0

I am collecting a bunch of CVE data for some security-related analysis and wanted to know if there are examples of vulnerabilities that depend on the existence of another vulnerability on the same system. A sort of vulnerability-dependency, if you will.

For example, let's say that a system is vulnerable to CVE-1, and later another vulnerability (CVE-2) is discovered that is only exploitable if the system is still vulnerable to CVE-1. Is there an example of such a vulnerability?

Or would the original CVE just be updated with the new information?

  • 3
    This is very broad. If I have a CVE for auth bypass, it then allows me to exploit everything that requires an authenticated user. If I have a CVE for cross site scripting, then in some cases that allows me to exploit a minor session handling error that allows me to reuse sessions. Daisy-chaining vulnerabilities is extremely common. – Ohnana Jan 23 '16 at 1:30
4

A CVE is a vulnerability description, ie. a document stating that some security property has been found to be broken.

As explained in Ohnana's comment, a CVE might indeed state that to be exploitable some other security properties not part of this CVE should also be broken (typically CVE requiring a specific access from the attacker, whether it is local, privileged, in position to tamper network traffic, etc.).

However the CVE will not limit this to the use of another specific CVE. It will not tell for instance that this CVE is exploitable if a local access has been gained by using specifically this other CVE. It will just say that this CVE is only exploitable with a local access.

However, while there is not strict dependency between CVEs, there can still be a kind of link between them because, when an important enough (or suspected to be important) vulnerability is discovered in some widespread software, a lot of security researchers will dig into this and possibly make other discoveries.

Then, it will be up to determine how such discoveries should be classified:

  • In the scheme you describe, which I understand as "using this vulnerability allows the attacker to do even more harm as previously expected by proceeding in a certain way", this will most likely ends-up as an update of the first CVE. It means that the vulnerability's impact seems to have been underestimated and needs to be revised.

  • However, most often such discoveries are independent vulnerabilities. Each of them will get its own CVE and can be exploited independently. However it is possible that the same fix can solve several of such CVEs since they are likely to concern the same part of the software (the one under scrutiny by all security researchers). This is useful because it will help to increase the fix quality. Shellshock with its list of CVEs published after the first discovery seems a good example.

  • At last it is also possible that several discovered issues, while being independent from each other and not necessarily being all security issues (and therefore not needing a distinct CVE), may combine to increase the initial CVE threat. For instance, CVE-2015-3456 mentions a vulnerability affecting Qemu's Floppy Disk Controller in some versions of Xen and KVM and allowing to escape the VM; while this issue should be restricted to environment having floppy drive emulation enabled, researchers have discovered that "if the administrator explicitly disables the virtual floppy drive, an unrelated bug causes the vulnerable FDC code to remain active and exploitable by attackers".

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.