From 28a9289989f3cdf1fa7119a1ad8da77284c12ec4 Mon Sep 17 00:00:00 2001
From: KaraZajac <kara@soulstone.org>
Date: Mon, 8 Jun 2026 10:30:25 -0400
Subject: [PATCH] fix: normalize CVE_METADATA.json to sorted order
 (drift-check)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The weekly drift-check stayed red after v0.9.9's KEV+CWE fixes because of a
latent ordering bug: sudo_host (CVE-2025-32462), added in v0.9.8, was
appended to the end of CVE_METADATA.json instead of its sorted position.
check_drift compares the record list in discover_cves() sorted order, so
the misplaced entry read as drift independent of its field values.
Regenerated via tools/refresh-cve-metadata.py — sorted order restored, all
field values reconfirmed against CISA KEV + NVD in a clean fetch.
---
 core/cve_metadata.c    | 16 ++++++++--------
 docs/CVE_METADATA.json | 18 +++++++++---------
 docs/RELEASE_NOTES.md  |  7 +++++++
 3 files changed, 24 insertions(+), 17 deletions(-)

diff --git a/core/cve_metadata.c b/core/cve_metadata.c
index ab5fc80..045c908 100644
--- a/core/cve_metadata.c
+++ b/core/cve_metadata.c
@@ -236,6 +236,14 @@ const struct cve_metadata cve_metadata_table[] = {
         .in_kev              = false,
         .kev_date_added      = "",
     },
+    {
+        .cve                 = "CVE-2025-32462",
+        .cwe                 = "CWE-863",
+        .attack_technique    = "T1068",
+        .attack_subtechnique = NULL,
+        .in_kev              = false,
+        .kev_date_added      = "",
+    },
     {
         .cve                 = "CVE-2025-32463",
         .cwe                 = "CWE-829",
@@ -292,14 +300,6 @@ const struct cve_metadata cve_metadata_table[] = {
         .in_kev              = false,
         .kev_date_added      = "",
     },
-    {
-        .cve                 = "CVE-2025-32462",
-        .cwe                 = "CWE-863",
-        .attack_technique    = "T1068",
-        .attack_subtechnique = NULL,
-        .in_kev              = false,
-        .kev_date_added      = "",
-    },
 };
 
 const size_t cve_metadata_table_len =
diff --git a/docs/CVE_METADATA.json b/docs/CVE_METADATA.json
index 82583ed..44b1aaf 100644
--- a/docs/CVE_METADATA.json
+++ b/docs/CVE_METADATA.json
@@ -251,6 +251,15 @@
     "in_kev": false,
     "kev_date_added": ""
   },
+  {
+    "cve": "CVE-2025-32462",
+    "module_dir": "sudo_host_cve_2025_32462",
+    "cwe": "CWE-863",
+    "attack_technique": "T1068",
+    "attack_subtechnique": null,
+    "in_kev": false,
+    "kev_date_added": ""
+  },
   {
     "cve": "CVE-2025-32463",
     "module_dir": "sudo_chwoot_cve_2025_32463",
@@ -313,14 +322,5 @@
     "attack_subtechnique": null,
     "in_kev": false,
     "kev_date_added": ""
-  },
-  {
-    "cve": "CVE-2025-32462",
-    "module_dir": "sudo_host_cve_2025_32462",
-    "cwe": "CWE-863",
-    "attack_technique": "T1068",
-    "attack_subtechnique": null,
-    "in_kev": false,
-    "kev_date_added": ""
   }
 ]
diff --git a/docs/RELEASE_NOTES.md b/docs/RELEASE_NOTES.md
index 81a0dfa..be2dbc7 100644
--- a/docs/RELEASE_NOTES.md
+++ b/docs/RELEASE_NOTES.md
@@ -29,6 +29,13 @@ rules into `/etc/audit` legitimately needs root.
   after disclosure, NVD had not yet classified it; it is now **CWE-269**
   (Improper Privilege Management).
 
+A third, latent cause kept the gate red even after those two: when
+`sudo_host` (CVE-2025-32462) was added in v0.9.8 its record was appended to
+the *end* of `CVE_METADATA.json`, but the drift check compares the record
+list in `discover_cves()`'s sorted order — so the out-of-order entry read
+as drift regardless of its values. Regenerating via the script restores
+sorted order.
+
 Refreshed `CVE_METADATA.json`, the generated `cve_metadata.c` table, and
 `KEV_CROSSREF.md` accordingly (README + website counts updated).