| Nome do aluno | Felipe de Sant'anna Paixão |
|---|---|
| Título do trabalho | An Empirical Study of Configuration-Dependent Vulnerabilities in Highly Configurable Systems |
| Resumo do trabalho |
Highly configurable systems implemented in C/C++ rely extensively on compile-time variability through preprocessor directives and build-system logic, resulting in an exponential configuration space. When security vulnerabilities are fixed via patches, only a subset of variants may actually contain the vulnerable code; however, current vulnerability disclosures rarely specify these compile-time conditions. This work introduces PatchLens, a purely static analysis approach that derives precise, human-readable Vulnerability Impact Conditions (VICs)—Boolean formulas over configuration options that characterize the set of variants affected by a security patch. PatchLens operates directly on unpreprocessed source code and unified diff patches, mapping modified hunks to abstract syntax tree (AST) subtrees, extracting surrounding conditional-compilation guards, resolving file-level inclusion constraints from project-specific build systems, and simplifying the resulting expressions. A large-scale empirical evaluation was conducted on security patches collected from the National Vulnerability Database and PatchDB, comprising thousands of patches across the Linux kernel, FFmpeg, and PHP. PatchLens successfully generated impact conditions for the vast majority of analyzable patches with an average processing time of approximately 47 milliseconds per patch. Manual inspection of 500 statistically sampled cases found no incorrect impact conditions and only occasional conservative over-approximations, indicating strong practical soundness. Our analysis reveals that most vulnerabilities depend on a small number of configuration options, and only a minority affect all possible variants. Moreover, vulnerabilities whose impact conditions are tautological—i.e., affecting every configuration—are associated with significantly higher CVSS impact scores. Finally, we show that existing CVE descriptions almost never mention the compile-time options that gate vulnerability exposure, highlighting a substantial opportunity for automated enrichment. These results demonstrate that patch-derived presence conditions can provide actionable, configuration-aware vulnerability information without requiring variant compilation, enabling targeted patch management, improved regression testing strategies, and data-driven security analyses in highly configurable systems. |
| Orientador | Eduardo Almeida |
| Membro Titular 1 (com afiliação) | Daniel Sadoc Menasché (UFRJ) |
| Link para o curriculum lattes |
https://lattes.cnpq.br/ |
| Membro Titular 2 (com afiliação) | Gustavo Figueiredo Bittencourt (IC-UFBA) |
| Link para o curriculum lattes |
https://lattes.cnpq.br/ |
| Suplente 1 (com afiliação) | Frederico Araujo Durao (IC-UFBA) |
| Suplente 2 (com afiliação) | Joanna Cecilia da Silva Santos (University of Notre Dame) |
| Data do exame | 10 Apr, 2026 |
| Horário do exame | 8:30 AM |
Data da Defesa:
10/04/2026 - 08:30
Tipo de Defesa:
Qualificação de Mestrado