Do #ifdefs Influence the Occurrence of Vulnerabilities? An Empirical Study of the Linux Kernel

kaestner@cs.cmu.edu (G. Ferreira, M. Malik, C. Kästner, J. Pfeffer, S. Apel)
Wed, 01 Mar 2017 14:35:44 -0500

Gabriel Ferreira, Momin Malik, Christian Kästner, Juergen Pfeffer, and Sven Apel. Do #ifdefs Influence the Occurrence of Vulnerabilities? An Empirical Study of the Linux Kernel. In Proceedings of the 20th International Software Product Line Conference (SPLC), pages 65--744, New York, NY: ACM Press, September 2016.

Preprocessors support the diversification of software products with #ifdefs, but also require additional effort from developers to maintain and understand variable code. We conjecture that #ifdefs cause developers to produce more vulnerable code because they are required to reason about multiple features simultaneously and maintain complex mental models of dependencies of configurable code. We extracted a variational call graph across all configurations of the Linux kernel, and used configuration complexity metrics to compare vulnerable and non-vulnerable functions considering their vulnerability history. Our goal was to learn about whether we can observe a measurable influence of configuration complexity on the occurrence of vulnerabilities. Our results suggest, among others, that vulnerable functions have higher variability than non-vulnerable ones and are also constrained by fewer configuration options. This suggests that developers are inclined to notice functions appear in frequently-compiled product variants. We aim to raise developers’ awareness to address variability more systematically, since configuration complexity is an important, but often ignored aspect of software product lines.