Impact assessment of third-party library vulnerabilities through vulnerability reachability analysis

Abstract

Modern software development increasingly relies on third-party libraries (TPLs) to accelerate development, yet this practice introduces security risks when vulnerabilities emerge in dependencies. When a new TPL vulnerability is disclosed, project maintainers must assess whether their projects are affected, a process that demands considerable developer effort. Vulnerability reachability analysis automates this process by evaluating whether a client program’s control flow can reach the vulnerable TPL function. Despite the numerous advantages, however, existing vulnerability reachability analysis fail to account for the impact of path constraints, leading to false alarms by incorrectly identifying unreachable vulnerable functions as reachable. In this paper, we propose CPVRA, a novel impact assessment framework designed to reduce false alarms by incorporating a satisfiability assessment of path constraints into the analysis process. We evaluated CPVRA using a benchmark dataset comprising 201 test cases derived from 6 widely used TPLs and 24 dependent client programs. The results show that CPVRA reduced false alarms by 40.9% compared to Dep-scan and by 39.5% compared to standard vulnerability reachability analysis. Additionally, CPVRA demonstrated high computational efficiency, with an average analysis time of 15.3 s per client program.