google / google/osv.dev

Solution hashes for a vulnerability lies in an external fork

Open
#2,415 5 comments 0 reactions 0 assignees View on GitHub
backlog data quality
Dominant language
Go
Stars
2.9k
Forks
369
Avg merge
1d 17h
Merged PRs (30d)
149

Description

**Describe the bug**

Hi Team,

I am playing with the OSV API for checking vulnerabilities in the kernel repositories, and on trying the cli, I got the following results -
```sh
(.venv) ➜ git_kernel_vulns git:(master) ✗ curl -d \
'{"commit": "30e3b4f256b4e366a61658c294f6a21b8626dda7",
"package": {"name": "github.com/torvalds/linux"}}' \
"https://api.osv.dev/v1/query" | jq '.vulns | .[] | .id'
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 5643k 100 5643k 100 108 342k 6 0:00:18 0:00:16 0:00:02 1346k
"CVE-2021-33909"
"CVE-2021-3609"
"CVE-2021-3656"
"CVE-2021-37159"
"CVE-2021-3744"
...
```

Picking one the vulnerabilities from the output - `GSD-2022-1000409`, I wanted to check the commit hash which fixes the issue - https://osv.dev/vulnerability/GSD-2022-1000409
The solution fix (`0838d6d68182f0b28a5434bc6d50727c4757e35b `) - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ doesn't lie in the given repository, and on checking the link, I see that it lies in an external fork - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=0838d6d68182f0b28a5434bc6d50727c4757e35b

The commit message itself suggests that the fix is an upstream commit -
```
Notice: this object is not reachable from any branch.
commit 926fd9f23b27ca6587492c3f58f4c7f4cd01dad5 upstream.
```

**To Reproduce**
Provided above
**Expected behaviour**
The solution fix should lie in the upstream branch(or atleast should be present in the fork)

**Screenshots**

**Additional context**

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.