CVE-2016-6156 and CVE-2017-5576

cves/kernel/CVE-2016-6156.yml

@@ -19,14 +19,14 @@ curated_instructions: |
   This will enable additional editorial checks on this file to make sure you
   fill everything out properly. If you are a student, we cannot accept your work
   as finished unless curated is properly updated.
-curation_level: 0
+curation_level: 2
 reported_instructions: |
   What date was the vulnerability reported to the security team? Look at the
   security bulletins and bug reports. It is not necessarily the same day that
   the CVE was created.  Leave blank if no date is given.
 
   Please enter your date in YYYY-MM-DD format.
-reported_date:
+reported_date: '2023-11-06'
 announced_instructions: |
   Was there a date that this vulnerability was announced to the world? You can
   find this in changelogs, blogs, bug reports, or perhaps the CVE date.
@@ -55,7 +55,9 @@ description_instructions: |
 
   Your target audience is people just like you before you took any course in
   security
-description:
+description: |
+  A race condition in the ec_device_ioctl_xcmd function caused a denial of
+  service, known as a "double fetch" vulnerability.
 bounty_instructions: |
   If you came across any indications that a bounty was paid out for this
   vulnerability, fill it out here. Or correct it if the information already here
@@ -92,6 +94,7 @@ fixes:
   note: |
     Taken from NVD references list with Git commit. If you are
     curating, please fact-check that this commit fixes the vulnerability and replace this comment with 'Manually confirmed'
+    Manually Confirmed
 vcc_instructions: |
   The vulnerability-contributing commits.
 
@@ -133,10 +136,10 @@ unit_tested:
 
     For the fix_answer below, check if the fix for the vulnerability involves
     adding or improving an automated test to ensure this doesn't happen again.
-  code:
-  code_answer:
-  fix:
-  fix_answer:
+  code: false
+  code_answer: no automated unit tests were found
+  fix: false
+  fix_answer: no automated unit tests were found
 discovered:
   question: |
     How was this vulnerability discovered?
@@ -151,10 +154,10 @@ discovered:
 
     If there is no evidence as to how this vulnerability was found, then please
     explain where you looked.
-  answer:
-  automated:
-  contest:
-  developer:
+  answer: Information was not given about the discovery of this vulnerability.
+  automated: false
+  contest: false
+  developer: false
 autodiscoverable:
   instructions: |
     Is it plausible that a fully automated tool could have discovered
@@ -171,8 +174,8 @@ autodiscoverable:
 
     The answer field should be boolean. In answer_note, please explain
     why you come to that conclusion.
-  note:
-  answer:
+  note: no information is provided.
+  answer: false
 specification:
   instructions: |
     Is there mention of a violation of a specification? For example, the POSIX
@@ -188,8 +191,8 @@ specification:
 
     The answer field should be boolean. In answer_note, please explain
     why you come to that conclusion.
-  note:
-  answer:
+  note: no information is provided.
+  answer: false
 subsystem:
   question: |
     What subsystems was the mistake in? These are WITHIN linux kernel
@@ -223,7 +226,7 @@ subsystem:
     e.g.
         name: ["subsystemA", "subsystemB"] # ok
         name: subsystemA # also ok
-  name:
+  name: drivers
   note:
 interesting_commits:
   question: |
@@ -255,8 +258,8 @@ i18n:
     Answer should be true or false
     Write a note about how you came to the conclusions you did, regardless of
     what your answer was.
-  answer:
-  note:
+  answer: false
+  note: no relation to i18n
 sandbox:
   question: |
     Did this vulnerability violate a sandboxing feature that the system
@@ -270,8 +273,8 @@ sandbox:
     Answer should be true or false
     Write a note about how you came to the conclusions you did, regardless of
     what your answer was.
-  answer:
-  note:
+  answer: false
+  note: no relation to sandboxing
 ipc:
   question: |
     Did the feature that this vulnerability affected use inter-process
@@ -282,8 +285,8 @@ ipc:
     Answer must be true or false.
     Write a note about how you came to the conclusions you did, regardless of
     what your answer was.
-  answer:
-  note:
+  answer: false
+  note: no relation to ipc
 discussion:
   question: |
     Was there any discussion surrounding this?
@@ -309,9 +312,9 @@ discussion:
 
