Skip to content
Explanation

CS Transitions

The specification governs

This page explains the design of the Vultron Protocol. It is informative: the normative text is the Vultron Protocol Specification. Where this page and the specification differ, the specification governs.

This page defines the transitions of the Coordinated Vulnerability Disclosure (CVD) Case State (CS) model: the events that move a case from one state to another, the rules that restrict them, and the transition grammar. It builds on CS States, which defines the six substates and the 32 case states. The normative definition is in the Vultron Protocol Specification §8 Case State (CS) Dimensions.

CS Input Symbols

Each row of the CVD case substates table implies an event that changes that substate from lowercase to uppercase. These events are the input symbols of the CS deterministic finite automaton (DFA).


Symbol Description Formalism
V A Vendor becomes aware of a vulnerability \(vfd\cdot\cdot\cdot \xrightarrow{\mathbf{V}} Vfd\cdot\cdot\cdot\)
F A Vendor readies a fix for a vulnerability \(Vfd\cdot\cdot\cdot \xrightarrow{\mathbf{F}} VFd\cdot\cdot\cdot\)
D A Deployer deploys a fix for a vulnerability \(VFd\cdot\cdot\cdot \xrightarrow{\mathbf{D}} VFD\cdot\cdot\cdot\)
P Information about a vulnerability becomes known to the public \(\cdot\cdot\cdot p \cdot\cdot \xrightarrow{\mathbf{P}} \cdot\cdot\cdot P \cdot\cdot\)
X An exploit for a vulnerability is made public \(\cdot\cdot\cdot\cdot x \cdot \xrightarrow{\mathbf{X}} \cdot\cdot\cdot\cdot X \cdot\)
A Attacks exploiting a vulnerability are observed \(\cdot\cdot\cdot\cdot\cdot a \xrightarrow{\mathbf{A}} \cdot\cdot\cdot\cdot\cdot A\)
CS Model Input Symbols (\(\Sigma^{cs}\)) Defined
\[\Sigma^{cs} = \{\mathbf{V},\mathbf{F},\mathbf{D},\mathbf{P},\mathbf{X},\mathbf{A}\}\]

Here we diverge somewhat from the notation used for the RM and EM models, which use lowercase letters for transitions and uppercase letters for states. Because CS state names already use both lowercase and uppercase letters, here we use a bold font for the symbols of the CS DFA to differentiate the transition from the corresponding substate it leads to: e.g., \(vfd\cdot\cdot\cdot \xrightarrow{\mathbf{V}} Vfd\cdot\cdot\cdot\).

We define the set of symbols for the CS DFA as \(\Sigma^{cs}\) at right.

For the CS model, an input symbol \(\sigma^{cs} \in \Sigma^{cs}\) is "read" when a Participant observes a change in status, such as a Vendor being notified or exploit code being published. For simplicity, we begin with the assumption that observations are globally known: a status change observed by any CVD Participant is known to all. In the real world, we believe the Formal Vultron Protocol is poised to ensure eventual consistency with this assumption, by communicating perceived case state among coordinating parties.

CS Transitions Defined

This section defines the allowable transitions between states in the CS model. They follow a few rules, described in detail in §2.4 of A State-Based Model for Multi-Party Coordinated Vulnerability Disclosure and summarized here.

Each Transition Records One Event

States record events that have or have not occurred, and history is immutable, so every transition is irreversible. The result is an acyclic directed graph of states, beginning at \(q^{cs}_0={vfdpxa}\) and ending at \(\mathcal{F}^{cs}=\{VFDPXA\}\), with the allowed transitions as its edges. In practical terms, there is an arrow of time from vfdpxa to VFDPXA, and each transition changes exactly one letter from lowercase to uppercase.

