cve-map.json

{
  "_comment": "Curated mapping of risk-cluster ids (used by data/weights.yaml) to concrete CVE identifiers from the kernel.org vulns feed. Curated by hand; agents must read, never generate. Clusters whose exposure is a class rather than a named bug carry an empty cves list and explain why.",
  "autoload-amplifier": {
    "cves": [],
    "note": "Class amplifier, not a defect of its own: module autoload converts every unloadable-module CVE into a locally reachable one. Counted through the clusters it amplifies."
  },
  "bluetooth-parsing": {
    "cves": ["CVE-2017-1000251"],
    "note": "L2CAP configuration heap overflow reachable from a nearby device."
  },
  "bpf-verifier": {
    "cves": ["CVE-2021-3490", "CVE-2023-2163"],
    "note": "Verifier bounds-tracking and state-pruning defects convert directly into arbitrary kernel read/write."
  },
  "cap-sys-admin-abuse": {
    "cves": [],
    "note": "Amplifier: CAP_SYS_ADMIN in an unprivileged workload unlocks ioctl surfaces across namespaces, mounts and devices designed on the assumption of root."
  },
  "compat-ioctls": {
    "cves": ["CVE-2010-3081"],
    "note": "Legacy 32-bit compatibility layer; the canonical compat-layer LPE."
  },
  "dccp-uaf": {
    "cves": ["CVE-2017-6074"],
    "note": "Double-free in DCCP socket option handling, reachable by one socket() call when autoloadable."
  },
  "dma-physical-access": {
    "cves": [],
    "note": "Class exposure: physical DMA over legacy buses reads and writes host memory without kernel involvement (the Inception technique). No single CVE; mitigated by blacklisting the bus."
  },
  "fs-image-parsing": {
    "cves": [],
    "note": "Recurring parser-defect stream across legacy filesystem images; individual fixes are distro-batched, so the cluster is tracked at class level."
  },
  "heap-grooming-primitive": {
    "cves": ["CVE-2017-5123"],
    "note": "Representative exploit chain where userfaultfd turned an unreliable race into a deterministic primitive."
  },
  "infoleak": {
    "cves": ["CVE-2018-17182"],
    "note": "Representative kernel memory-disclosure defect; kptr_restrict and dmesg_restrict remove the reconnaissance step of most chains."
  },
  "io_uring-refcount": {
    "cves": ["CVE-2022-1116"],
    "note": "Reference-counting defects in the io_uring submission path."
  },
  "io_uring-uaf": {
    "cves": ["CVE-2023-1872", "CVE-2024-0582"],
    "note": "Lifetime bugs in registered-ring and pinned-page handling, both exploited for local privilege escalation."
  },
  "kernel-integrity": {
    "cves": [],
    "note": "Lockdown guards root-to-kernel-memory paths (raw ioports, PCI config, ACPI tables); class exposure without a single canonical CVE."
  },
  "keyring-uaf": {
    "cves": ["CVE-2016-0728"],
    "note": "The canonical keyring reference-leak-to-use-after-free local privilege escalation."
  },
  "kvm-ioctl": {
    "cves": ["CVE-2021-22543"],
    "note": "Guest-to-host memory corruption through the KVM ioctl interface."
  },
  "net-legacy-proto": {
    "cves": ["CVE-2010-3904"],
    "note": "RDS privilege escalation: the template for treating barely-used transports as first-class LPE targets."
  },
  "netfilter-via-userns": {
    "cves": ["CVE-2024-1086"],
    "note": "nf_tables use-after-free exploited from inside an unprivileged user namespace."
  },
  "perf-lpe": {
    "cves": ["CVE-2023-5717"],
    "note": "Race-condition use-after-free in perf_event_open leading to privilege escalation."
  },
  "physical-memory-access": {
    "cves": [],
    "note": "/dev/mem is gated by STRICT_DEVMEM and lockdown rather than by patching any one defect; exposure is binary and class-level."
  },
  "refcount-overflow": {
    "cves": ["CVE-2014-2851"],
    "note": "Representative reference-count mismanagement reaching use-after-free."
  },
  "remote-heap-overflow": {
    "cves": ["CVE-2021-43267"],
    "note": "TIPC message-length integer overflow to remote heap corruption on hosts running an unused protocol stack."
  },
  "tty-ldisc-lpe": {
    "cves": ["CVE-2017-2636"],
    "note": "Race condition in the n_hdlc line discipline, the reference tty-ldisc local privilege escalation."
  },
  "usb-parsing": {
    "cves": ["CVE-2016-2384"],
    "note": "Malicious USB device triggers double-free in the midi driver; the template for descriptor-parsing attacks."
  },
  "userns-lpe": {
    "cves": ["CVE-2021-3493", "CVE-2022-0185", "CVE-2023-0386"],
    "note": "Overlayfs and filesystem-context escalations whose first link is an unprivileged user namespace."
  }
}