Datasetpublic

openSUSE/cve-backport-codegen-dataset

CVE Backport Code Generation Dataset Per-hunk code generation dataset for CVE security patch backporting, derived from openSUSE Build Service maintenance patches. Task Given a region of vulnerable source code and a description of the upstream CVE fix, the model outputs the fixed version of the code. A programmatic diff then produces the final patch. This plays to LLM strengths in code completion and avoids format-sensitivity issues with direct diff generation.… See the full description on the dataset page: https://huggingface.co/datasets/openSUSE/cve-backport-codegen-dataset.

sourceHugging Faceotherupdated 6mo agoView on Hugging Face

1likes49downloads

Dataset Card

CVE Backport Code Generation Dataset

Per-hunk code generation dataset for CVE security patch backporting, derived from openSUSE Build Service maintenance patches.

Task

Given a region of vulnerable source code and a description of the upstream CVE fix, the model outputs the fixed version of the code. A programmatic diff then produces the final patch. This plays to LLM strengths in code completion and avoids format-sensitivity issues with direct diff generation.

Files

File	Examples	Description
`train.jsonl`	36,166	Latest (v5) — all 3-turn codegen, no test generation
`eval.jsonl`	1,834	Held-out evaluation set (unchanged across versions)

Version History

Version	Examples	What changed
v5	36,166	All examples converted to 3-turn codegen (removed 772 five-turn test-gen examples from v4). Codegen-only focus improved adapted-tier recall from 86% to 90%
v4	36,168	+501 examples from source matching fix, 772 five-turn examples with CVE test cases
v3	35,778	Cleaned v2: removed 186 toxic examples (XML test data, DH prime tables, assembly blobs)
v2	24,452	Synthetic cross-version augmentation (+7,445 adapted-tier examples), more packages
v1	17,007	Initial dataset: per-hunk code generation from openSUSE maintenance patches

Format

All v5 examples use 3-turn ChatML format (system / user / assistant):

json

{
  "messages": [
    {"role": "system", "content": "You are a security patch backporting assistant..."},
    {"role": "user", "content": "## File: lib/url.c\n## Lines: 100-130\n\n```c\n{vulnerable code}\n```\n\n## Fix\nCVE-2024-1234: description"},
    {"role": "assistant", "content": "{fixed code}"}
  ],
  "metadata": {
    "cve_id": "CVE-2024-1234",
    "package": "curl",
    "language": "c",
    "tier": "identical",
    "suse_license": "MIT"
  }
}

Coverage

—2,300+ CVEs across 145 packages
—Languages: C (80%), Python (7%), C++ (3%), Shell, Perl, JavaScript, Java, Go, PHP, Ruby
—Tiers: identical (patch applies directly), adapted (context differs), synthetic-adapted (cross-version augmentation)
—99.8% per-example SPDX license metadata

Licenses

All training examples are derived from publicly available openSUSE Build Service maintenance patches. Per-example license metadata is in metadata.suse_license. The most common licenses are:

LGPL-2.1-or-later, OpenSSL, GPL-2.0-only, MIT, PHP-3.01, Apache-2.0, GPL-2.0-or-later, BSD-3-Clause, GPL-3.0-or-later, BSD-2-Clause, Python-2.0, MPL-2.0, ImageMagick

Model

Trained models are at openSUSE/CVE-Backport-Qwen2.5-Coder-32B.

The CLI tool for using the model is at github.com/openSUSE/cve-backport-tool.