How do you audit closed-source vendor blobs for CVEs in production firmware?

[trifonivanov07]

Hey everyone,

I'm curious about real-world workflows for verifying precompiled vendor binaries (.ko, .o, .elf) when source code isn't available.

My situation:
We receive 5-10 vendor blobs per release and need to triage them for known CVEs and unsafe patterns before integration. Currently using binwalk + string analysis, but feels incomplete.

What I'd like to understand:

1. What's your standard workflow for auditing closed-source blobs? (Ghidra headless, SCA tools, manual RE, or just vendor attestation?)
2. How do you handle stripped binaries where function names are gone?
3. Do you actually catch cherry-picked patches where vendors backport fixes without updating version strings?
4. For kernel modules (.ko), how do you analyze unsafe memory operations without kernel headers?
5. Is binary auditing a hard gate in your CI/release pipeline, or does friction make it impractical?

Genuinely trying to understand how teams balance security vs delivery speed with third-party blobs. Would appreciate hearing what works (and what doesn't) in practice.