{"id":120879,"date":"2024-12-06T21:45:59","date_gmt":"2024-12-06T19:46:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/google-opublikoval-vanir-staticheskij-analizator-dlya-vyyavleniya-neispravlennyh-uyazvimostej"},"modified":"2024-12-06T21:45:59","modified_gmt":"2024-12-06T19:46:00","slug":"google-opublikoval-vanir-staticheskij-analizator-dlya-vyyavleniya-neispravlennyh-uyazvimostej","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/google-opublikoval-vanir-staticheskij-analizator-dlya-vyyavleniya-neispravlennyh-uyazvimostej","title":{"rendered":"Google has released Vanir, a static analyzer for identifying unpatched vulnerabilities.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Google has introduced a new open project, Vanir, which enhances a static analyzer for automatically identifying unused patches that address vulnerabilities. Vanir utilizes a database of signatures that contains information about known vulnerabilities and patches to address them. This database has been maintained by Google since July 2020 and covers 95% of vulnerabilities in projects related to the Android platform, including the Linux kernel. Currently, it supports source code checks in C, C++, and Java. The Vanir code is written in C++ and Python, and is distributed under the BSD license. <\/p>\n
The project consists of two parts \u2014 a signature generator and a missed patches detector. The generator creates a signature for identifying the absence of a fix based on a vulnerability description in OSV format and a link to a patch or commit that resolves the vulnerability. Currently, it supports processing commits in repositories googlesource.com and git.codelinaro.org, but support for other services can easily be added by connecting a handler to extract code. <\/p>\n
The detector parses the code in the specified repository and determines the absence of fixes described in the provided signatures. The implementation is based on automatic signature refinement algorithms and multi-pattern analysis approaches proposed in the research projects ReDeBug and VUDDY. On a modern PC with a 16-core CPU, scanning the source code tree of the Android platform against the OSV database containing information on over 2000 vulnerabilities takes 10-20 minutes. The output generates a report listing potentially unpatched vulnerabilities along with links to their related code positions, CVE identifiers, and patches. According to statistics collected over two years of using Vanir at Google, the false positive rate is 2.72%.
<\/center>
<\/center> <\/p>\n
Advantages of the proposed toolkit: <\/p>\n
\n
The ability to identify unpatched vulnerabilities in third-party branches, modifications, and code borrowings that are not directly related to the main project. In the context of Android, the toolkit can be used to check the implementation of fixes in variants of the Android platform developed by device OEMs.\n
Conducting checks solely based on the analysis of existing code, without reference to metadata such as version number, commit history, and SBOM (Software Bill Of Materials).\n
Support for automatic signature generation using information about vulnerabilities that emerges from public sources and patches published by maintainers.\n
Higher performance of checks based on static analysis of source code compared to tools for dynamic analysis and verification of binary builds.\n
Self-sufficiency \u2014 the ability to deploy infrastructure on one's own systems without relying on external services.\n
Access to a ready-to-use up-to-date signature database, maintained by the Google Android Security Team.\n
Support for connectivity to continuous integration and delivery (CI\/CD) systems. The ability to integrate into other projects using Vanir in the form of libraries in Python.\n
The capability to adapt the system for tasks not related to vulnerabilities, for example, to identify code cloning or the use of licensed code in other projects. <\/ul>\n
![\"Google](\"\/wp-content\/uploads\/2024\/12\/2c0e972dd6294e148aabac3657a7f9e9.png\")
<\/center> ![\"Google](\"\/wp-content\/uploads\/2024\/12\/0dda2019ec266d89ae2bfaec43f72c33.png\")
<\/center> <\/p>\n