Enhancing Security in Third-Party Library Reuse -- Comprehensive Detection of 1-day Vulnerability through Code Patch Analysis
Shangzhi Xu, Jialiang Dong, Weiting Cai, Juanru Li, Arash Shaghaghi, Nan Sun, Siqi Ma
TL;DR
This work tackles 1-day vulnerabilities from third-party library reuse by introducing VULTURE, a two-component system: TPLFilter builds a platform-tailored TPL database using keyword-based selection and LLM-assisted commit slicing, while Vulture performs precise reuse detection and dual-mode 1-day vulnerability analysis. It combines function-level hashing, locality-sensitive hashing, birth-time information, and chunk-based analysis to handle exact and custom TPL reuses, linking reused code to CVE patches via CVE/NVD data and LLMS for patch mapping. Empirical results show Vulture outperforms state-of-the-art tools (e.g., V1SCAN, SNYK) in both TPL reuse detection and 1-day vulnerability detection, achieving high F1 scores (e.g., ~95.8% in benchmark) and real-world efficacy across IoT projects. The approach demonstrates practical improvements in detection speed, precision, and patch-retreival, supporting developers in secure TPL reuse and patch application in the software supply chain.
Abstract
Nowadays, software development progresses rapidly to incorporate new features. To facilitate such growth and provide convenience for developers when creating and updating software, reusing open-source software (i.e., thirdparty library reuses) has become one of the most effective and efficient methods. Unfortunately, the practice of reusing third-party libraries (TPLs) can also introduce vulnerabilities (known as 1-day vulnerabilities) because of the low maintenance of TPLs, resulting in many vulnerable versions remaining in use. If the software incorporating these TPLs fails to detect the introduced vulnerabilities and leads to delayed updates, it will exacerbate the security risks. However, the complicated code dependencies and flexibility of TPL reuses make the detection of 1-day vulnerability a challenging task. To support developers in securely reusing TPLs during software development, we design and implement VULTURE, an effective and efficient detection tool, aiming at identifying 1-day vulnerabilities that arise from the reuse of vulnerable TPLs. It first executes a database creation method, TPLFILTER, which leverages the Large Language Model (LLM) to automatically build a unique database for the targeted platform. Instead of relying on code-level similarity comparison, VULTURE employs hashing-based comparison to explore the dependencies among the collected TPLs and identify the similarities between the TPLs and the target projects. Recognizing that developers have the flexibility to reuse TPLs exactly or in a custom manner, VULTURE separately conducts version-based comparison and chunk-based analysis to capture fine-grained semantic features at the function levels. We applied VULTURE to 10 real-world projects to assess its effectiveness and efficiency in detecting 1-day vulnerabilities. VULTURE successfully identified 175 vulnerabilities from 178 reused TPLs.