Reachability analysis
Named by 16 kept items in this workspace.
The items that name it 16
Prioritizes patching of vulnerabilities actually executed in the application path.
Determining whether vulnerable code is actually reachable/exploitable in a given codebase, used to filter out non-exploitable CVEs; cited as relevant to the vast majority of CVEs via code_not_reachable justification
Analyzing call graphs to determine whether a given vulnerability is actually reachable by an attacker under realistic circumstances; can cut findings needing review by 80%
Method to determine exploitability of vulnerabilities identified in SBOMs, described as the author's favorite approach
Determining via call graph/static analysis whether vulnerable code (at the function level) can actually be executed in the context of the dependent software, used by Endor Labs to reduce false positives
Statically models call paths from first-party code through direct dependencies to transitive dependencies to determine whether a vulnerability is exploitable/reachable, used to prioritize and reduce false positives
builds comprehensive call graph tracing control flow and data flow from entry points to prove whether vulnerable code is actually executable, filtering unreachable findings
Determining whether a vulnerable function/component is actually callable/exploitable in a specific product, used to decide whether Article 14 reporting obligations apply (per Paragraph 218 of the Commission guidance)
Defensive technique of tracing whether there is an execution path to vulnerable code before treating a CVE as relevant
Builds a call graph from source at build time to check whether a vulnerable function sits on a path the deployed app can actually reach, filtering out non-exploitable findings
Building a call graph to check whether code actually calls a vulnerable function, used to prioritize remediation to real exploitability
Asks whether attacker-controllable input can actually reach vulnerable code, used to prioritize exploitable findings and reduce false positives; Endor Labs' research on function-level reachability analysis found less than 9.5% of vulnerabilities are exploitable at the function level
Precomputed Reachability analyzes function calls within the dependency graph from Composer manifests without needing application source code, flagging ~60% of vulnerabilities in transitive dependencies as irrelevant; Full Application Reachability analyzes application source code and dependency code
Determines whether application code paths actually reach a changed or vulnerable function; if no path reaches the change/vulnerability, it cannot break the build or be exploited, so it is deprioritized.
One of five security tasks benchmarked; determining whether a vulnerable code path is actually reachable
In every workspace you can read 18
AI
Security
All techniques in this workspace.