Narrow – SCA Reachability Analysis Without The Effort
summary
Narrow is an open source Python tool that extracts fixes from CVE references (commits and PRs), finds changed functions via patch extraction, builds a static control flow graph over project plus dependencies and reports reachable vulnerable targets. On a small random sample it finds targets for ~21 of 71 reported vulns and verifies only one true exploit path, cutting triage from thousands of issues to a few dozen; recall is low (~20%), and it needs source, single entry points and struggles with dynamic callbacks and compiled deps.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 7:23How Narrow works
- 17:43Results and efficacy
- 21:56Trade-offs and limits
- 27:18Rolling out Narrow
- 37:11Prioritizing vulnerabilities
- 45:14Call to action
- 47:26Q&A
related talks
22mWhen is a vulnerability not a vulnerability? Overcoming the...
23mPrioritisation of SCA Findings in Software Dependencies Using Static Reachability Analysis
32mPruning Kernel CVEs With Code Reachability Analysis
38mEffective Usage Analysis: Boosting Developer Productivity Via Innovative, Noise-reduced Vulnerability Analysis
05mLightning Talk: Pruning the Kernel CVEs With Code Reachability Analysis
30mTopics of Interest: Effective Usage Analysis: The Shortest Path Between a Developer ...
49mOpen-source vulnerability management? Use the source, Luke!
34mHow To Find And Prevent Entire Classes Of Security Vulnerabilities