CVEfixes: Automated Collection of Vulnerabilities and Their Fixes from Open-Source Software

Abstract

Data-driven research on the automated discovery and repair of security vulnerabilities in source code requires comprehensive datasets of real-life vulnerable code and their fixes. To assist in such research, we propose a method to automatically collect and curate a comprehensive vulnerability dataset from Common Vulnerabilities and Exposures (CVE) records in the public National Vulnerability Database (NVD). We implement our approach in a fully automated dataset collection tool and share an initial release of the resulting vulnerability dataset named CVEfixes. The CVEfixes collection tool automatically fetches all available CVE records from the NVD, gathers the vulnerable code and corresponding fixes from associated open-source repositories, and organizes the collected information in a relational database. Moreover, the dataset is enriched with meta-data such as programming language, and detailed code and security metrics at five levels of abstraction. The collection can easily be repeated to keep up-to-date with newly discovered or patched vulnerabilities. The initial release of CVEfixes spans all published CVEs up to 9 June 2021, covering 5365 CVE records for 1754 open-source projects that were addressed in a total of 5495 vulnerability fixing commits. CVEfixes supports various types of data-driven software security research, such as vulnerability prediction, vulnerability classification, vulnerability severity prediction, analysis of vulnerability-related code changes, and automated vulnerability repair.

Accepted for publication in Proceedings of the 17th International Conference on Predictive Models and Data Analytics in Software Engineering (PROMISE '21), August 19-20, 2021, Athens, Greece

References in corpus (3)

• VulDeePecker: A Deep Learning-Based System for Vulnerability Detection
• $\mu$VulDeePecker: A Deep Learning-Based System for Multiclass Vulnerability Detection
• World of Code: Enabling a Research Workflow for Mining and Analyzing the Universe of Open Source VCS data

Cited by in corpus (15)

• Neural Transfer Learning for Repairing Security Vulnerabilities in C Code
• Large Language Models for Code: Security Hardening and Adversarial Testing
• How Effective Are Neural Networks for Fixing Security Vulnerabilities
• Finetuning Large Language Models for Vulnerability Detection
• MegaVul: A C/C++ Vulnerability Dataset with Comprehensive Code Representation
• The EarlyBIRD Catches the Bug: On Exploiting Early Layers of Encoder Models for More Efficient Code Classification
• Vulnerability Handling of AI-Generated Code -- Existing Solutions and Open Challenges
• sec-certs: Examining the security certification practice for better vulnerability mitigation
• Enabling Automatic Repair of Source Code Vulnerabilities Using Data-Driven Methods
• Automated Code-centric Software Vulnerability Assessment: How Far Are We? An Empirical Study in C/C++
• Understanding the Changing Landscape of Automotive Software Vulnerabilities: Insights from a Seven-Year Analysis
• SPVR: syntax-to-prompt vulnerability repair based on large language models
• LLaVul: A Multimodal LLM for Interpretable Vulnerability Reasoning about Source Code
• Vulnerability Propagation in Package Managers Used in iOS Development
• From Evaluation to Optimisation: Hierarchy-Aware Training Signals for CWE Prediction in Python