google / google/vanir

Failed to Generate Vulnerability Signature

Open
#9 3 comments 0 reactions 2 assignees Claimed by @aixiao0621 View on GitHub
Dominant language
Python
Stars
364
Forks
40
PR merge metrics
No merged PRs in 30d

Description

Hello, I would like to add support for GitHub commit signature generation by enhancing the `code_extractor`. Before proceeding, I tested the command:

```bash
$ ./bazel-bin/sign_generator_runner --vulnerability_file_name=/mnt/d/vanir/test/tty1.json --signature_file_name=/mnt/d/vanir/test/op.json
```

The content of `tty1.json` is:

```json
[
{
"id": "ASB-A-244395411",
"details": "In pipe_resize_results of pipe.c, there is a possible UAF bug caused by a race condition. This could lead to local denial of service and local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. ",
"aliases": [
"A-244395411",
"CVE-2022-2959"
],
"modified": "2024-11-06T12:16:03.231308Z",
"published": "2023-01-01T00:00:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://source.android.com/security/bulletin/2023-01-01"
},
{
"type": "FIX",
"url": "https://android.googlesource.com/kernel/common/+/a2c2b6c91475908e2ac90a3d70f5d12ae86b8033"
}
],
"affected": [
{
"package": {
"name": ":linux_kernel:",
"ecosystem": "Android"
},
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": ":0"
},
{
"fixed": ":2023-01-05"
}
]
}
],
"versions": [
"Kernel"
],
"database_specific": {
"source": "https://storage.googleapis.com/android-osv/ASB-A-244395411.json"
}
}
],
"schema_version": "1.6.0"
}]
```

However, this operation did not output the signature for the vulnerability. Instead, it only added an empty `"ecosystem_specific": {}` under `affected`. Could this be due to an incorrect usage on my part?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.