Where is my Code Vulnerable: Matching CVEs and Source Code
summary
Canvass Labs builds a system that parses NVD English descriptions with a BERT NLP model to extract package names and version ranges, pulls GitHub snapshots to index every version, and creates AST-based code fingerprints so pasted or edited code still matches. A demo finds 29 repository matches for one snippet (3 tied to NVD entries), lookups return in under a second after preprocessing, exposes fixes and line-level diffs, and uses a human-in-the-loop UI to trim false positives; parts are open source, core scanner is proprietary.
AI-written summary · about
chapters (4)
- 0:00Start
- 2:21Solution • Create Databases: - Find vulnerable code in open source - Find package names/versions in NVD • Scan your source code to find vulnerabilities • Report the vulnerable code and its fix.
- 7:14CVE-2003-1045 Description votes.cgi in Bugzilla 2.16.3 and earlier, and 2.17.1 through 2.17.4, allows remote attackers to read a user's voting page when that user has voted on a restricted bug, which allows remote attackers to read potentially sensitive voting information by modifying the who parameter.
- 18:55Where is my Code Vulnerable: Matching CVEs and Source Code
related talks
16mPerformance improvements: exposing hidden security fixes in Open Source
53mThe Trials and Tribulations of Bulk Converting CVEs to OSV
36mUsing AI to Discover Silently Patched Vulnerabilities in Open...
24mUsing Python to Detect Vulnerabilities in Binaries
40mIs Your Code Secure?: Automatic Security Analysis Tools and Systems
15mA vulnerability database should not be about vulnerabilities!
21mState of Attack Surface Elimination in a World Plagued by Vulnerable Software
26mConfig Based CVE Matching for Linux Kernel