The Vendor Fix Path Is Ordered

The Vendor fix path (\(vfd \cdot\cdot\cdot \xrightarrow{\mathbf{V}} Vfd \cdot\cdot\cdot \xrightarrow{\mathbf{F}} VFd \cdot\cdot\cdot \xrightarrow{\mathbf{D}} VFD \cdot\cdot\cdot\)) is a causal requirement, set out in CS States. The diagram below shows that the fix path moves in one direction, through its four prefixes in a fixed order.

---
title: Vendor Fix Path Transitions
---
stateDiagram-v2
    direction LR
    vfd: vfd...
    Vfd: Vfd...
    VFd: VFd...
    VFD: VFD...

    [*] --> vfd
    vfd --> Vfd
    Vfd --> VFd
    VFd --> VFD
    VFD --> [*]

Public Awareness Implies Vendor Awareness

Vendors are presumed to know at least as much as the public does. Therefore \(v\cdot\cdot P \cdot\cdot\) can only lead to \(V\cdot\cdot P \cdot\cdot\): once the public is aware, the next event must be Vendor awareness. The diagram below shows this single permitted exit.

---
title: Public Awareness Forces Vendor Awareness
---
stateDiagram-v2
    direction LR
    vP: v..P..
    VP: V..P..
    vP --> VP

Exploit Publication Causes Public Awareness

Exploit publication is tantamount to public awareness. Therefore \(\cdot\cdot\cdot pX \cdot\) can only lead to \(\cdot\cdot\cdot PX \cdot\): once an exploit is public, the next event must be public awareness. The diagram below shows this single permitted exit.

---
title: Exploit Publication Forces Public Awareness
---
stateDiagram-v2
    direction LR
    pX: ...pX.
    PX: ...PX.
    pX --> PX

States in \(v\cdot\cdot P \cdot\cdot\) and \(\cdot\cdot\cdot pX \cdot\) are therefore unstable: a case passes through them rather than resting in them.

For all practical purposes, this rule lets us simplify the full \(pxa \rightarrow PXA\) diagram:

---
title: pxa State Diagram
---
stateDiagram-v2
    direction LR
    [*] --> pxa

    pxa --> Pxa : P
    pxa --> pXa : X
    pxa --> pxA : A

    pXa --> PXa : P
    pXa --> pXA : A

    pxA --> PxA : P
    pxA --> pXA : X

    Pxa --> PxA : A
    Pxa --> PXa : X

    pXA --> PXA : P
    PXa --> PXA : A
    PxA --> PXA : X
    PXA --> [*]

down to the following:

---
title: Simplified pxa State Diagram
---
stateDiagram-v2
    direction LR
    [*] --> pxa

    pxa --> Pxa : P
    pxa --> PXa : X,P
    pxa --> pxA : A


    pxA --> PxA : P
    pxA --> PXA : X,P

    Pxa --> PxA : A
    Pxa --> PXa : X

    PXa --> PXA : A
    PxA --> PXA : X
    PXA --> [*]

Attacks Do Not Necessarily Cause Public Awareness

In this model, attacks observed while the public is unaware of the vulnerability (\(\cdot\cdot\cdot p \cdot A\)) need not immediately cause public awareness (\(\cdot\cdot\cdot P \cdot A\)), although that can and does happen. We allow states in \(\cdot\cdot\cdot p \cdot A\) to persist for two reasons.

  1. The connection between an attack and the vulnerability it exploited is often made later, during incident analysis. The attack itself may have been observed much earlier, but knowledge of which vulnerability it targeted may be delayed until after other events have occurred.
  2. Attackers are not a monolithic group. An attack by a niche set of threat actors does not mean that the knowledge and capability to exploit the vulnerability is available to all possible adversaries. Publication in that case might help other adversaries more than it helps defenders.

So although \(\cdot\cdot\cdot p \cdot A\) does not require an immediate transition to \(\cdot\cdot\cdot P \cdot A\) the way \(\cdot\cdot\cdot pX \cdot \xrightarrow{\mathbf{P}} \cdot\cdot\cdot PX \cdot\) does, it is plausible that P becomes more likely while attacks are occurring.

