Generating Mitigations for Downstream Projects to Neutralize Upstream Library Vulnerability

Abstract

Third-party libraries are essential in software development as they prevent the need for developers to recreate existing functionalities. However, vulnerabilities within these libraries pose significant risks to dependent projects. Upgrading dependencies is infeasible when no patched version is available or when downstream projects have strict version constraints. Moreover, repairing the vulnerability proves challenging when the source code of the library is inaccessible. State-of-the-art automatic vulnerability repair and automatic program repair methods both fail to address this issue. Therefore, mitigating library vulnerabilities without access to source code or available patches is crucial for a swift response to potential security attacks. Existing tools encounter challenges concerning generalizability and functional security. Upon vulnerability disclosure, LUMEN prepares a pool of candidate mitigation strategies by retrieving explicit workarounds from public sources and supplementing the pool with generated strategies based on vulnerability reproduction behavior. LUMEN then selects a suitable strategy, autonomously gathers repository-specific context, and adaptively generates a validated mitigation patch. We evaluate LUMEN on 474 impacted functions associated with 94 vulnerabilities. LUMEN successfully mitigates 393 functions, achieving a success rate of 82.91%, which substantially outperforms the adapted baseline in blocking vulnerability reproduction under our exploit-based evaluation. Additionally, our ablation study evaluates the contributions of strategy composition, strategy selection, and repository-level context collection. Further evaluations show that LUMEN can mitigate vulnerabilities disclosed after the knowledge cutoff of the base model.

arXiv commentTOSEM