Week 11 Studio: Studio: reproduce the CVE triage

In groups, run a second real CVE through the same tool comparison the lecture just demonstrated

3 May 2027

Before the session

Have your group’s CVE picked before you arrive — the session time is for running tools, not for searching CVE databases.

In the session

Working groups spend the session applying MISRA-C-style static analysis, a Checked C conversion attempt, and/or a Frama-C annotation attempt (pick based on which fits your function) to the vulnerable code, and comparing notes with the lecture’s worked example as a reference.

Afterwards

Keep your notes. This is the smallest possible dry run of the comparative verification report, and the report is explicitly allowed to reuse or extend this session’s CVE if your group wants to go deeper on it.

The spec

What you bring to the session. Written so a reader can tell whether it has been met without asking you.

your group picks a CVE distinct from the one used in lecture, with a patch diff small enough to read in one sitting
you try at least two tools from the semester against the vulnerable function and record what each one actually reports
you can say, for at least one tool, exactly why it did or didn't catch the bug

Teaching team

Dev Okonkwo — tutor