Uncovering Recurring Vulnerabilities through Taint-Extracted Operator Sequences

Recurring vulnerabilities, caused by code reuse, spread into new software when developers copy flawed open-source code. Detecting these vulnerabilities is challenging due to limitations in accuracy, scalability, and vulnerability-type coverage. Recent advancements by Kang et al. [1] improved accuracy and scalability using taint analysis but had limited coverage. We propose OpSMAtcher (Operation Sequence Matcher), a comprehensive method leveraging taint analysis to extract sequences of operators and function calls as signatures, and employing string-matching algorithms and rule-based filters for accurate signature matching. Experiments show that OpSMAtcher supports 24 common vulnerability types with 0.768 precision and 0.721 recall, whereas a state-of-the-art tool supports only seven types with about 0.3 lower accuracy. Additionally, OpSMAtcher identified eight previously unknown recurring vulnerabilities in Debian packages, showing superior coverage and effectiveness over existing methods.