Using Program Analysis to Identify the Use of Vulnerable Functions
Hagberg, Rasmus ; Hell, Martin LU and Reichenbach, Christoph LU
(2021)
p.520-530
- Abstract
- Open-Source Software (OSS) is increasingly used by software applications. It allows for code reuse, but also comes with the problem of potentially being affected by the vulnerabilities that are found in the OSS libraries. With large numbers of OSS components and a large number of published vulnerabilities, it becomes challenging to identify and analyze which OSS components need to be patched and updated. In addition to matching vulnerable libraries to those used in software products, it is also necessary to analyze if the vulnerable functionality is actually used by the software. This process is both time-consuming and error-prone. Automating this process presents several challenges, but has the potential to significantly decrease... (More)
- Open-Source Software (OSS) is increasingly used by software applications. It allows for code reuse, but also comes with the problem of potentially being affected by the vulnerabilities that are found in the OSS libraries. With large numbers of OSS components and a large number of published vulnerabilities, it becomes challenging to identify and analyze which OSS components need to be patched and updated. In addition to matching vulnerable libraries to those used in software products, it is also necessary to analyze if the vulnerable functionality is actually used by the software. This process is both time-consuming and error-prone. Automating this process presents several challenges, but has the potential to significantly decrease vulnerability exposure time. In this paper, we propose a modular framework for analyzing if software code is using the vulnerable part of a library, by analyzing and matching the call graphs of the software with changes resulting from security patches. Further, we provide an implementation of the framework targeting Java and the Maven dependency management system. This allows us to identify 20% of the dependencies in our sample projects as false positives. We also identify and discuss challenges and limitations in our approach (Less)
- Abstract (Swedish)
- Open-source software (OSS) is increasingly used by software applications. It allows for code reuse, but also comes with the problem of potentially being affected by the vulnerabilities that are found in the OSS libraries. With large numbers of OSS components and a large number of published vulnerabilities, it becomes challenging to identify and analyze which OSS components need to be patched and updated. In addition to matching vulnerable libraries to those used in software products, it is also necessary to analyze if the vulnerable functionality is actually used by the software. This process is both time-consuming and error-prone. Automating this process presents several challenges, but has the potential to significantly decrease... (More)
- Open-source software (OSS) is increasingly used by software applications. It allows for code reuse, but also comes with the problem of potentially being affected by the vulnerabilities that are found in the OSS libraries. With large numbers of OSS components and a large number of published vulnerabilities, it becomes challenging to identify and analyze which OSS components need to be patched and updated. In addition to matching vulnerable libraries to those used in software products, it is also necessary to analyze if the vulnerable functionality is actually used by the software. This process is both time-consuming and error-prone. Automating this process presents several challenges, but has the potential to significantly decrease vulnerability exposure time. In this paper, we propose a modular framework for analyzing if software code is using the vulnerable part of a library, by analyzing and matching the call graphs of the software with changes resulting from security patches. Further, we provide an implementation of the framework targeting Java and the Maven dependency management system. This allows us to identify 20% of the dependencies in our sample projects as false positives. We also identify and discuss challenges and limitations in our approach. (Less)
Please use this url to cite or link to this publication:
https://lup.lub.lu.se/record/3dad7fa0-2960-4633-927f-082230f16580
- author
- Hagberg, Rasmus
; Hell, Martin
LU
and Reichenbach, Christoph
LU
- organization
- publishing date
- 2021
- type
- Chapter in Book/Report/Conference proceeding
- publication status
- published
- subject
- host publication
- 18th International Conference on Security and Cryptography, SECRYPT 2021
- pages
- 520 - 530
- publisher
- INSTICC Press
- external identifiers
-
- scopus:85111853356
- ISBN
- 978-989758524-1
- DOI
- 10.5220/0010548205230530
- project
- Säkra mjukvaruuppdateringar för den smarta staden
- WASP startup package Christoph Reichenbach
- language
- English
- LU publication?
- yes
- id
- 3dad7fa0-2960-4633-927f-082230f16580
- date added to LUP
- 2021-06-11 10:17:40
- date last changed
- 2022-05-05 02:00:40
@inproceedings{3dad7fa0-2960-4633-927f-082230f16580,
abstract = {{Open-Source Software (OSS) is increasingly used by software applications. It allows for code reuse, but also comes with the problem of potentially being affected by the vulnerabilities that are found in the OSS libraries. With large numbers of OSS components and a large number of published vulnerabilities, it becomes challenging to identify and analyze which OSS components need to be patched and updated. In addition to matching vulnerable libraries to those used in software products, it is also necessary to analyze if the vulnerable functionality is actually used by the software. This process is both time-consuming and error-prone. Automating this process presents several challenges, but has the potential to significantly decrease vulnerability exposure time. In this paper, we propose a modular framework for analyzing if software code is using the vulnerable part of a library, by analyzing and matching the call graphs of the software with changes resulting from security patches. Further, we provide an implementation of the framework targeting Java and the Maven dependency management system. This allows us to identify 20% of the dependencies in our sample projects as false positives. We also identify and discuss challenges and limitations in our approach}},
author = {{Hagberg, Rasmus and Hell, Martin and Reichenbach, Christoph}},
booktitle = {{18th International Conference on Security and Cryptography, SECRYPT 2021}},
isbn = {{978-989758524-1}},
language = {{eng}},
pages = {{520--530}},
publisher = {{INSTICC Press}},
title = {{Using Program Analysis to Identify the Use of Vulnerable Functions}},
url = {{http://dx.doi.org/10.5220/0010548205230530}},
doi = {{10.5220/0010548205230530}},
year = {{2021}},
}