Formalism

The probability \(P\) of public awareness given attacks observed is greater than the probability of public awareness without attacks observed.

\[ P(\mathbf{P} \mid \cdot\cdot\cdot p \cdot A) > P(\mathbf{P} \mid \cdot\cdot\cdot p \cdot a) \]

The reason is that there are more ways for the public to discover the vulnerability when attacks are happening than when they are not. For states in \(\cdot\cdot\cdot p \cdot a\), public awareness depends on the normal process of vulnerability discovery and reporting. States in \(\cdot\cdot\cdot p \cdot A\) add the possibility of discovery through security incident analysis. Hence:

Once attacks have been observed, fix development SHOULD accelerate, the embargo teardown process SHOULD begin, and publication and deployment SHOULD follow as soon as is practical.

CS Model Diagrams

The two diagrams below put these rules together.

The simplified CS model diagram

The simplified diagram shows only the parallelism between the Participant-specific Vendor fix path and the Participant-agnostic public, exploit, and attack substates. It omits the interactions between the two, which the rules above impose.

---
title: Case State Diagram showing Participant-Agnostic and Participant-Specific Aspects
---
stateDiagram-v2
    direction LR
    CS: Case State Model
    state CS {
        ps: Participant-Specific
        state ps {
            [*] --> vfd
            vfd --> Vfd : V
            Vfd --> VFd : F
            VFd --> VFD : D
            VFD --> [*]
        }
        --
        g: Participant-Agnostic 
        state g {
            [*] --> pxa

            pxa --> Pxa : P
            pxa --> pXa : X
            pxa --> pxA : A

            pXa --> PXa : P
            pXa --> pXA : A

            pxA --> PxA : P
            pxA --> pXA : X

            Pxa --> PxA : A
            Pxa --> PXa : X

            pXA --> PXA : P
            PXa --> PXA : A
            PxA --> PXA : X
            PXA --> [*]
        }
    }
    [*] --> CS
    CS --> [*]

The full CS model diagram

The full diagram shows all 32 states and every allowed transition. Each point along the Vendor fix path corresponds to an instance of the public, exploit, and attack diagram, drawn as one of four macrostates embedded in the larger model.

