Propagation Model for SSC attacks: Why SBOM (tools) don't tell the whole truth

Ljubica Grgic, Lazar Maksimovic, Pavel Laskov

[Kryptografia i bezpieczeństwo] Autorzy: Ljubica Grgic, Lazar Maksimovic, Pavel Laskov

Ensuring security of software supply chains (SSC) is indispensable in today's world of modern software practices. SBOM (tools) have been introduced as relevant building blocks to ensure the transparency of SSCs. However they have serious limitations in practices as their vulnerability detection and interpretation capacity is not sufficient to explain exploitability effects that can propagte through the whole chain. To address this gap, we propose a propagation-centred approach to SSC security and introduce a four-stage propagation model. We empirically evaluate four open-source SBOM tools against each stage using three projects and Log4j vulnerability as our test case. Our results show that current SBOM tools systematically support only Stage 1 (Structural Exposure) and Stage 2 (Vulnerability Class Presence) while Stage 3 (Code Reachability) and Stage 4 (Taint Path Analysis) require cap…

Kategoria arxiv

cs.CR

Kategoria

Kryptografia i bezpieczeństwo

Pdf

https://arxiv.org/pdf/2609.05380v1

Doi

10.1007/978-3-032-35579-9_30

Otwórz oryginał w źródle ↗