ARVO: Atlas of Reproducible Vulnerabilities for Open Source Software
Fuente:
arXiv
Enregistré dans:
| Auteurs principaux: | , , , , , , , , , , , |
|---|---|
| Format: | Preprint |
| Publié: |
2024
|
| Sujets: | |
| Accès en ligne: | |
| Tags: |
Ajouter un tag
Pas de tags, Soyez le premier à ajouter un tag!
|
| _version_ | 1866909279711133696 |
|---|---|
| author | Mei, Xiang Singaria, Pulkit Singh Del Castillo, Jordi Xi, Haoran Abdelouahab Benchikh Bao, Tiffany Wang, Ruoyu Shoshitaishvili, Yan Doupé, Adam Pearce, Hammond Dolan-Gavitt, Brendan |
| author_facet | Mei, Xiang Singaria, Pulkit Singh Del Castillo, Jordi Xi, Haoran Abdelouahab Benchikh Bao, Tiffany Wang, Ruoyu Shoshitaishvili, Yan Doupé, Adam Pearce, Hammond Dolan-Gavitt, Brendan |
| contents | High-quality datasets of real-world vulnerabilities are enormously valuable for downstream research in software security, but existing datasets are typically small, require extensive manual effort to update, and are missing crucial features that such research needs. In this paper, we introduce ARVO: an Atlas of Reproducible Vulnerabilities in Open-source software. By sourcing vulnerabilities from C/C++ projects that Google's OSS-Fuzz discovered and implementing a reliable re-compilation system, we successfully reproduce more than 5,000 memory vulnerabilities across over 250 projects, each with a triggering input, the canonical developer-written patch for fixing the vulnerability, and the ability to automatically rebuild the project from source and run it at its vulnerable and patched revisions. Moreover, our dataset can be automatically updated as OSS-Fuzz finds new vulnerabilities, allowing it to grow over time. We provide a thorough characterization of the ARVO dataset, show that it can locate fixes more accurately than Google's own OSV reproduction effort, and demonstrate its value for future research through two case studies: firstly evaluating real-world LLM-based vulnerability repair, and secondly identifying over 300 falsely patched (still-active) zero-day vulnerabilities from projects improperly labeled by OSS-Fuzz. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2408_02153 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | ARVO: Atlas of Reproducible Vulnerabilities for Open Source Software Mei, Xiang Singaria, Pulkit Singh Del Castillo, Jordi Xi, Haoran Abdelouahab Benchikh Bao, Tiffany Wang, Ruoyu Shoshitaishvili, Yan Doupé, Adam Pearce, Hammond Dolan-Gavitt, Brendan Cryptography and Security Artificial Intelligence Machine Learning High-quality datasets of real-world vulnerabilities are enormously valuable for downstream research in software security, but existing datasets are typically small, require extensive manual effort to update, and are missing crucial features that such research needs. In this paper, we introduce ARVO: an Atlas of Reproducible Vulnerabilities in Open-source software. By sourcing vulnerabilities from C/C++ projects that Google's OSS-Fuzz discovered and implementing a reliable re-compilation system, we successfully reproduce more than 5,000 memory vulnerabilities across over 250 projects, each with a triggering input, the canonical developer-written patch for fixing the vulnerability, and the ability to automatically rebuild the project from source and run it at its vulnerable and patched revisions. Moreover, our dataset can be automatically updated as OSS-Fuzz finds new vulnerabilities, allowing it to grow over time. We provide a thorough characterization of the ARVO dataset, show that it can locate fixes more accurately than Google's own OSV reproduction effort, and demonstrate its value for future research through two case studies: firstly evaluating real-world LLM-based vulnerability repair, and secondly identifying over 300 falsely patched (still-active) zero-day vulnerabilities from projects improperly labeled by OSS-Fuzz. |
| title | ARVO: Atlas of Reproducible Vulnerabilities for Open Source Software |
| topic | Cryptography and Security Artificial Intelligence Machine Learning |
| url | https://arxiv.org/abs/2408.02153 |