---
title: Case State Diagram
---
stateDiagram-v2
    direction LR
    VendorUnaware: Vendor Unaware
    VendorAware: Vendor Aware
    FixReady: Fix Ready
    FixDeployed: Fix Deployed
    state VendorUnaware {
        vfdpxa
        vfdPxa
        vfdpXa 
        vfdPXa
        vfdpxA
        vfdPxA
        vfdpXA
        vfdPXA 
   }
   state VendorAware {
        Vfdpxa
        VfdPxa
        VfdpXa 
        VfdPXa
        VfdpxA
        VfdPxA
        VfdpXA
        VfdPXA 
   } 
   state FixReady {
        VFdpxa
        VFdPxa
        VFdpXa 
        VFdPXa
        VFdpxA
        VFdPxA
        VFdpXA
        VFdPXA
   }
   state FixDeployed {
        VFDpxa
        VFDPxa
        VFDpXa 
        VFDPXa
        VFDpxA
        VFDPxA
        VFDpXA
        VFDPXA
    }
    [*] --> vfdpxa
    vfdpxa --> vfdPxa : P
    vfdpxa --> vfdpXa : X
    vfdpXa --> vfdPXa : P
    vfdpxa --> vfdpxA : A
    vfdpxA --> vfdPxA : P
    vfdpxA --> vfdpXA : X
    vfdpXA --> vfdPXA : P
    vfdpxa --> Vfdpxa : V
    vfdpxA --> VfdpxA : V
    vfdPxa --> VfdPxa : V
    vfdPXa --> VfdPXa : V
    vfdPxA --> VfdPxA : V
    vfdPXA --> VfdPXA : V
    Vfdpxa --> VfdPxa : P
    Vfdpxa --> VfdpXa : X
    VfdpXa --> VfdPXa : P
    Vfdpxa --> VfdpxA : A
    VfdpxA --> VfdPxA : P
    VfdpxA --> VfdpXA : X
    VfdpXA --> VfdPXA : P
    VfdPxa --> VfdPxA : A
    VfdPxa --> VfdPXa : X
    VfdPXa --> VfdPXA : A
    VfdPxA --> VfdPXA : X
    Vfdpxa --> VFdpxa : F
    VfdpxA --> VFdpxA : F
    VfdPxa --> VFdPxa : F
    VfdPXa --> VFdPXa : F
    VfdPxA --> VFdPxA : F
    VfdPXA --> VFdPXA : F
    VFdpxa --> VFdPxa : P
    VFdpxa --> VFdpXa : X
    VFdpXa --> VFdPXa : P
    VFdpxa --> VFdpxA : A
    VFdpxA --> VFdPxA : P
    VFdpxA --> VFdpXA : X
    VFdpXA --> VFdPXA : P
    VFdPxa --> VFdPxA : A
    VFdPxa --> VFdPXa : X
    VFdPXa --> VFdPXA : A
    VFdPxA --> VFdPXA : X
    VFdpxa --> VFDpxa : D
    VFdpxA --> VFDpxA : D
    VFdPxa --> VFDPxa : D
    VFdPXa --> VFDPXa : D
    VFdPxA --> VFDPxA : D
    VFdPXA --> VFDPXA : D
    VFDpxa --> VFDPxa : P
    VFDpxa --> VFDpXa : X
    VFDpXa --> VFDPXa : P
    VFDpxa --> VFDpxA : A
    VFDpxA --> VFDPxA : P
    VFDpxA --> VFDpXA : X
    VFDpXA --> VFDPXA : P
    VFDPxa --> VFDPxA : A
    VFDPxa --> VFDPXa : X
    VFDPXa --> VFDPXA : A
    VFDPxA --> VFDPXA : X
    VFDPXA --> [*]

The four macrostates behave differently.

Macrostate Behavior
Vendor Unaware (vfd) The least stable of the four. Many of its internal transitions are disallowed, owing to the instability of both \(vP\) and \(pX\), so a case is more likely to leave it than to leave the others. In practice, Vendors are likely to become aware of vulnerabilities in their products unless adversaries work hard to prevent it.
Vendor Aware (Vfd) The Vendor is aware of the vulnerability, but the fix is not yet ready. A case remains in Vfd until the Vendor produces a fix.
Fix Available (VFd) A fix is available but not yet deployed. Many publicly disclosed vulnerabilities spend a sizable amount of time here, awaiting action by system owners or Deployers.
Fix Deployed (VFD) A sink: once reached, there are no exits. Attacks attempted here are expected to fail. The more systems one is concerned with, the less certain one can be of having reached it: one patched instance is easy to confirm, but the last of thousands across an enterprise is not.

A Regular Grammar for the CS model

The full CS model diagram above can be summarized as a right-linear grammar \(\delta^{cs}\). Each rule lists the events that can fire from one state and the state each event leads to. The grammar and the diagram describe the same set of transitions.

