P2Patch finds bypasses and strengthens vulnerability repairs
In plain words
P2Patch is a system for repairing software vulnerabilities. One software agent finds an executable example of the flaw, another changes the program, and an execution referee checks whether the example still works. The first example becomes a repair requirement.
The system then searches the patched program for another route to the same flaw. In 41 of 101 C/C++ and Java repair runs, it found a confirmed bypass after the patch blocked the original example. That test shows why blocking one example alone can miss a remaining path.
The research
How can evaluators tell whether a software repair closes the reported vulnerability, rather than just blocking the example that guided it? Repair evidence often doubles as the success check, so one passed example can conceal another path for the same flaw.
P2Patch turns confirmed attacks on a patch into new repair requirements, then checks the result on independent attack tests.
Researchers compared P2Patch with single-pass repair from the same finding, without a live attack example or later bypass search. They measured, for each project, the share of conclusive held-out attack tests the patch blocked, then averaged across projects.
On tests blocked by the official fix, the averages were 0.847 for P2Patch and 0.781 for single-pass repair across 101 subjects.
On tests that also reproduce after the official fix, the averages were 0.625 and 0.421 across the 40 subjects with such suites. The orchestrator judged execution outcomes, while researchers calculated these averages.
The separate test groups show greater measured coverage on both paths the official fix closes and candidate paths it leaves open.
The attack search has a fixed budget, and the independently written test suites cover selected paths rather than the full input space. A stable run or high measured coverage therefore does not prove that a patch contains no vulnerability.
Analysis
Deep
- Original paper authors
- Mohsen Iranmanesh, Sina Moradi Sabet, Sina Marefat, Ali Javidi Ghasr, Maxime Newman Nereyabagabo
- Submitted to arXiv
- License
- arXiv non-exclusive