Skip to content

Reachability Analysis (Beta)#

Reachability analysis checks whether your application's code has a call path to the vulnerable function of a vulnerability detected in a Go application, and shows the result on the task.

Beta Feature on the CSIRT Plan

This feature is available to organizations on the CSIRT Plan. Because it is provided as a beta, its behavior and display may change in future releases.

What Reachability Analysis Tells You#

A vulnerability detection in FutureVuls shows that "a version of the software affected by the vulnerability is installed." The detection does not check whether your application's code actually calls the vulnerable function.

Reachability analysis statically analyzes the source code of your application and determines whether there is a call path from your application's code to the vulnerable function. The result is shown for each task as a state such as Reachable, Partial, or Not reachable.

Reachability tab in the task details

For the meaning of each state, see "Reading the Results".

How to Treat the Results#

  • The results are shown only as reference information. They do not change the task status, the task priority, or the SSVC Priority
  • Reachable shows that there is a call path to the vulnerable function. It does not show that the vulnerability can be exploited
  • Not reachable shows that no path to the vulnerable function was found within the analyzed scope. It does not guarantee that the vulnerability has no impact
  • "Not analyzed", "Not set up", and "No verdict" show that no analysis result exists. They do not mean that the vulnerable function is unreachable, or that the task is safe

How It Works#

flowchart LR
    A["Your CI<br>(source code checked out)"] --> B["vuls-reach<br>(static analysis)"]
    B --> C["Upload the report<br>to FutureVuls"]
    C --> D["Match with existing detections<br>and show per task"]
  1. In your CI, you run a script in an environment where the source code of your application is checked out
  2. The script downloads the reachability analysis program vuls-reach, which statically analyzes the source code. The analysis of Go uses govulncheck
  3. The script uploads the analysis report to FutureVuls
  4. FutureVuls matches each row of the report with the existing detections (application, package, version, and vulnerability), and shows one state for each task (server × vulnerability)

Reachability analysis adds results to the detections of applications that are already registered in FutureVuls. You register applications and detect vulnerabilities with scans and other methods, as before.

Scope#

Item Details
Language Go only
Detections Library detections only. Detections of OS packages, private software, and so on are out of scope
Vulnerabilities Vulnerabilities in Go modules. Vulnerabilities in the Go standard library are out of scope
Execution environment CI runners on Linux (x86_64 or aarch64)
Network Environments without internet access (offline or air-gapped environments) are not supported

Data Sent to FutureVuls#

The source code of your application is not uploaded to FutureVuls. The uploaded report contains the following information:

  • The vulnerability ID
  • The name and version of the package affected by the vulnerability
  • The names of the vulnerable functions for which a call path was found
  • The call paths. The paths include the function names and package names of your application
  • The reachability verdict and the time of the evaluation

To identify the analysis target, the script also sends the server UUID, the application ID (applicationId), the lockfile path, the time the analysis started, and the version of vuls-reach.

For the hosts that vuls-reach and the Go command connect to during the analysis, see "CI Execution Environment".

  • Setup: How to add reachability analysis to your CI
  • Reading the Results: How the results appear in the task list and Task Details, and what the states mean