CS Transition Function (\(\delta^{cs}\)) Defined

\(\delta^{cs} = \begin{cases} vfdpxa &\to \mathbf{V}~Vfdpxa~|~\mathbf{P}~vfdPxa~|~\mathbf{X}~vfdpXa~|~\mathbf{A}~vfdpxA \\ vfdpxA &\to \mathbf{V}~VfdpxA~|~\mathbf{P}~vfdPxA~|~\mathbf{X}~vfdpXA \\ vfdpXa &\to \mathbf{P}~vfdPXa \\ vfdpXA &\to \mathbf{P}~vfdPXA \\ vfdPxa &\to \mathbf{V}~VfdPxa \\ vfdPxA &\to \mathbf{V}~VfdPxA \\ vfdPXa &\to \mathbf{V}~VfdPXa \\ vfdPXA &\to \mathbf{V}~VfdPXA \\ Vfdpxa &\to \mathbf{F}~VFdpxa~|~\mathbf{P}~VfdPxa~|~\mathbf{X}~VfdpXa~|~\mathbf{A}~VfdpxA \\ VfdpxA &\to \mathbf{F}~VFdpxA ~|~ \mathbf{P}~VfdPxA ~|~ \mathbf{X}~VfdpXA \\ VfdpXa &\to \mathbf{P}~VfdPXa \\ VfdpXA &\to \mathbf{P}~VfdPXA \\ VfdPxa &\to \mathbf{F}~VFdPxa ~|~ \mathbf{X}~VfdPXa ~|~ \mathbf{A}~VfdPxA \\ VfdPxA &\to \mathbf{F}~VFdPxA ~|~ \mathbf{X}~VfdPXA \\ VfdPXa &\to \mathbf{F}~VFdPXa ~|~ \mathbf{A}~VfdPXA \\ VfdPXA &\to \mathbf{F}~VFdPXA \\ VFdpxa &\to \mathbf{D}~VFDpxa~|~\mathbf{P}~VFdPxa ~|~ \mathbf{X}~VFdpXa ~|~ \mathbf{A}~VFdpxA \\ VFdpxA &\to \mathbf{D}~VFDpxA ~|~ \mathbf{P}~VFdPxA ~|~ \mathbf{X}~VFdpXA \\ VFdpXa &\to \mathbf{P}~VFdPXa \\ VFdpXA &\to \mathbf{P}~VFdPXA \\ VFdPxa &\to \mathbf{D}~VFDPxa ~|~ \mathbf{X}~VFdPXa ~|~ \mathbf{A}~VFdPxA \\ VFdPxA &\to \mathbf{D}~VFDPxA ~|~ \mathbf{X}~VFdPXA \\ VFdPXa &\to \mathbf{D}~VFDPXa ~|~ \mathbf{A}~VFdPXA \\ VFdPXA &\to \mathbf{D}~VFDPXA \\ VFDpxa &\to \mathbf{P}~VFDPxa ~|~ \mathbf{X}~VFDpXa ~|~ \mathbf{A}~VFDpxA \\ VFDpxA &\to \mathbf{P}~VFDPxA ~|~ \mathbf{X}~VFDpXA \\ VFDpXa &\to \mathbf{P}~VFDPXa \\ VFDpXA &\to \mathbf{P}~VFDPXA \\ VFDPxa &\to \mathbf{X}~VFDPXa ~|~ \mathbf{A}~VFDPxA \\ VFDPxA &\to \mathbf{X}~VFDPXA \\ VFDPXa &\to \mathbf{A}~VFDPXA \\ VFDPXA &\to \varepsilon \\ \end{cases}\)

Together with the states \(\mathcal{Q}^{cs}\), start state \(q^{cs}_0\), and final states \(\mathcal{F}^{cs}\) defined in CS States, the input symbols \(\Sigma^{cs}\) and this grammar complete the CS model's 5-tuple.

Case State Model \((\mathcal{Q},q_0,\mathcal{F},\Sigma,\delta)^{cs}\) Fully Defined
\[CS = \begin{pmatrix} \begin{aligned} \mathcal{Q}^{cs} = & \text{the 32 states } vfdpxa \dots VFDPXA \text{ of CS States}, \\ q^{cs}_0 = & vfdpxa, \\ \mathcal{F}^{cs} = & \{VFDPXA\}, \\ \Sigma^{cs} = & \{\mathbf{V},\mathbf{F},\mathbf{D},\mathbf{P},\mathbf{X},\mathbf{A}\}, \\ \delta^{cs} = & \text{the grammar above} \end{aligned} \end{pmatrix}\]

For more information

Possible Histories examines the strings this grammar generates as the possible histories of CVD cases. Their implications for measuring the efficacy of the CVD process are developed further in A State-Based Model for Multi-Party Coordinated Vulnerability Disclosure.