Chasing One-day Vulnerabilities Across Open Source Forks

Chasing One-day Vulnerabilities Across Open Source Forks Stefano Zacchiroli Polytechnic Institute of Paris [email protected] 21 Oct 2025 Rencontres Cyber IP Paris École polytechnique, Palaiseau, France Stefano Zacchiroli Chasing One-day Vulnerabilities 2025-10-21, Rencontres Cyber IP Paris 1 / 10 Outline 1Open source supply chain security 2Software Heritage 3Chasing one-day vulnerabilities across open source forks 4Conclusion Stefano Zacchiroli Chasing One-day Vulnerabilities 2025-10-21, Rencontres Cyber IP Paris 2 / 10 Open source security Open source software can be freely used, copied, and modified. Open Source Software (OSS) is everywhere Huge boost for innovation! (e.g., reduced time to market) 96% of (non-open) software products depend on open source (2022). Open source is at the heart of the global digital infrastructure. With great exposure comes great scrutiny... ...by both good and bad actors. OSS is more and more targeted by attackers. Increased policy attention to secure OSS, e.g.: US: executive orders (Biden 2022; Trump Jan 2025) EU: CRA, progressively coming into effect Stefano Zacchiroli Chasing One-day Vulnerabilities 2025-10-21, Rencontres Cyber IP Paris 2 / 10 Open source security Open source software can be freely used, copied, and modified. Open Source Software (OSS) is everywhere Huge boost for innovation! (e.g., reduced time to market) 96% of (non-open) software products depend on open source (2022). Open source is at the heart of the global digital infrastructure. With great exposure comes great scrutiny... ...by both good and bad actors. OSS is more and more targeted by attackers. Increased policy attention to secure OSS, e.g.: US: executive orders (Biden 2022; Trump Jan 2025) EU: CRA, progressively coming into effect Stefano Zacchiroli Chasing One-day Vulnerabilities 2025-10-21, Rencontres Cyber IP Paris 2 / 10 Software supply chain attacks Reusing OSS via dependencies Software dependencies: a popular way of reusing open source software. Software product Auses functionalities implemented in OSS product B...and so on. based on xkcd.com/2347 Attacking the software supply chain Attacking undermaintained "leaf" packages (e.g., D) →efficient attack strategy Many documented attacks: event-stream (2018), node-ipc (2022), XZ utils (2024), ... Stefano Zacchiroli Chasing One-day Vulnerabilities 2025-10-21, Rencontres Cyber IP Paris 3 / 10 Software supply chain attacks Reusing OSS via dependencies Software dependencies: a popular way of reusing open source software. Software product Auses functionalities implemented in OSS product B...and so on. based on xkcd.com/2347 Attacking the software supply chain Attacking undermaintained "leaf" packages (e.g., D) →efficient attack strategy Many documented attacks: event-stream (2018), node-ipc (2022), XZ utils (2024), ... Stefano Zacchiroli Chasing One-day Vulnerabilities 2025-10-21, Rencontres Cyber IP Paris 3 / 10 Outline 1Open source supply chain security 2Software Heritage 3Chasing one-day vulnerabilities across open source forks 4Conclusion Stefano Zacchiroli Chasing One-day Vulnerabilities 2025-10-21, Rencontres Cyber IP Paris 4 / 10 Software Heritage softwareheritage.org THE GR E AT LIBRARY OF SO U RCE CODE Collect, preserve and share all software source code Preserving our heritage, enabling better software and better science for all Reference catalog find and reference all software source code Universal archive preserve and share all software source code Research infrastructure enable analysis of all software source code Stefano Zacchiroli Chasing One-day Vulnerabilities 2025-10-21, Rencontres Cyber IP Paris 4 / 10 Software Heritage softwareheritage.org THE GR E AT LI BR A RY OF SOURCE CODE Collect, preserve and share all software source code Preserving our heritage, enabling better software and better science for all Reference catalog find and reference all software source code Universal archive preserve and share all software source code Research infrastructure enable analysis of all software source code Stefano Zacchiroli Chasing One-day Vulnerabilities 2025-10-21, Rencontres Cyber IP Paris 4 / 10 Securing open source with Software Heritage What does Software Heritage bring to the table? The largest archive that guarantees the: 1availability 2integrity →see SWHID (SoftWare Hash IDentifiers), ISO 18670 swhid.org 3traceability of (OSS) source code Auniversal, open knowledge base of facts about open source software... ...that can be leveraged by everyone (not only the big players) to secure OSS. SWHSec project swhsec.github.io 2023–2027 R&D project, funded by French national CampusCyber 8 research teams; co-led by Télécom Paris Axes: (1) extending SWH with security info + (2) code analysis, dependency analysis, vulnerability tracking, automatic vulnerability fixing, ... at SWH scale. Stefano Zacchiroli Chasing One-day Vulnerabilities 2025-10-21, Rencontres Cyber IP Paris 6 / 10 Securing open source with Software Heritage What does Software Heritage bring to the table? The largest archive that guarantees the: 1availability 2integrity →see SWHID (SoftWare Hash IDentifiers), ISO 18670 swhid.org 3traceability of (OSS) source code Auniversal, open knowledge base