The extent of orphan vulnerabilities from code reuse in open source software
The extent of orphan vulnerabilities from code reuse in open source software
复制标题
开源软件中代码重用造成的孤立漏洞的程度
DOI：
10.1145/3510003.3510216
复制
发表时间：
2022
期刊：
影响因子：
--
通讯作者：
Mockus, Audris
中科院分区：
文献类型：
--
作者：
Reid, David;Jahanshahi, Mahmoud;Mockus, Audris
动机：开源软件的一个关键前提是能够将代码复制到其他开源项目（白盒重用）。这种复制加速了新项目的开发，但原始项目中的代码缺陷（如漏洞）也可能传播，即使在代码被挪用的项目中得到修复。通过代码重用传播漏洞的程度，这种传播的潜在影响，或减轻这些次要漏洞风险的途径尚未在几乎完整的开源代码集合的背景下进行研究。目的：我们的目标是找到检测白盒重用导致的漏洞的方法，确定它们的普遍程度，并探索如何解决它们。方法：我们依靠World of Code基础设施，它提供了几乎所有开源软件的策划和交叉引用集合，以进行一些已知漏洞的案例研究。为了进行我们的案例研究，我们开发了一个工具，VDiOS，以帮助识别和修复白盒重用引起的漏洞，这些漏洞已经在原始项目中打了补丁（孤儿漏洞）。结果：我们发现了许多孤儿漏洞的实例，即使在当前活跃和高度流行的项目中（超过1K星）。即使是表面上不活跃的项目，也仍然可以公开供其他人使用，并进一步传播脆弱性。即使在非常受欢迎的项目中，修复孤儿漏洞的时间也往往很长，这增加了它传播到新项目的机会。我们向许多项目维护人员提供了补丁，发现只有一小部分人接受并应用了补丁。我们希望VDiOS将导致进一步研究和减轻孤儿漏洞和其他孤儿代码缺陷的风险。
Motivation: A key premise of open source software is the ability to copy code to other open source projects (white-box reuse). Such copying accelerates development of new projects, but the code flaws in the original projects, such as vulnerabilities, may also spread even if fixed in the projects from where the code was appropriated. The extent of the spread of vulnerabilities through code reuse, the potential impact of such spread, or avenues for mitigating risk of these secondary vulnerabilities has not been studied in the context of a nearly complete collection of open source code.Aim: We aim to find ways to detect the white-box reuse induced vulnerabilities, determine how prevalent they are, and explore how they may be addressed.Method: We rely on World of Code infrastructure that provides a curated and cross-referenced collection of nearly all open source software to conduct a case study of a few known vulnerabilities. To conduct our case study we develop a tool, VDiOS, to help identify and fix white-box-reuse-induced vulnerabilities that have been already patched in the original projects (orphan vulnerabilities).Results: We find numerous instances of orphan vulnerabilities even in currently active and in highly popular projects (over 1K stars). Even apparently inactive projects are still publicly available for others to use and spread the vulnerability further. The often long delay in fixing orphan vulnerabilities even in highly popular projects increases the chances of it spreading to new projects. We provided patches to a number of project maintainers and found that only a small percentage accepted and applied the patch. We hope that VDiOS will lead to further study and mitigation of risks from orphan vulnerabilities and other orphan code flaws.