Description
Software vulnerabilities remain a persistent challenge in modern software development,
and their timely remediation is critical for maintaining the security of software systems.
While large-scale fuzzing infrastructures have proven effective at discovering vulnerabilities,
the process of generating corrective patches remains largely manual. Recent
work has explored the use of large language models for automated program repair, but
most existing approaches rely on static prompts and one-shot approaches, and evaluate
their work on synthetic benchmarks or small code snippets. This thesis investigates the
use of large language models for automated vulnerability repair in real-world C and
C++ software.
We present a multi-agent repair framework that transforms structured root cause
analyses derived from fuzzing crashes into directly applicable source code patches. The
architecture decomposes the repair task into specialized agents for patch generation,
patch evaluation, source code exploration, and tool selection, coordinated through an
iterative repair loop with execution-based validation. Two complementary context
management mechanisms—controlled tool availability and isolated code exploration—
enable the system to operate on large, real-world codebases despite model context
limitations.
We evaluate the framework on 25 real-world bugs from actively maintained opensource
projects, spanning diverse bug categories including memory safety violations,
undefined behavior, and incorrect numerical computations. The system achieves an
overall repair success rate of 81.6%, with 21 out of 25 vulnerabilities repaired in at least
8 out of 10 runs. We conduct systematic ablation studies to analyze the impact of model
choice, multi-agent coordination, context management, and validation strategy. The
results show that model capability is the primary bottleneck, and that each architectural
component contributes to repair success in specific scenarios, with no single component
being universally essential but each covering failure modes that the others cannot
address.
|
Thesis topic in co-operation with the Fraunhofer Institute for Applied and Integrated Security AISEC, Garching