1

When I look for proof-of-concepts of a security vulnerability, I often see this kind of Github repositories:

https://github.com/Satheesh575555/linux-4.19.72_CVE-2023-0386

https://github.com/nidhi7598/linux-4.19.72_CVE-2022-29581

You could see that there is a pattern here in the name. Also, in the list of commits, there is almost nothing. At first I thought they had malware or something that would run when we tried to use them. But no, I diffed the content of these repos and the official linux 4.19.72, and they were almost identical. There were some minor differences, but they can't be malicious:

Only in linux-4.19.72_CVE-2023-0386: .whitesource

Files linux-4.19.72_CVE-2023-0386/fs/overlayfs/copy_up.c and official_linux-4.19.72/fs/overlayfs/copy_up.c differ
780,783d779
<    if (!kuid_has_mapping(current_user_ns(), ctx.stat.uid) ||
<        !kgid_has_mapping(current_user_ns(), ctx.stat.gid))
<        return -EOVERFLOW;

These two repos are just examples, and there are many other similar ones. Does anyone know why people created such repos? Some malicious intent here that I haven't figured out?

Improve this question

1 Answer 1

Reset to default
1

Your example does not track PoC or exploit, quite to the contrary they track the fixes on branches of the kernel.

For CVE-2023-0386: https://nvd.nist.gov/vuln/detail/CVE-2023-0386 ...we can see among the references the fix from Torvalds: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4f11ada10d0a And the fix is precisely what your example is, except that it is for the 4.17 branch, whereas Torvalds fix was for v6.2-rc6.

So this is actual content. As of today there are 6 kernel branches (4.14, 4.19, 5.4, 5.10, 5.15, 6.1), and tracking the backport of a CVE that would be:

  • discovered and fix on, say, 6.1,
  • ...but for a bug that would have been introduced in 4.9 branch, not maintained anymore,
  • ...but such a case would imply that the CVE should be fixed on all current 6 branches: where and how? The more different the branch, to more different the patch can be.

Such job is not only useful, it is needed. And not so easy to do, give it a try if you wish. ;-)

Improve this answer
2
  • As I already said in the question, I know that the content in the repos can't be malicious. But my question is about why such repos exist. Even though they have actual content as you said, I don't see that they have any useful purpose. You could see that there is a pattern here in the names and the contents of the repos. There are many other similar ones that I didn't mention. It looks like the owners just want these repos to be showed when people search for the related CVEs.
    – Thanh Bui
    Jul 17 at 18:06
  • If you don't understand the purpose, then you never had to sort out 500-1000 CVE yelds from the NVD on your kernel branch and version (with, of course, up to 95% false positives depending on your build configuration). Some people have been getting donations for such a service for years, e.g. linuxkernelcves.com from open data but closed source github.com/nluedtke/linux_kernel_cves.
    – jbm
    Jul 18 at 7:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .