Abstract:Open-source software (OSS) has profoundly transformed the software development paradigm by facilitating effortless code reuse. However, in recent years, there has been an alarming increase in disclosed vulnerabilities within OSS, posing significant security risks to downstream users. Therefore, analyzing existing vulnerabilities and precisely assessing their threats to downstream applications become pivotal. Plenty of efforts have been made recently towards this problem, such as vulnerability reachability analysis and vulnerability reproduction. The key to these tasks is identifying the vulnerable function (i.e., the function where the root cause of a vulnerability resides). However, public vulnerability datasets (e.g., NVD) rarely include this information as pinpointing the exact vulnerable functions remains to be a longstanding challenge. Existing methods mainly detect vulnerable functions based on vulnerability patches or Proof-of-Concept (PoC). However, such methods face significant limitations due to data availability and the requirement for extensive manual efforts, thus hindering scalability. To address this issue, we propose a novel approach VFFinder that localizes vulnerable functions based on Common Vulnerabilities and Exposures (CVE) descriptions and the corresponding source code utilizing Large Language Models (LLMs). Specifically, VFFinder adopts a customized in-context learning (ICL) approach based on CVE description patterns to enable LLM to extract key entities. It then performs priority matching with the source code to localize vulnerable functions. We assess the performance of VFFinder on 75 large open-source projects. The results demonstrate that VFFinder surpasses existing baselines significantly. Notably, the Top-1 and MRR metrics have been improved substantially, averaging 4.25X and 2.37X respectively. We also integrate VFFinder with Software Composition Analysis (SCA) tools, and the results show that our tool can reduce the false positive rates of existing SCA tools significantly.

Identifying Affected Libraries and Their Ecosystems for Open Source Software Vulnerabilities

Unveil the Mystery of Critical Software Vulnerabilities

Patchmatch: A Tool for Locating Patches of Open Source Project Vulnerabilities

Automated Unearthing of Dangerous Issue Reports.

Understanding the Threats of Upstream Vulnerabilities to Downstream Projects in the Maven Ecosystem.

Vision: Identifying Affected Library Versions for Open Source Software Vulnerabilities

Effective Vulnerable Function Identification Based on CVE Description Empowered by Large Language Models

Insight: Exploring Cross-Ecosystem Vulnerability Impacts.

Vulnerable Open Source Dependencies: Counting Those That Matter

Combining Software Metrics and Text Features for Vulnerable File Prediction

Vulnerabilities and Security Patches Detection in OSS: A Survey

DeepVuler: A Vulnerability Intelligence Mining System for Open-Source Communities

Vulnerability discovery based on source code patch commit mining: a systematic literature review

Exploiting Library Vulnerability via Migration Based Automating Test Generation

Explaining the Contributing Factors for Vulnerability Detection in Machine Learning

Identifying Vulnerable Third-Party Libraries from Textual Descriptions of Vulnerabilities and Libraries

LLM-Enhanced Static Analysis for Precise Identification of Vulnerable OSS Versions

A Method for Mining XML Data Describing Open-Source and Proprietary Software Vulnerabilities.

LLM-Enhanced Software Patch Localization

Mitigating Persistence of Open-Source Vulnerabilities in Maven Ecosystem

OSLDetector