Tracing Vulnerable Code Lineage

descriptionPublicationkeyboard_double_arrow_right Article , Conference object , Preprint 01 May 2021Embargo end date: 01 Jan 2021Publisher:IEEEJournal:2021 IEEE/ACM 18th International Conference on Mining Software Repositories (MSR)

Authors: David Reid; Kalvin Eng; Chris Bogart; Adam Tutko;

doi: 10.1109/msr52588.2021.00087 , 10.48550/arxiv.2103.12304 , 10.5281/zenodo.4627775 , 10.5281/zenodo.4627776

arXiv: 2103.12304

Tracing Vulnerable Code Lineage

- Summary
- Subjects
- Metrics

Abstract

This paper presents results from the MSR 2021 Hackathon. Our team investigates files/projects that contain known security vulnerabilities and how widespread they are throughout repositories in open source software. These security vulnerabilities can potentially be propagated through code reuse even when the vulnerability is fixed in different versions of the code. We utilize the World of Code infrastructure to discover file-level duplication of code from a nearly complete collection of open source software. This paper describes a method and set of tools to find all open source projects that use known vulnerable files and any previous revisions of those files.

Related Organizations

Carnegie Mellon University
United States
University of Alberta
Canada
University of Tennessee at Knoxville
United States
THE UNIVERSITY OF TENNESSEE
United States
Tennessee State University
United States

Keywords

Software Engineering (cs.SE), FOS: Computer and information sciences, Computer Science - Software Engineering, Computer Science - Cryptography and Security, Cryptography and Security (cs.CR)

Impact byBIP!

	selected citations These citations are derived from selected sources. This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).	1
	popularity This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network.	Average
	influence This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically).	Average
	impulse This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network.	Average