of facts about open source software... ...that can be leveraged by everyone (not only the big players) to secure OSS. SWHSec project swhsec.github.io 2023–2027 R&D project, funded by French national CampusCyber 8 research teams; co-led by Télécom Paris Axes: (1) extending SWH with security info + (2) code analysis, dependency analysis, vulnerability tracking, automatic vulnerability fixing, ... at SWH scale. Stefano Zacchiroli Chasing One-day Vulnerabilities 2025-10-21, Rencontres Cyber IP Paris 6 / 10 Outline 1Open source supply chain security 2Software Heritage 3Chasing one-day vulnerabilities across open source forks 4Conclusion Stefano Zacchiroli Chasing One-day Vulnerabilities 2025-10-21, Rencontres Cyber IP Paris 7 / 10 One-day vulnerabilities in open source One-day vulnerabilities Def.: vulnerabilities that are publicly known, but not fixed yet in software you use. Challenge: identify them quickly and exhaustively, then apply countermeasures. Many tools available to detect one-day vulnerabilities via declared dependencies. Reusing OSS via forks Open source is also reused via forking: (1) start from existing OSS (e.g., Teeworlds game), (2) create your own (e.g., DDnet), (3) periodically integrate changes. Stefano Zacchiroli Chasing One-day Vulnerabilities 2025-10-21, Rencontres Cyber IP Paris 7 / 10 One-day vulnerabilities in open source One-day vulnerabilities Def.: vulnerabilities that are publicly known, but not fixed yet in software you use. Challenge: identify them quickly and exhaustively, then apply countermeasures. Many tools available to detect one-day vulnerabilities via declared dependencies. Reusing OSS via forks Open source is also reused via forking: (1) start from existing OSS (e.g., Teeworlds game), (2) create your own (e.g., DDnet), (3) periodically integrate changes. Stefano Zacchiroli Chasing One-day Vulnerabilities 2025-10-21, Rencontres Cyber IP Paris 7 / 10 Vulnerability propagation through forks Any change to a piece of software (commit) can introduce a new vulnerability. Or it can fix an existing vulnerability. What happens if a project is forked between introduction and fix of a vulnerability? It inherits the vulnerability, ...until the change with the fix is integrated. Stefano Zacchiroli Chasing One-day Vulnerabilities 2025-10-21, Rencontres Cyber IP Paris 8 / 10 Vulnerability propagation through forks Any change to a piece of software (commit) can introduce a new vulnerability. Or it can fix an existing vulnerability. What happens if a project is forked between introduction and fix of a vulnerability? It inherits the vulnerability, ...until the change with the fix is integrated. Stefano Zacchiroli Chasing One-day Vulnerabilities 2025-10-21, Rencontres Cyber IP Paris 8 / 10 Vulnerability propagation through forks Any change to a piece of software (commit) can introduce a new vulnerability. Or it can fix an existing vulnerability. What happens if a project is forked between introduction and fix of a vulnerability? It inherits the vulnerability, ...until the change with the fix is integrated. Stefano Zacchiroli Chasing One-day Vulnerabilities 2025-10-21, Rencontres Cyber IP Paris 8 / 10 swh-vuln: chasing one-day vulnerabilities across forks... at SWH scale Approach 1Start from a public DB of vuln. introduced/fixed in public commits (e.g., OSV.dev). 2"Color" the entire graph of public code development history with vulnerability info. Software Heritage is the only place where this can be done at the scale of all forks, across all public code, independently of specific development platforms. 3Inform maintainers of vulnerable forks. (After validation.) Early results Identified 2.2 M (million) forks of repositories referenced by OSV.dev, containing vulnerable commits; 1.3 M forks vulnerable in their most recent commit. 86.6 M vulnerable commits were specific to forks, not findable with current tools. Among 66 manually vetted cases, 5 confirmed vulnerabilities (1 critical). Romain Lefeuvre, Charly Reux, Stefano Zacchiroli, Olivier Barais, Benoit Combemale Chasing One-day Vulnerabilities Across Open Source Forks To appear, 2025. Stefano Zacchiroli Chasing One-day Vulnerabilities 2025-10-21, Rencontres Cyber IP Paris 9 / 10 swh-vuln: chasing one-day vulnerabilities across forks... at SWH scale Approach 1Start from a public DB of vuln. introduced/fixed in public commits (e.g., OSV.dev). 2"Color" the entire graph of public code development history with vulnerability info. Software Heritage is the only place where this can be done at the scale of all forks, across all public code, independently of specific development platforms. 3Inform maintainers of vulnerable forks. (After validation.) Early results Identified 2.2 M (million) forks of repositories referenced by OSV.dev, containing vulnerable commits; 1.3 M forks vulnerable in their most recent commit. 86.6 M vulnerable commits were specific to forks, not findable with current tools. Among 66 manually vetted cases, 5 confirmed vulnerabilities (1 critical). Romain Lefeuvre, Charly Reux, Stefano Zacchiroli, Olivier Barais, Benoit Combemale Chasing One-day Vulnerabilities Across Open Source Forks To appear, 2025. Stefano Zacchiroli Chasing One-day Vulnerabilities 2025-10-21, Rencontres Cyber IP Paris 9 / 10