Abstract:Open-source software (OSS) has profoundly transformed the software development paradigm by facilitating effortless code reuse. However, in recent years, there has been an alarming increase in disclosed vulnerabilities within OSS, posing significant security risks to downstream users. Therefore, analyzing existing vulnerabilities and precisely assessing their threats to downstream applications become pivotal. Plenty of efforts have been made recently towards this problem, such as vulnerability reachability analysis and vulnerability reproduction. The key to these tasks is identifying the vulnerable function (i.e., the function where the root cause of a vulnerability resides). However, public vulnerability datasets (e.g., NVD) rarely include this information as pinpointing the exact vulnerable functions remains to be a longstanding challenge. Existing methods mainly detect vulnerable functions based on vulnerability patches or Proof-of-Concept (PoC). However, such methods face significant limitations due to data availability and the requirement for extensive manual efforts, thus hindering scalability. To address this issue, we propose a novel approach VFFinder that localizes vulnerable functions based on Common Vulnerabilities and Exposures (CVE) descriptions and the corresponding source code utilizing Large Language Models (LLMs). Specifically, VFFinder adopts a customized in-context learning (ICL) approach based on CVE description patterns to enable LLM to extract key entities. It then performs priority matching with the source code to localize vulnerable functions. We assess the performance of VFFinder on 75 large open-source projects. The results demonstrate that VFFinder surpasses existing baselines significantly. Notably, the Top-1 and MRR metrics have been improved substantially, averaging 4.25X and 2.37X respectively. We also integrate VFFinder with Software Composition Analysis (SCA) tools, and the results show that our tool can reduce the false positive rates of existing SCA tools significantly.

MegaVul: A C/C++ Vulnerability Dataset with Comprehensive Code Representations.

MegaVul: A C/C++ Vulnerability Dataset with Comprehensive Code Representation

Fine-grained Commit-level Vulnerability Type Prediction by CWE Tree Structure.

Patchmatch: A Tool for Locating Patches of Open Source Project Vulnerabilities

DiverseVul: A New Vulnerable Source Code Dataset for Deep Learning Based Vulnerability Detection

VulZoo: A Comprehensive Vulnerability Intelligence Dataset

A ground-truth dataset of real security patches

A Large-Scale Empirical Study on Vulnerability Distribution Within Projects and the Lessons Learned

A Manually-Curated Dataset of Fixes to Vulnerabilities of Open-Source Software

eyeballvul: a future-proof benchmark for vulnerability detection in the wild

HeVulD: A Static Vulnerability Detection Method Using Heterogeneous Graph Code Representation

ReposVul: A Repository-Level High-Quality Vulnerability Dataset

Detecting code vulnerabilities by learning from large-scale open source repositories

Investigating Large Language Models for Code Vulnerability Detection: An Experimental Study

VulDetectBench: Evaluating the Deep Capability of Vulnerability Detection with Large Language Models

DeepVulSeeker: A novel vulnerability identification framework via code graph structure and pre-training mechanism

REEF: A Framework for Collecting Real-World Vulnerabilities and Fixes

SQVDT: A Scalable Quantitative Vulnerability Detection Technique for Source Code Security Assessment.

CleanVul: Automatic Function-Level Vulnerability Detection in Code Commits Using LLM Heuristics

Effective Vulnerable Function Identification Based on CVE Description Empowered by Large Language Models