java-topology/whitepaper/disclosure/cve-strategy.rst

CVE Strategy
=============

.. contents:: :local:

Overview
--------

Not every CWE-407 defect warrants a CVE. The criteria for CVE filing are:

1. The tool accepts **untrusted input** from the network or from an adversary-controlled file
2. The defect creates a **measurable denial-of-service vector**: an adversary can craft input
   that maximizes the O(n²) path, degrading performance to the point of service disruption
3. The performance degradation is **distinguishable from legitimate load** — i.e., the crafted
   input is not a normal workload

Tools that process only trusted input (developer-controlled build configurations, private
module graphs) do not meet the bar for CVE even if the defect is architecturally identical.

CVE-Eligible Defects
---------------------

The following defects are CVE candidates based on the above criteria:

.. list-table::
   :header-rows: 1
   :widths: 15 20 35 15 15

   * - Defect
     - Tool
     - Attack vector
     - Complexity
     - Status
   * - ts-0001, ts-0002, ts-0003
     - TypeScript ``tsc``
     - Crafted ``.ts`` source with adversarially large export-star or resolution chain;
       submitted to a CI/CD compiler service
     - O(depth²) / O(V²)
     - File after Phase 3
   * - scala3-0001
     - Scala 3 ``scalac``
     - Crafted ``.scala`` source with many type parameters in a constraint interaction;
       submitted to a CI/CD compiler service
     - O(n³) — CRITICAL
     - File after Phase 3
   * - distlib-0001
     - pip / distlib
     - Crafted ``pyproject.toml`` or ``setup.cfg`` with adversarially large circular
       dependency graph; triggers during ``pip install``
     - O(V²)
     - File after Phase 3
   * - npm-0001, npm-0002
     - npm Arborist
     - Crafted ``package.json`` with adversarially large dependency graph; triggers
       during ``npm install``
     - O(K²) / O(depth²)
     - File after Phase 3
   * - kotlin-0001
     - Kotlin ``kotlinc``
     - Crafted ``.kt`` source with deep inheritance hierarchy; submitted to compiler service
     - O(E×V)
     - File after Phase 3
   * - FRR, BIRD (if confirmed)
     - Routing daemons
     - Crafted BGP UPDATE or OSPF LSA with adversarially structured AS-path or link-state
       topology; injected via BGP peering or OSPF adjacency
     - TBD (O(V²) or worse)
     - File after confirmation + Phase 3

CVE-Not-Eligible Defects (Rationale)
--------------------------------------

.. list-table::
   :header-rows: 1
   :widths: 15 20 45 20

   * - Defect
     - Tool
     - Rationale
     - Decision
   * - javac-0001 through javac-0005
     - ``javac``
     - javac processes source code written by the developer. An adversary would need to
       provide source files to the victim, which requires developer complicity. The primary
       impact is on the developer's own compile time. Build services (e.g., CI/CD pipelines
       that compile user-submitted code) could be affected, but this is a secondary vector.
       The patches are correct regardless; CVE is borderline.
     - Borderline — assess based on whether patch is likely to be backported to LTS JDKs
   * - ghc-0001 through ghc-0004
     - GHC
     - Same argument as javac. GHC is not typically exposed as a compile-as-a-service target.
     - No CVE unless evidence of compile-service deployment
   * - gcc-0001
     - GCC gcov
     - gcov processes instrumented binaries and test coverage data, both developer-controlled.
     - No CVE
   * - llvm-0001
     - LLVM LTO
     - LTO processes developer-compiled bitcode. No untrusted-input vector.
     - No CVE
   * - rustc-0001, rustc-0002
     - ``rustc``
     - Same as javac; Rust playground could be a compile-as-a-service vector.
     - Borderline — assess based on Rust playground / cloud build service usage
   * - maven-0001, maven-0002, maven-0003
     - Maven
     - Maven processes ``pom.xml`` files under developer control. No external-input vector
       for the graph construction path.
     - No CVE
   * - cmake-0001
     - CMake
     - ``CMakeLists.txt`` is developer-controlled. No external-input vector.
     - No CVE
   * - cargo-0001
     - Cargo tree
     - Display-only path; bounded by workspace size. No service disruption vector.
     - No CVE
   * - linux-0001
     - Linux headerdep.pl
     - Build-time tooling; runs on developer-controlled kernel tree.
     - No CVE

CVE Filing Process
-------------------

For each CVE-eligible defect:

1. **Confirm the attack vector** with a proof-of-concept crafted input that demonstrates
   measurable performance degradation (e.g., 10x slowdown at n=1000 vs n=100 baseline)
2. **Notify the maintainer** privately with the PoC before filing (Phase 3)
3. **Request a CVE** from MITRE via the CNA (Common Numbering Authority) for the affected
   project, or through a coordinating CNA (e.g., GitHub Security Advisories)
4. **Publish the CVE** after the 90-day window, with or without a patch

CVSS Scoring Guidance
----------------------

For CWE-407 defects in compilers and package managers:

- **Attack Vector:** Network (N) if the tool processes remotely-obtained input;
  Local (L) if it only processes local files
- **Attack Complexity:** Low (L) — the crafted input is straightforward to construct
- **Privileges Required:** None (N) for package managers; Low (L) for compiler services
- **User Interaction:** Required (R) — victim must run the affected tool against the crafted input
- **Scope:** Unchanged (U) — DoS only; no privilege escalation
- **Confidentiality / Integrity:** None (N)
- **Availability:** High (H) — tool becomes unusable or extremely slow on crafted input

Estimated CVSS v3.1 base score for package manager defects (distlib-0001, npm-0001/0002):
**CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H = 6.5 (Medium)**

For routing daemon defects (if confirmed), Attack Vector is Network and User Interaction
may be None if the defect can be triggered by a BGP peer without operator action:
**CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5 (High)**

The Scala 3 O(n³) defect may score higher due to the cubic scaling allowing smaller input
to achieve the same disruption level.