Copy-Paste Is a CVE Delivery Mechanism: Tracking How Vulnerabilities Hop Between Linux, Android, and Thousands of GitHub Projects

Empirical study traces how known CVE vulnerabilities propagate via code clones across and within major open-source projects, finding high-severity bugs alive in latest Linux and Android.

Imagine you photocopy a house key and give copies to a hundred friends. If the original key has a defect — say it can be picked in three seconds — every copy inherits that flaw. Now imagine nobody told the hundred friends. That is what happens when developers copy-paste vulnerable code between projects. This paper's core mechanism is simple: known-vulnerable code patterns, catalogued by CVE identifiers in the National Vulnerability Database, are grep-able signatures. If you build a tool that fingerprints those patterns and then scan thousands of projects, you can track exactly how far the infection has spread. The committed claim: CVE-catalogued vulnerabilities propagate across project boundaries (InterProject), not just within the same codebase (IntraProject), and this propagation is empirically measurable at scale using pattern-matching detection. The authors built SQVDT (Software Quality and Vulnerability Detection Tool), scanned CVE-based vulnerability patterns from NVD, and found matching vulnerable code in the latest versions of Linux, Android, and thousands of open-source GitHub repositories. Several of these are rated high-severity on the CVSS scale. The ladder context matters here. Code clone detection and vulnerability propagation studies are not new — Li et al.'s work on ReDeBug (2012), Kim et al.'s VUDDY (2017), and more recently tools like MVP and VulChecker have all attacked this problem with increasing sophistication, using token-level hashing, graph-based code representations, or deep learning. This paper sits closer to the simpler pattern-matching end of that spectrum. The authors do not compare SQVDT's precision or recall against these established tools on a shared benchmark, which is the most significant gap. We get evidence that vulnerabilities propagate — which the field already believes — but not a rigorous measurement of how well the detection works compared to existing approaches. Architecturally, SQVDT appears to be a signature-based pattern matcher operating on CVE vulnerability patterns extracted from NVD. This places it in the static-analysis, pattern-matching family rather than the graph-neural-network or deep-learning clone detection family. The advantage is interpretability and speed; the disadvantage is that any syntactic transformation (variable renaming, refactoring, compiler-level inlining) can evade pattern matching. The paper does not discuss evasion rates or false-positive rates in detail. On integrity, the validation is same-team, same-tool. The authors scan real-world codebases (Linux, Android, GitHub projects), which is better than synthetic benchmarks, but there is no independent replication, no precision/recall comparison against a labeled ground-truth dataset, and no pre-registration. The frequency analysis of propagation patterns adds some empirical weight, but the lack of a confusion matrix — how many of those 'matches' are true positives vs. syntactically similar but semantically different code — leaves the core finding unverified at the level the security community would demand. The practical value is real but incremental. Every security team already knows that dependency and code reuse create vulnerability propagation risk. What would change the game is a tool that could quantify propagation risk at the package-manager or repository level with verified precision, integrated into CI/CD pipelines. This paper gestures toward that future but doesn't deliver the engineering artifact. The milestone to watch is whether SQVDT or a successor tool publishes precision/recall numbers on a community benchmark like Big-Vul or CVEfixes and gets integrated into a real DevSecOps workflow. The obvious next experiment the authors did not run: a head-to-head comparison of SQVDT against VUDDY, ReDeBug, or a deep-learning-based clone detector on the same CVE dataset, reporting precision, recall, and F1. The honest read is (a) — this is likely a resource and scope constraint rather than a hidden negative result. The paper reads as a first empirical demonstration rather than a tool-comparison study, and the authors may be positioning SQVDT for a follow-up benchmarking paper.