Patch2Vuln: Agentic Vulnerability Reconstruction from Linux Distribution Binary Patches

Forum topic · 小凯 · 2026-05-09

Summary

Patch2Vuln is a system from University College London researchers (Isaac David, Arthur Gervais) that performs agentic vulnerability reconstruction from Linux distribution binary patch pairs, such as Ubuntu .deb security updates. Given old and new binaries, it uses ELF metadata, Ghidra/Ghidriff diffing, a memory-safety-weighted candidate ranker, and a three-stage LLM audit loop (preliminary audit, validation plan, final audit) with bounded local verification to infer security-relevant changed functions, root-cause classes, and affected input channels. Evaluated on a 25-case benchmark of 20 Ubuntu security patch pairs and 5 negative controls with a hand-built oracle, the agent localized the ground-truth function in 10/20 security cases, correctly classified 11/20 root causes, and rejected all 5 negative controls as unknown, producing 2 behavioral differences (tcpdump) but no crashes or sanitizer findings. A layered failure taxonomy (ranker/diff miss, context export miss, reasoning/validation miss) shows the main bottleneck is diff coverage: the true function never reached the agent's context in 6/20 cases. The system distinguishes vulnerability reconstruction from exploit generation and patch-status matching, and deliberately reports conservative unknowns when bounded probes fail to reproduce behavior. Paper: arXiv 2605.06601.

Patch2Vuln: Agentic Reconstruction of Vulnerabilities from Linux Distribution Binary Patches

*Forum translation/summary of a post on zhichai.net. Original paper: "Patch2Vuln: Agentic Reconstruction of Vulnerabilities from Linux Distribution Binary Patches" by Isaac David and Arthur Gervais (University College London), arXiv:2605.06601, 2026-05-07.*

Problem Definition

Security patches are a unique intelligence source: attackers and defenders simultaneously see the vulnerable and fixed versions, but the security meaning is buried in binary diffs. Patch2Vuln formalizes vulnerability reconstruction from a binary patch pair: given old/new Linux distribution packages (e.g., Ubuntu .deb), infer from purely local, binary-derived evidence — ELF metadata, symbols/strings, Ghidra/Ghidriff diffs, decompiled snippets, local call context, and bounded old/new validation outputs — the security-relevant code region, root-cause class, affected input medium, and verifiable behavioral hypothesis.

This differs from:

Patch-based exploit generation (Brumley et al. 2008, AEG, MAYHEM) — goal is weaponized payloads
Binary vulnerability matching (e.g., BinXray) — goal is patch-status determination

The endpoint here is explanatory security auditing: transforming raw diffs into structured vulnerability hypotheses.

System Architecture: Candidate-Centric Three-Stage Agentic Harness

The contribution is not a new binary differ but a measurable agentic harness converting existing tool output into auditable vulnerability-level explanations, implemented as a locally resumable Docker pipeline with four deterministic stages and three agent reasoning stages.

Deterministic evidence layer

Package extraction and ELF normalization (dpkg-deb -x)
Ghidra headless analysis and Ghidriff CLI diff extraction
Candidate function ranker: Ghidriff diff score baseline plus memory-safety feature weighting — comparisons against INT_MAX/SIZE_MAX, file-length pre-checks, allocation-size changes, memcpy/memmove/read argument changes, parser bounds checks, captured-vs-declared length mismatches, new error strings ("too large", "short read", "invalid", "truncated"), with penalties for giant dispatchers and low-confidence fallback tokens
Candidate dossiers: structured per-function files with binary path, identifier, ranking features, diff metadata, neighboring strings/imports, decompilation, and local call context

Key prompt-design point: structure-aware packing with a fixed context budget per candidate, preserving rank order and logging omitted candidates — avoiding the "mid-object truncation" failure mode where the model sees neither the full dossier nor what was dropped.

Agent reasoning layer (three-stage audit loop)

| Stage | Input | Output | |---|---|---| | Preliminary audit | Ranked candidate dossiers, ELF metadata, Ghidra context inventory | Inferred vulnerability class, security-relevant functions, validation hypotheses | | Validation plan | Preliminary audit, dossiers | Safe local action templates + candidate IDs (harness renders concrete inputs) | | Final audit | Preliminary audit, validation plan, local old/new validation results | Revised conclusions, confidence, candidate ranking, explicit separation of confirmed evidence vs. weakened hypotheses |

Validation action schemas support target-specific local inputs: tcpdump_pcap, tcpdump_filter_file, expat_xmlwf, expat_c_harness, libarchive_archive. System prompts enforce: no network access, no CVE/USN lookups, no weaponized exploit instructions, only bounded local regression tests.

Evaluation Methodology: Layered Diagnosis with a Private Oracle

A 25-case Ubuntu .deb benchmark: 20 security update pairs (parser libraries, network/protocol, archive/media, noisy patch clusters) and 5 negative controls (2 byte-identical, 3 maintenance/rebuild diffs), all run end-to-end and scored at function level against a private hand-built oracle.

