Name
Abstract | ||
|---|---|---|
Despite the effort of software maintainers, patches to open-source repositories are propagated from the main codebase to all the related projects (e.g., forks) with a significant delay. Previous work shows that this is true also for security patches, which represents a critical problem. Vulnerability databases, such as the CVE database, were born to speed-up the application of critical patches; however, patches associated with CVE entries (i.e., CVE patches) are still applied with a delay, and some security fixes lack the corresponding CVE entries. Because of this, project maintainers could miss security patches when upgrading software.In this paper, we are the first to define safe patches (sps). An sp is a patch that does not disrupt the intended functionality of the program (on valid inputs), meaning that it can be applied with no testing; we argue that most security fixes fall into this category. Furthermore, we show a technique to identify sps, and implement SPIDER
<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">1</sup>
, a tool based on such a technique that works by analyzing the source code of the original and patched versions of a file. We performed a large-scale evaluation on 341,767 patches from 32 large and popular source code repositories as well as on 809 CVE patches. Results show that SPIDER was able to identify 67,408 sps and that most of the CVE patches are sps. In addition, SPIDER identified 2,278 patches that fix vulnerabilities lacking a CVE; 229 of these are still unpatched in different vendor kernels, which can be considered as potential unfixed vulnerabilities. |
Year | DOI | Venue |
|---|---|---|
2020 | 10.1109/SP40000.2020.00038 | 2020 IEEE Symposium on Security and Privacy (SP) |
Keywords | DocType | ISSN |
fast patch propagation,CVE patches,source code repositories,patched versions,sps,safe patches,CVE entries,security fixes,critical patches,CVE database,security patches,open-source repositories,software maintainers,related software repositories,SPIDER | Conference | 1081-6011 |
ISBN | Citations | PageRank |
978-1-7281-3498-7 | 1 | 0.35 |
References | Authors | |
38 | 5 | |
Name | Order | Citations | PageRank |
|---|---|---|---|
| Aravind Machiry | 1 | 340 | 16.35 |
| Nilo Redini | 2 | 18 | 3.21 |
| Eric Camellini | 3 | 1 | 0.35 |
| Christopher Kruegel | 4 | 8799 | 516.05 |
| Giovanni Vigna | 5 | 7121 | 507.72 |