1

I'm trying to understand how to get more information about a vulnerability given a CVE. I noticed that some CVEs, on websites like https://www.cvedetails.com, have got references to articles or to code, for example a reference to https://www.exploit-db.com, sometimes you can find code on Github from the author or even a metasploit module. It seems to me that many CVEs, if not the majority, have got just a small description of the problem (something like an "abstract") and references to advisories or patches, with no information about the vulnerability itself. How can I know more about a vulnerability in this case? I suppose there's some research behind a CVE, so I should be able to find a research paper somewhere, right?

For example, that's the case of CVE-2017-3167:

  • There's no exploit-db entry and no metasploit module
  • I can't find any code in Github
  • I can't find any real article that talks about it
  • I can't find any publication on Google Scholar
  • I can't even find author's name!

It makes sense to me that, for security reasons, there's no code available for this particular vulnerability because it's classified as CRITICAL, but I think a better, theoretical, description of the vulnerability should be available for learning/research purposes. So maybe I'm missing something.

1 Answer 1

2

Not all CVE's have a public detailed technical disclosure and especially not all CVE's have a public working exploit. However, there are some ways to identify the technical details behind a CVE:

  • Check Git changes - Some CVE's are related to open source software and so the patch can be publicly available in the Git history of the project.

  • Check functionality changes - CVE's may effect functionality, being able to detect the change in functionality can lead to an assumption of what the vulnerability is.

  • Reverse engineer - Taking a look at the disassembled code, network traffic or anything else related to the software can help get a better understanding of the patch. This is assuming you can compare the software before and after the patch.

I have found that most information I can get related to a CVE is from the National Vulnerability Database (NVD). For example, the CVE you mentioned can be found here. A full search can be found here.

1
  • 1
    Using your approach, I identified this commit where they deprecate the old function and create a new, secure, one! Thank you!
    – Fral
    Nov 11, 2022 at 11:03

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .