Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Unveiling Security Weaknesses in Autonomous Driving Systems: An In-Depth Empirical Study

Wenyuan Cheng, Zengyang Li, Peng Liang, Ran Mo, Hui Liu

TL;DR

The paper investigates security weaknesses in ADS codebases, focusing on open-source projects Autoware, AirSim, and Apollo. It leverages CodeQL, a static analysis framework, to identify vulnerabilities across multiple versions and CWE categories (notably CWE-190 and CWE-20) and to examine their lifecycles and impact on ADS performance. Key contributions include a systematic vulnerability distribution map, lifecycle insights showing persistence across versions, and validation through developer feedback demonstrating CodeQL's practical utility. Findings highlight persistent security risks in perception-related modules and the role of third-party libraries in introducing build-time vulnerabilities, underscoring the need to embed static analysis into ADS development workflows.

Abstract

The advent of Autonomous Driving Systems (ADS) has marked a significant shift towards intelligent transportation, with implications for public safety and traffic efficiency. While these systems integrate a variety of technologies and offer numerous benefits, their security is paramount, as vulnerabilities can have severe consequences for safety and trust. This study aims to systematically investigate potential security weaknesses in the codebases of prominent open-source ADS projects using CodeQL, a static code analysis tool. The goal is to identify common vulnerabilities, their distribution and persistence across versions to enhance the security of ADS. We selected three representative open-source ADS projects, Autoware, AirSim, and Apollo, based on their high GitHub star counts and Level 4 autonomous driving capabilities. Using CodeQL, we analyzed multiple versions of these projects to identify vulnerabilities, focusing on CWE categories such as CWE-190 (Integer Overflow or Wraparound) and CWE-20 (Improper Input Validation). We also tracked the lifecycle of these vulnerabilities across software versions. This approach allows us to systematically analyze vulnerabilities in projects, which has not been extensively explored in previous ADS research. Our analysis revealed that specific CWE categories, particularly CWE-190 (59.6%) and CWE-20 (16.1%), were prevalent across the selected ADS projects. These vulnerabilities often persisted for over six months, spanning multiple version iterations. The empirical assessment showed a direct link between the severity of these vulnerabilities and their tangible effects on ADS performance. These security issues among ADS still remain to be resolved. Our findings highlight the need for integrating static code analysis into ADS development to detect and mitigate common vulnerabilities.

Unveiling Security Weaknesses in Autonomous Driving Systems: An In-Depth Empirical Study

TL;DR

The paper investigates security weaknesses in ADS codebases, focusing on open-source projects Autoware, AirSim, and Apollo. It leverages CodeQL, a static analysis framework, to identify vulnerabilities across multiple versions and CWE categories (notably CWE-190 and CWE-20) and to examine their lifecycles and impact on ADS performance. Key contributions include a systematic vulnerability distribution map, lifecycle insights showing persistence across versions, and validation through developer feedback demonstrating CodeQL's practical utility. Findings highlight persistent security risks in perception-related modules and the role of third-party libraries in introducing build-time vulnerabilities, underscoring the need to embed static analysis into ADS development workflows.

Abstract

The advent of Autonomous Driving Systems (ADS) has marked a significant shift towards intelligent transportation, with implications for public safety and traffic efficiency. While these systems integrate a variety of technologies and offer numerous benefits, their security is paramount, as vulnerabilities can have severe consequences for safety and trust. This study aims to systematically investigate potential security weaknesses in the codebases of prominent open-source ADS projects using CodeQL, a static code analysis tool. The goal is to identify common vulnerabilities, their distribution and persistence across versions to enhance the security of ADS. We selected three representative open-source ADS projects, Autoware, AirSim, and Apollo, based on their high GitHub star counts and Level 4 autonomous driving capabilities. Using CodeQL, we analyzed multiple versions of these projects to identify vulnerabilities, focusing on CWE categories such as CWE-190 (Integer Overflow or Wraparound) and CWE-20 (Improper Input Validation). We also tracked the lifecycle of these vulnerabilities across software versions. This approach allows us to systematically analyze vulnerabilities in projects, which has not been extensively explored in previous ADS research. Our analysis revealed that specific CWE categories, particularly CWE-190 (59.6%) and CWE-20 (16.1%), were prevalent across the selected ADS projects. These vulnerabilities often persisted for over six months, spanning multiple version iterations. The empirical assessment showed a direct link between the severity of these vulnerabilities and their tangible effects on ADS performance. These security issues among ADS still remain to be resolved. Our findings highlight the need for integrating static code analysis into ADS development to detect and mitigate common vulnerabilities.

Paper Structure

This paper contains 25 sections, 6 figures, 7 tables.

Table of Contents

  1. Introduction
  2. Research Design
  3. Research Questions
  4. Data Collection
  5. Select Projects and Versions
  6. Select Query Categories and Run
  7. Confirm Query results
  8. Data Analysis
  9. Results And Analysis
  10. Distribution of Vulnerabilities (RQ1)
  11. Distribution of Vulnerabilities in Different Categories
  12. Distribution of Vulnerabilities in Different Modules
  13. Life Cycle of Vulnerabilities (RQ2)
  14. Results of Manual Validation and Feedback from Developers (RQ3)
  15. Implications
  16. ...and 10 more sections

Figures (6)

  • Figure 1: Overall Structure of the Data Collection Process
  • Figure 2: Well-known ADS Projects on GitHub, Their Main Language, and Number of Stars. Note. The data is obtained on 2025.1.21. And while there are many famous ADS-related repositories on GitHub, they do not contain the whole system.
  • Figure 3: Workflow of CodeQL Vulnerability Detection
  • Figure 4: Relationships between Components in the Building Process
  • Figure 5: Distribution of CWE Vulnerabilities (RQ1). Note. The inner circle represents the error level, and the outer circle represents the warning level.
  • ...and 1 more figures