Propagation Model for SSC attacks: Why SBOM (tools) don't tell the whole truth
Study shows open-source SBOM tools only cover structural exposure and vulnerability presence, missing code reachability and taint-path analysis stages.
An arXiv paper proposes a four-stage propagation model for software supply chain attack effects and empirically evaluates four open-source SBOM tools against it using three projects and the Log4j vulnerability as the test case. Current SBOM tools systematically support only Stage 1 (structural exposure) and Stage 2 (vulnerability class presence), while Stage 3 (code reachability) and Stage 4 (taint path analysis) require capabilities absent from the SBOM ecosystem. The authors argue propagation-centred SSC security research is needed to prevent cyber risk from evolving into systemic risk.
- Four-stage propagation model: structural exposure, vulnerability presence, code reachability, taint path analysis
- Four open-source SBOM tools evaluated on three projects using Log4j as test case
- SBOM ecosystem lacks reachability and taint-path capabilities for exploitability propagation
- Authors urge propagation-centred SSC research to avert systemic cyber risk
Full article173 words · extracted from arxiv.org · click to collapse
Ensuring security of software supply chains (SSC) is indispensable in today's world of modern software practices. SBOM (tools) have been introduced as relevant building blocks to ensure the transparency of SSCs. However they have serious limitations in practices as their vulnerability detection and interpretation capacity is not sufficient to explain exploitability effects that can propagte through the whole chain. To address this gap, we propose a propagation-centred approach to SSC security and introduce a four-stage propagation model. We empirically evaluate four open-source SBOM tools against each stage using three projects and Log4j vulnerability as our test case. Our results show that current SBOM tools systematically support only Stage 1 (Structural Exposure) and Stage 2 (Vulnerability Class Presence) while Stage 3 (Code Reachability) and Stage 4 (Taint Path Analysis) require capabilities absent from the SBOM ecosystem. We argue that putting propagation effects at the centre of SSC security research is essential to prevent cyber risk evolving into systemic risks. Our research findings contribute to a future research and design of modern SSC security tools.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.05380