_INP BFCVE Challenge
Irena Bojanova, Inventor, Creator, PI, Bugs Framework (BF) #

Let’s start creating of a labeled dataset of input/output check related software security vulnerability specifications using BF’s input/output check bugs formalism (taxonomy and LL(1) formal grammar) .

There are 70 736 input/output check related CVEs (as of August 2023). To start with, we query the CVE for entries with CWEs assigned by NVD, where the CWEs also map by operation to BF Input/Output Check classes. We then order them by their severity scores according to the Common Vulnerability Scoring System (CVSS) and select maximum thirty CVEs per operation – thus reducing the count to the most severe CVEs per _INP BF operation .

First set of steps: #

1. Explore the CVEs listed below. Each one has input/output check related underlying weaknesses and was identified via the corresponding CWE2BF mappings and the CWE to CVE assignments by NVD.
2. Identify at least one CVE for wchich you can find the Bug Report, the Code with Bug, and the Code with Fix (locate the specific GitHub repository with the Diffs). See how these are listed for the examples in BFCVE on the left.

Second set of steps: #

3. Get to know the BF Input/Output Check Bugs Model .
4. Get to know the taxonomies of the BF Input/Output Check Classes .
5. Get to know the BF Tool .
6. Collaborate on creating BF descriptions of your CVEs.
   Important Note: Use the “NVD CWE” and “BF Chain(s) Indentifiable from NVD CWE” columns only as possibly useful guidance. In some cases, a listed CWE may be a wrongly assigned one by NVD, so please notify us if you encounter such. In some cases, the listed chains may be wrong or not the only possible, as the CWE information (from which they are retrieved) may be wrong or limited.

Third set of steps: #

7. Open in a text editor the .bfcve file where you saved the BF CVE description usign the BF Tool.
8. Copy the entire content of the .bfcve file. This is your BF CVE specification in XML format.
9. Submit the copied .bfcve content and the links to the Bug Report, the Code with Bug, and the Code with Fix here: