Automated Detection of Configuration-Specific Security Vulnerabilities via Patch Analysis
For developers and security analysts of highly configurable software, PatchLens provides a scalable, explainable method to identify vulnerable variants, enabling targeted testing and automated CVE enrichment.
PatchLens automatically derives Boolean predicates (VICs) that specify which compile-time variants of configurable C/C++ systems contain a security vulnerability, without compiling any variant. Evaluated on 1,581 patches from Linux, FFmpeg, and PHP, it produces compact predicates (avg. 1-3 variables) and reveals that only a small fraction of vulnerabilities are system-wide, while CVE descriptions almost never encode the required options (≈1% recall).
We study how security patches in highly configurable C/C++ systems map onto the space of compile-time variants. We formalize the Vulnerability Impact Condition (VIC) - a Boolean predicate over configuration options that denotes all variants that contained the original flaw - and introduce PatchLens, a purely static technique that recovers VICs by aligning AST-level patch hunks with source-level presence conditions and resolving file inclusion via lightweight build system analysis. Evaluating PatchLens on 1,192 Linux kernel, 289 FFmpeg, and 100 PHP patches, we compute precise, human-readable VICs without the need to compile any system variant. The resulting predicates are compact (avg. 1.84 variables for Linux, 3.23 for FFmpeg, 1.04 for PHP) and show that only a small fraction of vulnerabilities are system-wide, which carry higher CVSS scores; meanwhile, CVE texts almost never encode the required options ($\approx$ 1% average recall), motivating automated enrichment of CVE descriptions with VICs. PatchLens and the accompanying dataset enable immediate applications in CI (variant-aware triage and test selection), targeted sampling and fuzzing, and feature risk scoring, offering a scalable, explainable path to vulnerability assessment in highly configurable software.