Abstract:Open-source software (OSS) has profoundly transformed the software development paradigm by facilitating effortless code reuse. However, in recent years, there has been an alarming increase in disclosed vulnerabilities within OSS, posing significant security risks to downstream users. Therefore, analyzing existing vulnerabilities and precisely assessing their threats to downstream applications become pivotal. Plenty of efforts have been made recently towards this problem, such as vulnerability reachability analysis and vulnerability reproduction. The key to these tasks is identifying the vulnerable function (i.e., the function where the root cause of a vulnerability resides). However, public vulnerability datasets (e.g., NVD) rarely include this information as pinpointing the exact vulnerable functions remains to be a longstanding challenge. Existing methods mainly detect vulnerable functions based on vulnerability patches or Proof-of-Concept (PoC). However, such methods face significant limitations due to data availability and the requirement for extensive manual efforts, thus hindering scalability. To address this issue, we propose a novel approach VFFinder that localizes vulnerable functions based on Common Vulnerabilities and Exposures (CVE) descriptions and the corresponding source code utilizing Large Language Models (LLMs). Specifically, VFFinder adopts a customized in-context learning (ICL) approach based on CVE description patterns to enable LLM to extract key entities. It then performs priority matching with the source code to localize vulnerable functions. We assess the performance of VFFinder on 75 large open-source projects. The results demonstrate that VFFinder surpasses existing baselines significantly. Notably, the Top-1 and MRR metrics have been improved substantially, averaging 4.25X and 2.37X respectively. We also integrate VFFinder with Software Composition Analysis (SCA) tools, and the results show that our tool can reduce the false positive rates of existing SCA tools significantly.

VMPBL: Identifying Vulnerable Functions Based on Machine Learning Combining Patched Information and Binary Comparison Technique by LCS.

Function-Level Vulnerability Detection Through Fusing Multi-Modal Knowledge

Patchmatch: A Tool for Locating Patches of Open Source Project Vulnerabilities

Fine-grained Commit-level Vulnerability Type Prediction by CWE Tree Structure.

Effective Vulnerable Function Identification Based on CVE Description Empowered by Large Language Models

Mvp: Detecting Vulnerabilities Using Patch-Enhanced Vulnerability Signatures

Combining Software Metrics and Text Features for Vulnerable File Prediction

Patch Based Vulnerability Matching for Binary Programs

PatchDiscovery: Patch Presence Test for Identifying Binary Vulnerabilities Based on Key Basic Blocks.

SemHunt: Identifying Vulnerability Type with Double Validation in Binary Code.

Approach of Leveraging Patches to Discover Unknown Vulnerabilities

CompVPD: Iteratively Identifying Vulnerability Patches Based on Human Validation Results with a Precise Context

BinVulDet: Detecting Vulnerability in Binary Program Via Decompiled Pseudo Code and BiLSTM-attention

Automatically Patching Vulnerabilities of Binary Programs Via Code Transfer from Correct Versions

VCIPR: Vulnerable Code is Identifiable When a Patch is Released (Hacker's Perspective)

VulMatch: Binary-level Vulnerability Detection Through Signature

Similar but Patched Code Considered Harmful -- The Impact of Similar but Patched Code on Recurring Vulnerability Detection and How to Remove Them

Towards Practical Binary Code Similarity Detection: Vulnerability Verification via Patch Semantic Analysis

VulPecker

VulDetectBench: Evaluating the Deep Capability of Vulnerability Detection with Large Language Models

VulMPFF: A Vulnerability Detection Method for Fusing Code Features in Multiple Perspectives