Study traces CVE-linked vulnerable code copied across projects
Original title: An Empirical Study on CVE-based Vulnerabilities Propagation from one System to another System (IntraProject vs InterProject)
Using SQVDT on NVD data, the authors report copy-paste reuse of high-severity patterns inside and between projects.
An empirical study examines how CVE-based vulnerabilities spread within a project and from one project to another, including through code clones and copy-paste reuse. The authors ran their SQVDT detection tool on an NVD-sourced CVE dataset and report similar vulnerable-code patterns in recent software, including the latest Linux and Android versions and thousands of GitHub open-source projects. They say several very high CVSS vulnerabilities moved between systems because code was reused, and they evaluated those patterns by how often they propagated. The abstract recommends considering the impact on interconnected systems but does not name individual CVEs or fixed versions.
Unconfirmed: The abstract names no specific CVEs, CVSS scores, or affected project versions beyond latest Linux and Android.
- Detection used the authors' SQVDT tool on an NVD CVE dataset.
- Patterns were reported in the latest Linux and Android versions.
- The authors also cite thousands of GitHub open-source projects.
- Propagation is attributed to copy-paste code reuse.
- Intra-project and inter-project spread were both examined.
Impact: Reused code can carry high-severity flaws into other systems
| Product | Affected |
|---|---|
| Linux | latest version |
| Android | latest version |
- Organizations
- NVD
From the original article
1 min read at arxiv.orgVulnerabilities in applications, including browsers, media players, online services and document readers, etc. are often exploited and cause a serious damage. The vulnerabilities could exist in your system maybe because of some coding errors, design oversights, outdated software, AI generated codes or maybe transferred from another system during development (e.
By Junaid Akram · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.