     Put any links to disagreements you found in the notes section, or any other
     comment you want to make.
-  discussed_as_security:
-  any_discussion:
-  note:
+  discussed_as_security: false
+  any_discussion: false
+  note: no discussion was had in regards to this issue that is available.
 vouch:
   question: |
     Was there any part of the fix that involved one person vouching for
@@ -324,8 +327,8 @@ vouch:
 
     Answer must be true or false.
     Write a note about how you came to the conclusions you did, regardless of what your answer was.
-  answer:
-  note:
+  answer: true
+  note: commit for change was signed off, reviewed, and tested
 stacktrace:
   question: |
     Are there any stacktraces in the bug reports?
@@ -339,9 +342,9 @@ stacktrace:
     Answer must be true or false.
     Write a note about how you came to the conclusions you did, regardless of
     what your answer was.
-  any_stacktraces:
-  stacktrace_with_fix:
-  note:
+  any_stacktraces: false
+  stacktrace_with_fix: false
+  note: no stacktraces found
 forgotten_check:
   question: |
     Does the fix for the vulnerability involve adding a forgotten check?
@@ -360,8 +363,8 @@ forgotten_check:
     Answer must be true or false.
     Write a note about how you came to the conclusions you did, regardless of
     what your answer was.
-  answer:
-  note:
+  answer: true
+  note: Verifies values havent changed, checks were added to prevent buffer overflows.
 order_of_operations:
   question: |
     Does the fix for the vulnerability involve correcting an order of
@@ -373,8 +376,8 @@ order_of_operations:
     Answer must be true or false.
     Write a note about how you came to the conclusions you did, regardless of
     what your answer was.
-  answer:
-  note:
+  answer: false
+  note: no mention.
 lessons:
   question: |
     Are there any common lessons we have learned from class that apply to this
@@ -390,38 +393,38 @@ lessons:
 
     If you think of another lesson we covered in class that applies here, feel
     free to give it a small name and add one in the same format as these.
-  defense_in_depth:
-    applies:
-    note:
-  least_privilege:
-    applies:
+  defense_in_depth: 
+    applies: false
     note:
-  frameworks_are_optional:
-    applies:
+  least_privilege: 
+    applies: false
     note:
-  native_wrappers:
-    applies:
+  frameworks_are_optional: 
+    applies: false
     note:
-  distrust_input:
-    applies:
+  native_wrappers: 
+    applies: false
     note:
-  security_by_obscurity:
-    applies:
+  distrust_input: 
+    applies: true
+    note: confirm input is correct, and not too large
+  security_by_obscurity: 
+    applies: false
     note:
-  serial_killer:
-    applies:
+  serial_killer: 
+    applies: false
     note:
-  environment_variables:
-    applies:
+  environment_variables: 
+    applies: false
     note:
-  secure_by_default:
-    applies:
+  secure_by_default: 
+    applies: false
     note:
-  yagni:
-    applies:
+  yagni: 
+    applies: false
     note:
-  complex_inputs:
-    applies:
+  complex_inputs: 
+    applies: false
     note:
 mistakes:
   question: |
@@ -452,7 +455,9 @@ mistakes:
 
     Write a thoughtful entry here that people in the software engineering
     industry would find interesting.
-  answer:
+  answer: |
+   The mistake that led to this issue was just a simple check that was missed
+   to confirm that the values have not changed to prevent a buffer overflow.
 CWE_instructions: |
   Please go to http://cwe.mitre.org and find the most specific, appropriate CWE
   entry that describes your vulnerability. We recommend going to