I invented a CVE number to test my tool. It was real

说明与用途

该工具自动验证安全报告中声明的标识符是否存在于仓库中，但错误地确认了一个真实的 CVE，凸显了需要上下文验证的必要性。

问题

Maintainers receive bug reports with fabricated identifiers that exist in other projects, making triage costly.

结果

The tool identified fabricated claims accurately but misidentified a real CVE, highlighting the need for contextual checks. Benchmarking on curl advisories reduced unexplained misses from 24% to 3.1% after parser fixes.

工作流

• 1. Extract checkable claims from a security report.
• 2. Resolve each claim against the repository at the specified revision.
• 3. Report claims that do not resolve.
• 4. Run the tool against a fabricated report to validate end‑to‑end.
• 5. Measure performance on real advisories (curl OSV) and documentation corpus.

证据

The tool came back and told me the CVE was real. It's a Linux kernel TPM bug — "st33zp24: Fix missing cleanup on get_burstcount() error."

来源

Fixing both took the pinned advisory row from 24.0% unexplained to 3.1%.

来源