https://devfeed.tech/tags/software-supply-chain.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

### AI overview

The article argues that SBOMs generated after a build by software composition analysis tools can be incomplete because they may miss components that bypass recorded metadata, such as files copied through Dockerfiles. It presents build-time generation as a better way to produce complete SBOMs and describes untracked files as software dark matter, which can make post-build SBOMs closer to best guesses than reliable inventories.

### Source excerpt

GuessBOMs, SBOMs generated by reverse-engineering software artifacts, have severe limitations. The optimal point for generating complete SBOMs is at build time.