Abstract:Vulnerabilities publicly disclosed in the National Vulnerability Database (NVD) are assigned with CVE (Common Vulnerabilities and Exposures) IDs and associated with specific software versions. Many organizations, including IT companies and government, heavily rely on the disclosed vulnerabilities in NVD to mitigate their security risks. Once a software is claimed as vulnerable by NVD, these organizations would examine the presence of the vulnerable versions of the software and assess the impact on themselves. However, the version information about vulnerable software in NVD is not always reliable. Nguyen et al. find that the version information of many CVE vulnerabilities is spurious and propose an approach based on the original SZZ algorithm (i.e., an approach to identify bug-introducing commits) to assess the software versions affected by CVE vulnerabilities. However, SZZ algorithms are designed for common bugs, while vulnerabilities and bugs are different. Many bugs are introduced by a recent bug-fixing commit, but vulnerabilities are usually introduced in their initial versions. Thus, the current SZZ algorithms often fail to identify the inducing commits for vulnerabilities. Therefore, in this study, we propose an approach based on an improved SZZ algorithm to refine software versions affected by CVE vulnerabilities. Our proposed SZZ algorithm leverages the line mapping algorithms to identify the earliest commit that modified the vulnerable lines, and then considers these commits to be the vulnerability-inducing commits, as opposed to the previous SZZ algorithms that assume the commits that last modified the buggy lines as the inducing commits. To evaluate our proposed approach, we manually annotate the true inducing commits and verify the vulnerable versions for 172 CVE vulnerabilities with fixing commits from two publicly available datasets with five C/C++ and 41 Java projects, respectively. We find that 99 out of 172 vulnerabilities whose version information is spurious. The experiment results show that our proposed approach can identify more vulnerabilities with the true inducing commits and correct vulnerable versions than the previous SZZ algorithms. Our approach outperforms the previous SZZ algorithms in terms of F1-score for identifying vulnerability-inducing commits on both C/C++ and Java projects (0.736 and 0.630, respectively). For refining vulnerable versions, our approach also achieves the best performance on the two datasets in terms of F1-score (0.928 and 0.952).

Locating the Security Patches for Disclosed OSS Vulnerabilities with Vulnerability-Commit Correlation Ranking

Patchmatch: A Tool for Locating Patches of Open Source Project Vulnerabilities

PatchFinder: A Two-Phase Approach to Security Patch Tracing for Disclosed Vulnerabilities in Open-Source Software

Fine-grained Commit-level Vulnerability Type Prediction by CWE Tree Structure.

Unveil the Mystery of Critical Software Vulnerabilities

Vulnerabilities and Security Patches Detection in OSS: A Survey

Understanding the Practice of Security Patch Management Across Multiple Branches in OSS Projects

V-SZZ: Automatic Identification of Version Ranges Affected by CVE Vulnerabilities

PS3: Precise Patch Presence Test Based on Semantic Symbolic Signature

SPI: Automated Identification of Security Patches via Commits

Automated Unearthing of Dangerous Issue Reports.

Vulnerability discovery based on source code patch commit mining: a systematic literature review

Tracking Patches for Open Source Software Vulnerabilities

LLM-Enhanced Software Patch Localization

CompVPD: Iteratively Identifying Vulnerability Patches Based on Human Validation Results with a Precise Context

Repository-Level Graph Representation Learning for Enhanced Security Patch Detection

Dual Prompt-Based Few-Shot Learning for Automated Vulnerability Patch Localization

VFCFinder: Seamlessly Pairing Security Advisories and Patches

LLM-Enhanced Static Analysis for Precise Identification of Vulnerable OSS Versions

Pre-Patch: Find Hidden Threats In Open Software Based On Machine Learning Method

Patch2QL: Discover Cognate Defects in Open Source Software Supply Chain With Auto-generated Static Analysis Rules