vhp nvd --project kernel

Author: andymeneely

cves/kernel/CVE-2012-2669.yml

@@ -474,9 +474,9 @@ mistakes:
 
     Write a thoughtful entry here that people in the software engineering
     industry would find interesting.
-  answer: If anything, the developer probably did not think to check this input, thinking
-    that a limited number of cases would always be returned. However, there were outliers
-    when it came to how the message's origin was returned/checked.
+  answer: If anything, the developer probably did not think to check this input,
+    thinking that a limited number of cases would always be returned. However, there
+    were outliers when it came to how the message's origin was returned/checked.
 CWE_instructions: |
   Please go to http://cwe.mitre.org and find the most specific, appropriate CWE
   entry that describes your vulnerability. We recommend going to

cves/kernel/CVE-2013-0309.yml

@@ -194,8 +194,8 @@ specification:
 
     The answer field should be boolean. In answer_note, please explain
     why you come to that conclusion.
-  note: 'I saw no mention of any spec violation in the bug report conversations, commit
-    messages or other discussions between devs.
+  note: 'I saw no mention of any spec violation in the bug report conversations,
+    commit messages or other discussions between devs.
 
     '
   answer: false

cves/kernel/CVE-2013-5634.yml

@@ -180,8 +180,8 @@ autodiscoverable:
 
     The answer field should be boolean. In answer_note, please explain
     why you come to that conclusion.
-  note: "I don't believe it could be found by an automated tool like a fuzzer as it
-    is a \nresource management issue.\n"
+  note: "I don't believe it could be found by an automated tool like a fuzzer as
+    it is a \nresource management issue.\n"
   answer: false
 specification:
   instructions: |

cves/kernel/CVE-2014-0196.yml

@@ -256,8 +256,8 @@ interesting_commits:
       * Anything else you find interesting.
   commits:
   - commit: d945cb9cce20ac7143c2de8d88b187f62db99bdc
-    note: yes there was one that was seen by one of the developers as one of the sources
-      of the problem for this vulnerability
+    note: yes there was one that was seen by one of the developers as one of the
+      sources of the problem for this vulnerability
   - commit:
     note:
 i18n:
@@ -364,8 +364,8 @@ stacktrace:
     what your answer was.
   any_stacktraces: false
   stacktrace_with_fix: false
-  note: There was no mention of stack traces in the commits or the bug report or any
-    of the sources in the NVD
+  note: There was no mention of stack traces in the commits or the bug report or
+    any of the sources in the NVD
 forgotten_check:
   question: |
     Does the fix for the vulnerability involve adding a forgotten check?

cves/kernel/CVE-2014-5077.yml

@@ -197,8 +197,8 @@ specification:
 
     The answer field should be boolean. In answer_note, please explain
     why you come to that conclusion.
-  note: The bug description explains how the shared key for the SPTC protocol is not
-    updated for the second thread that attempts to associate
+  note: The bug description explains how the shared key for the SPTC protocol is
+    not updated for the second thread that attempts to associate
   answer: true
 subsystem:
   question: |
@@ -393,8 +393,8 @@ order_of_operations:
     Write a note about how you came to the conclusions you did, regardless of
     what your answer was.
   answer: false
-  note: It was one line fix and didnt require anything to be changed in terms of the
-    order of the program
+  note: It was one line fix and didnt require anything to be changed in terms of
+    the order of the program
 lessons:
   question: |
     Are there any common lessons we have learned from class that apply to this

cves/kernel/CVE-2014-9940.yml

@@ -476,4 +476,4 @@ nickname_instructions: |
   If the report mentions a nickname, use that.
   Must be under 30 characters. Optional.
 nickname:
-CVSS:
+CVSS: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

cves/kernel/CVE-2015-4178.yml

@@ -55,8 +55,8 @@ description_instructions: |
 
   Your target audience is people just like you before you took any course in
   security
-description: "The fs_pin struct in the Linux kernel contains two members (m_list and
-  s_list). \nThese members are usually initialized on use. However, if these members
+description: "The fs_pin struct in the Linux kernel contains two members (m_list
+  and s_list). \nThese members are usually initialized on use. However, if these members
   go \nunmodified, destroying or freeing them could cause the system to crash.\n"
 bounty_instructions: |
   If you came across any indications that a bounty was paid out for this
@@ -138,8 +138,8 @@ unit_tested:
   code: false
   code_answer: There were no unit tests involved for this subsystem.
   fix: false
-  fix_answer: "The fix uses hlist_del_init instead of hlist_del. \nThis provides an
-    hlist_unhashed test. However, no \nunit tests were added or removed to prevent
+  fix_answer: "The fix uses hlist_del_init instead of hlist_del. \nThis provides
+    an hlist_unhashed test. However, no \nunit tests were added or removed to prevent
     this bug.\n"
 discovered:
   question: |
@@ -287,8 +287,8 @@ ipc:
     Write a note about how you came to the conclusions you did, regardless of
     what your answer was.
   answer: false
-  note: The issue was with a data structure not being safely initialized, no IPC was
-    used.
+  note: The issue was with a data structure not being safely initialized, no IPC
+    was used.
 discussion:
   question: |
     Was there any discussion surrounding this?

cves/kernel/CVE-2015-6526.yml

@@ -160,10 +160,10 @@ discovered:
 
     If there is no evidence as to how this vulnerability was found, then please
     explain where you looked.
-  answer: "The fix commit was made on 2015/04/14, but the Redhat Bugzilla report shows\nthat
-    the bug report was not created until 2015/05/05. After looking at the\nbug report,
-    there is no explanation for how the vulnerability was found.\nThe bug report just
-    explains that a patch was released to \nfix the vulnerability.\n"
+  answer: "The fix commit was made on 2015/04/14, but the Redhat Bugzilla report
+    shows\nthat the bug report was not created until 2015/05/05. After looking at
+    the\nbug report, there is no explanation for how the vulnerability was found.\nThe
+    bug report just explains that a patch was released to \nfix the vulnerability.\n"
   automated: false
   contest: false
   developer: false
@@ -342,8 +342,8 @@ discussion:
     comment you want to make.
   discussed_as_security: false
   any_discussion: false
-  note: "There was no discussion of whether the vulnerability should be fixed or \nhow
-    to fix it in any bug report or commit messages.\n"
+  note: "There was no discussion of whether the vulnerability should be fixed or
+    \nhow to fix it in any bug report or commit messages.\n"
 vouch:
   question: |
     Was there any part of the fix that involved one person vouching for

cves/kernel/CVE-2015-8543.yml

@@ -485,4 +485,4 @@ nickname_instructions: |
   If the report mentions a nickname, use that.
   Must be under 30 characters. Optional.
 nickname:
-CVSS:
+CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

cves/kernel/CVE-2015-8660.yml

@@ -474,4 +474,4 @@ nickname_instructions: |
   If the report mentions a nickname, use that.
   Must be under 30 characters. Optional.
 nickname:
-CVSS:
+CVSS: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H