Abstract:Vulnerabilities publicly disclosed in the National Vulnerability Database (NVD) are assigned with CVE (Common Vulnerabilities and Exposures) IDs and associated with specific software versions. Many organizations, including IT companies and government, heavily rely on the disclosed vulnerabilities in NVD to mitigate their security risks. Once a software is claimed as vulnerable by NVD, these organizations would examine the presence of the vulnerable versions of the software and assess the impact on themselves. However, the version information about vulnerable software in NVD is not always reliable. Nguyen et al. find that the version information of many CVE vulnerabilities is spurious and propose an approach based on the original SZZ algorithm (i.e., an approach to identify bug-introducing commits) to assess the software versions affected by CVE vulnerabilities. However, SZZ algorithms are designed for common bugs, while vulnerabilities and bugs are different. Many bugs are introduced by a recent bug-fixing commit, but vulnerabilities are usually introduced in their initial versions. Thus, the current SZZ algorithms often fail to identify the inducing commits for vulnerabilities. Therefore, in this study, we propose an approach based on an improved SZZ algorithm to refine software versions affected by CVE vulnerabilities. Our proposed SZZ algorithm leverages the line mapping algorithms to identify the earliest commit that modified the vulnerable lines, and then considers these commits to be the vulnerability-inducing commits, as opposed to the previous SZZ algorithms that assume the commits that last modified the buggy lines as the inducing commits. To evaluate our proposed approach, we manually annotate the true inducing commits and verify the vulnerable versions for 172 CVE vulnerabilities with fixing commits from two publicly available datasets with five C/C++ and 41 Java projects, respectively. We find that 99 out of 172 vulnerabilities whose version information is spurious. The experiment results show that our proposed approach can identify more vulnerabilities with the true inducing commits and correct vulnerable versions than the previous SZZ algorithms. Our approach outperforms the previous SZZ algorithms in terms of F1-score for identifying vulnerability-inducing commits on both C/C++ and Java projects (0.736 and 0.630, respectively). For refining vulnerable versions, our approach also achieves the best performance on the two datasets in terms of F1-score (0.928 and 0.952).

ViolationTracker: Building Precise Histories for Static Analysis Violations

Towards Understanding Fixes of SonarQube Static Analysis Violations: A Large-Scale Empirical Study

Static Information Flow Tracking Based Approach to Detect Input Validation Vulnerabilities

Tracking the Evolution of Static Code Warnings: The State-of-the-Art and a Better Approach

Automatic, High Accuracy Prediction of Reopened Bugs

A Differential Testing Approach for Evaluating Abstract Syntax Tree Mapping Algorithms

V-SZZ: Automatic Identification of Version Ranges Affected by CVE Vulnerabilities

Extracting Fix Patterns for Static Analysis Violations Based on Collective Developer Knowledge

Detecting Semantic Conflicts using Static Analysis

Reducing False Positives of Static Bug Detectors Through Code Representation Learning

AVPredictor: Comprehensive Prediction and Detection of Atomicity Violations

Guiding Log Revisions by Learning from Software Evolution History

Automatic Traceability Maintenance via Machine Learning Classification

Logtracker

Refactoring-aware Block Tracking in Commit History

Detect Atomicity Violations in Concurrent Programs Through User Assistance and Identification of Suspicious Variable Access Patterns

Automatic Construction of an Effective Training Set for Prioritizing Static Analysis Warnings.

A Study of Static Warning Cascading Tools (Experience Paper)

Validating Static Warnings via Testing Code Fragments

How to Find Actionable Static Analysis Warnings: A Case Study with FindBugs

Towards Automated Identification of Violation Symptoms of Architecture Erosion