VFCFinder: Pairing Security Advisories and Patches

Trevor Dunlap, Elizabeth Lin, William Enck, and Bradley Reaves

ACM ASIA Conference on Computer and Communications Security, 2024

Our natural-language-to-programming-language model matches vulnerability reports to their fixing commits with 96.6% top-5 recall, backfilling over 300 missing patch links accepted into the GitHub Security Advisory database.

Abstract

Security advisories are the primary channel of communication for discovered vulnerabilities in open-source software, but they often lack crucial information. Specifically, 63% of vulnerability database reports are missing their patch links, also referred to as vulnerability fixing commits (VFCs). This paper introduces VFCFinder, a tool that generates the top-five ranked set of VFCs for a given security advisory using Natural Language Programming Language (NL-PL) models. VFCFinder achieves a 96.6% recall for finding the correct VFC within the Top-5 commits, and an 80.0% recall for the Top-1 ranked commit. VFCFinder generalizes to nine different programming languages and outperforms state-of-the-art approaches by 36 percentage points in terms of Top-1 recall. As a practical contribution, we used VFCFinder to backfill over 300 missing VFCs in the GitHub Security Advisory (GHSA) database. All of the VFCs were accepted and merged into the GHSA database. In addition to demonstrating a practical pairing of security advisories to VFCs, our general open-source implementation will allow vulnerability database maintainers to drastically improve data quality, supporting efforts to secure the software supply chain.

Citation (IEEE)

T. Dunlap, E. Lin, W. Enck, and B. Reaves, “VFCFinder: Pairing Security Advisories and Patches,” in ACM ASIA Conference on Computer and Communications Security, 2024.

BibTeX

@inproceedings{dler24,
  author = {Dunlap, Trevor and Lin, Elizabeth and Enck, William and Reaves, Bradley},
  booktitle = {{ACM ASIA} Conference on Computer and Communications Security},
  date = {2024-07},
  title = {{VFCFinder}: Pairing Security Advisories and Patches},
}