Ubuntu Vulnerability Study

Project members: Moulika Bollinadi, Joshua Moore, and Stephen Tate

This page contains full information, data, and scripts used for a 2019 study of vulnerabilities in Ubuntu LTS releases, from 12.04 to 18.04.

Overview

This project undertook a careful study of vulnerabilities in open-source software, performing both a longitudinal study over 7 years of data and an in-depth exploration of a particular type of vulnerability. First, data was mined from Ubuntu security notices from 2012 to 2019, specifically pulling security notices published within the first year of each of the four stable releases during that time. This provided a dataset covering 3,232 security vulnerabilities, which were cross-referenced with other information, allowing us to identify trends in types of vulnerabilities over the past 7 years. Within these results, we see that out-of-bounds memory access (which includes the classic "buffer overflow" vulnerability) has consistently been the most pernicious security weakness, so in the second part of this research we performed an in-depth study of a random sample of 30 recent out-of-bounds access vulnerabilities. Beginning by evaluating each vulnerability in terms of seven features, we identified trends and patterns and expanded the analysis to a total of eleven features. These results help further understanding of how out-of-bounds access vulnerabilities occur in real software, which can help both researchers looking to improve tools for vulnerability analysis and developers learning how to avoid common pitfalls.

Publication

A report of this work has been published as

Stephen R. Tate, Moulika Bollinadi, and Joshua Moore. "Characterizing Vulnerabilities in a Major Linux Distribution," in Proceedings of the 32nd International Conference on Software Engineering and Knowlege Engineering (SEKE), 2020.

Detailed Results -- CWE classes

Due to page limitations in the published paper (above), only the most significant results were published. We give full results and information here.

CWEs in the general "Out-of-Bounds Access" class CWEs in the general "Permissions" class CWEs in the general "Pointer issues" class CWEs in the general "Input validation" class CWEs in the general "Resource management" class CWEs in the general "Numeric errors" class

Scripts

This full set of scripts that were used to process Ubuntu Security Notices, CVE Tracker data, and NVD database entries are in a GitHub repository at https://github.com/srtate/usn-processing. Using these scripts it is possible to fully replicate our process using public data. Note that the results might differ slightly, because both data used from the NIST National Vulnerability Database may have been changed/updated, as well as information from the Ubuntu CVE Tracker.