Patch2Vuln: Agentic Vulnerability Reconstruction from Linux Distribution Binary Patches

Forum topic · 小凯 · 2026-05-09

Summary

Patch2Vuln, a system from University College London researchers (arXiv 2605.06601), formalizes vulnerability reconstruction from binary patch pairs: given old/new Ubuntu .deb packages, it infers security-relevant code changes, root-cause classes, and affected input channels using only local binary-derived evidence (ELF metadata, Ghidra/Ghidriff diffs, decompiled snippets, bounded validation). The system combines a deterministic evidence layer (package extraction, headless Ghidra diffing, a memory-safety-weighted candidate ranker) with a three-stage agentic audit loop: preliminary audit, validation planning, and final audit, restricted to no-network, non-weaponized local testing. Evaluated on 25 Ubuntu cases (20 security updates, 5 negative controls), the agent localized 10/20 vulnerabilities, correctly classified 11/20 root causes, and rejected all 5 negative controls, producing 2 behavioral diffs but zero crashes. A layered failure taxonomy attributes misses to diff coverage (6 cases), context export (1), and model reasoning (3), showing evidence delivery—not model reasoning—is the main bottleneck. The paper argues vulnerability reconstruction is distinct from exploit generation and patch-status detection.

Patch2Vuln: Agentic Reconstruction of Vulnerabilities from Linux Distribution Binary Patches

This post summarizes the paper "Patch2Vuln: Agentic Reconstruction of Vulnerabilities from Linux Distribution Binary Patches" by Isaac David and Arthur Gervais (University College London), arXiv: 2605.06601.

Problem and Task Definition

Security patches expose both vulnerable and fixed versions simultaneously, but the security meaning of a patch is buried in binary changes. Patch2Vuln formalizes vulnerability reconstruction from a binary patch pair: given old/new Linux distribution packages (e.g., Ubuntu .deb), infer security-relevant changed regions, root-cause class, affected input channels, and verifiable behavioral hypotheses — using only local binary-derived evidence (ELF metadata, symbols/strings, Ghidra/Ghidriff diffs, decompiled snippets, bounded old/new validation output).

This differs from:

Patch-based exploit generation (Brumley et al. 2008, AEG, MAYHEM): synthesizes exploitable payloads.
Binary vulnerability matching (e.g., BinXray): determines whether code is patched.

Patch2Vuln's endpoint is interpretive security auditing, not exploit generation or patch-status detection.

System Architecture: Candidate-Centric, Three-Stage Agentic Design

Deterministic evidence layer:

Package extraction and ELF normalization (dpkg-deb -x)
Ghidra headless analysis and Ghidriff CLI diff extraction
Candidate ranker: Ghidriff diff score plus memory-safety feature weighting (INT_MAX/SIZE_MAX comparisons, file-length pre-checks, allocation-size changes, memcpy/memmove/read argument changes, parser boundary checks, new error strings like "too large", "short read"), with penalties for giant dispatchers and low-confidence fallback tokens
Candidate dossiers: binary path, function identifier, ranking features, diff metadata, neighboring strings/imports, decompiled snippets, local call context

Key prompt design: structure-aware packing with fixed context budgets per candidate, preserved rank order, and explicit recording of omitted candidates — avoiding mid-object truncation failures.

Agentic reasoning layer (three-stage audit loop):

| Stage | Input | Output | |---|---|---| | Preliminary Audit | Ranked dossiers, ELF metadata, Ghidra context | Inferred vuln class, relevant functions, validation hypotheses | | Validation Plan | Preliminary audit, dossiers | Safe local action templates and candidate IDs | | Final Audit | All prior stages plus validation results | Revised conclusions, confidence, rankings, separating confirmed evidence from weakened hypotheses |

Validation actions support target-specific local inputs (tcpdump_pcap, tcpdump_filter_file, expat_xmlwf, expat_c_harness, libarchive_archive). System prompts enforce: no network access, no CVE/USN queries, no weaponized exploit instructions, only bounded local regression tests.

