AI slop pollutes the CVE pipeline with fake vulns
With NIST still buried under its backlog, expect AI-generated bogus reports to continue
AI-generated vulnerabilities have infiltrated the Common Vulnerabilities and Exposures (CVE) pipeline, according to security researchers. Fake critical- and high-rated CVEs for SQLite, a popular open-source database, recently appeared in the National Vulnerability Database (NVD) with assistance from the Cybersecurity and Infrastructure Security Agency (CISA).
These bogus advisories claimed to uncover severe security flaws in SQLite, but were later determined to be entirely fabricated. JFrog, a software supply chain security firm, discovered six SQLite advisories published by an obscure GitHub repository, which all failed to describe a reproducible vulnerability. Moreover, the accompanying proof-of-concept tests revealed no memory leaks or errors, debunking the claimed use-after-free (UAF) vulnerability.
Similar fraudulent CVEs were found in the GitHub repository, targeting other open-source software like libraw and ESP32-audioI2S. The issue stems from a lack of mandatory checkpoints in the CVE pipeline, where every claimed vulnerability should be independently verified. As a result, AI-generated advisories can easily bypass security measures and enter widely used databases, wasting time and resources for security professionals.
JFrog recommended several checks before acting on a newly published CVE, including verifying the vendor's credibility, the absence of commit hashes or pull requests in the reference fields, and suspicious metadata. These 54 apparently bogus CVEs are merely one example of a growing problem anticipated to be more prevalent as AI-generated advisories become increasingly effortless to produce.
Written by urgent.news from The Register's reporting — not their text. Machine-written — it may contain errors, so check the original before relying on it.
Also reported by 1 other outlet
- AI slop pollutes the CVE pipeline with fake vulns theregister.com