Three performance layers: 1. Patch-status matching — BinXray-style signature applicability (referenced as an external baseline, not run end-to-end) 2. Localization — raw Ghidriff ranking vs. Patch2Vuln ranker re-ranking, measured by top-1/3/5/25 hit rate 3. Semantic reconstruction — whether the final audit identifies the patch family and explains class, input medium, and patch meaning

Failure buckets (core methodological contribution):

ranker_or_diff_miss — ground-truth function absent from ranked candidates
context_export_miss — candidate present but Ghidra context export failed
model_reasoning_or_validation_miss — candidate reached the prompt but reasoning/validation failed
localized_by_agent — success

This layering matters: the model cannot reconstruct evidence that never reached its context, and negative validation results must not be misread as localization failures.

Results

| Metric | Value | |---|---| | Security update pairs | 20 | | localized_by_agent | 10 / 20 | | Correct root-cause classification | 11 / 20 | | Negative controls correctly rejected (unknown) | 5 / 5 | | Behavioral differences produced (not exploits) | 2 (both tcpdump) | | Crash / timeout / sanitizer findings | 0 |

Localization baseline comparison (20 security pairs):

| Method | Top-1 | Top-3 | Top-5 | Top-25 | |---|---|---|---|---| | Raw Ghidriff ranking | 2 | 6 | 6 | 12 | | Patch2Vuln ranker | 4 | 5 | 7 | 12 | | Agent final-audit localization | — | — | — | 10 |

The ranker improves top-1 and top-5 coverage, but the top-25 ceiling is unchanged (12), indicating a fundamental diff-coverage gap in 8 security pairs.

Failure distribution: 6 ranker_or_diff_miss, 1 context_export_miss, 3 model_reasoning_or_validation_miss.

Case Studies

tcpdump bionic (success) — CVE-2018-16301 / CVE-2020-8037 patch cluster. The hand-labeled filter-file path (read_infile) ranked 6th and reached the prompt. An oversized sparse filter file produced a diagnostic behavioral difference: the old version reported a short-read mismatch with negative expected size; the new version rejects it as too large. The report correctly named the function and additionally identified an OpenFlow pcap parser behavior difference ([|openflow] → OpenFlow (invalid)) as a separate parser behavior change within the same cluster, not a new vulnerability claim.

Expat (static reconstruction success, trigger failure) — candidate ranked 1st, correctly classified as integer_overflow with an accurate description of size-arithmetic and allocation/copy hardening. 41 bounded probes produced no old/new difference; the final report correctly stated that static evidence supports overflow hardening but triggerability was not demonstrated — illustrating the essential distinction between vulnerability reconstruction and trigger generation.

libarchive (correctly conservative) — the true function family was localized (rank 1), but classification was unknown: bounded validation did not reproduce a behavioral difference, and the patch cluster spans many archive formats (ar, RAR, 7z, ISO, WARC, LHA). 36 probes, no differences. This is appropriate defensive-audit behavior: do not erase strong static evidence because bounded tests fail, but do not overclaim memory corruption.

Negative controls (hallucination resistance) — 5/5 classified unknown. Byte-identical tcpdump and Expat controls yielded zero changed functions; maintenance diffs with real code changes (WebP: 727 changed functions, OpenJPEG: 303, zlib: 20) did not induce a "diff exists, therefore vulnerability exists" bias.

Limitations

| Limitation | Detail | |---|---| | Distribution scope | Ubuntu .deb only; RPM and rolling releases untested | | Blinding conditions | Realistic conditions (package names, paths, visible symbols); metadata-blind and symbol-suppressed variants need separate measurement | | Patch clusters | Real distribution updates often bundle multiple CVEs, complicating single-CVE attribution vs. lab patch pairs | | Validation boundary | No crashes, timeouts, or sanitizer findings; 2 behavioral differences only prove parser-path reachability, not memory corruption | | Diff coverage | 6/20 security pairs failed via ranker/diff miss — the largest empirical bottleneck |

Three forward paths: adjacent-version micro-diffs (to reduce noisy patch cluster interference), improved binary diff coverage (especially for small library patches), and candidate reachability tracking (to determine whether candidate functions were actually exercised when validation returns negative).

Conclusion

Patch2Vuln demonstrates the feasibility of agentic vulnerability reconstruction from Linux distribution binary updates. Given candidate-centric binary diff dossiers and safe validation tools, a high-effort offline agent localized 10 of 20 security targets, correctly classified 11 root causes, and rejected all 5 negative controls. The core finding: agent reasoning is useful when the right evidence is reachable; the real bottlenecks are reliably delivering security-relevant functions into the agent's context, and converting static reconstruction into local behavioral validation evidence. The work's lasting value lies in its honest, layered failure-diagnosis methodology, which precisely marks the current system boundary and provides a clear roadmap for follow-up investment.

---

Paper metadata

| Item | Value | |---|---| | Title | Patch2Vuln: Agentic Reconstruction of Vulnerabilities from Linux Distribution Binary Patches | | Authors | Isaac David, Arthur Gervais | | Affiliation | University College London | | arXiv | 2605.06601 | | Published | 2026-05-07 | | Link | https://arxiv.org/abs/2605.06601 | | Related systems | Ghidra, Ghidriff, BinXray, AEG, MAYHEM, KLEE, SAGE, S2E, Driller |