Evaluation: 25-Case Benchmark with Layered Diagnostics

Benchmark: 20 Ubuntu security update pairs (parser libraries, network/protocol, archive/media, noisy patch clusters) plus 5 negative controls (2 byte-identical, 3 maintenance/rebuild diffs), scored by a private hand-built function-level oracle.

Three diagnostic layers separate: 1. Patch-status matching (BinXray-style, cited as baseline only) 2. Localization: raw Ghidriff ranking vs. Patch2Vuln re-ranking 3. Semantic reconstruction: whether the agent's final audit finds the patch family and explains the vulnerability

Failure buckets: ranker_or_diff_miss, context_export_miss, model_reasoning_or_validation_miss, localized_by_agent — critical because models cannot reconstruct evidence that never reached their context, and negative validation results should not be misread as localization failure.

Results

| Metric | Value | |---|---| | Agent localized (localized_by_agent) | 10 / 20 | | Correct root-cause label | 11 / 20 | | Negative controls correctly rejected | 5 / 5 | | Behavioral diffs produced (non-exploit) | 2 (both tcpdump) | | Crash / timeout / sanitizer findings | 0 |

| Method | Top-1 | Top-3 | Top-5 | Top-25 | |---|---|---|---|---| | Raw Ghidriff | 2 | 6 | 6 | 12 | | Patch2Vuln ranker | 4 | 5 | 7 | 12 | | Agent final audit | — | — | — | 10 |

The top-25 ceiling of 12 is unchanged, indicating a fundamental diff-coverage gap in 8 security pairs. Failure distribution: 6 ranker_or_diff_miss, 1 context_export_miss, 3 model_reasoning_or_validation_miss.

Case Studies

tcpdump bionic (success): CVE-2018-16301 / CVE-2020-8037 cluster; the hand-labeled read_infile path ranked #6, was validated via an oversized sparse filter file, and correctly reported, plus an independent OpenFlow parser behavior diff.
Expat (static success, trigger failure): candidate ranked #1, correctly classified as integer overflow with accurate description of size-arithmetic and allocation hardening; 41 bounded probes produced no old/new difference — correctly reported as unproven triggerability, illustrating the distinction between reconstruction and trigger generation.
libarchive (conservative classification): function family found (#1) but labeled unknown after 36 probes with no behavioral difference across a multi-format patch cluster — appropriate defensive behavior.
Negative controls (hallucination resistance): 5/5 labeled unknown, including large maintenance diffs (727 changed functions in WebP, 303 in OpenJPEG, 20 in zlib) — the agent was not biased by "diff implies vulnerability."

Limitations and Future Directions

Ubuntu .deb only; RPM and rolling releases untested
Realistic conditions only (package names, paths, symbols visible); metadata-blind/symbol-suppressed variants need separate measurement
Real-world patch clusters merge multiple CVEs, complicating single-CVE attribution
No crashes/timeouts/sanitizer findings; the 2 behavioral diffs prove parser reachability, not memory corruption
Diff coverage (6/20 ranker/diff misses) is the biggest empirical bottleneck

Proposed paths forward: adjacent-version micro-diffs, improved binary diff coverage (especially for small library patches), and candidate-reachability tracking.

Conclusion

Patch2Vuln demonstrates that agentic vulnerability reconstruction from distribution binaries is feasible: 10/20 localized, 11/20 correctly classified, 5/5 negative controls rejected. The key finding: agent reasoning is useful when evidence is reachable; the real bottleneck is reliably delivering security-relevant functions into the agent's context and converting static reconstruction into local behavioral validation evidence.

| Metadata | Detail | |---|---| | Authors | Isaac David, Arthur Gervais | | Institution | University College London | | arXiv | 2605.06601 | | Related systems | Ghidra, Ghidriff, BinXray, AEG, MAYHEM, KLEE, SAGE, S2E, Driller |