A Reality Check on SBOM-based Vulnerability Management: An Empirical Study and A Path Forward

TL;DR

This study empirically evaluates SBOM utility in vulnerability management, revealing high false positives in scanners and proposing a two-stage approach with lock files and function call analysis for improved accuracy.

Contribution

It demonstrates that combining accurate SBOM generation with function call analysis significantly reduces false positives in vulnerability scanning.

Findings

Using lock files with package managers improves SBOM accuracy.

Vulnerability scanners produce 92% false positives due to unreachable code.

Function call analysis reduces false alarms by 61.9%.

Abstract

The Software Bill of Materials (SBOM) is a critical tool for securing the software supply chain (SSC), but its practical utility is undermined by inaccuracies in both its generation and its application in vulnerability scanning. This paper presents a large-scale empirical study on 2,414 open-source repositories to address these issues from a practical standpoint. First, we demonstrate that using lock files with strong package managers enables the generation of accurate and consistent SBOMs, establishing a reliable foundation for security analysis. Using this high-fidelity foundation, however, we expose a more fundamental flaw in practice: downstream vulnerability scanners produce a staggering 92.0\% false positive rate in our case study. We pinpoint the primary cause as the flagging of vulnerabilities within unreachable code. We then demonstrate that function call analysis can effectively prune 61.9\% of these false alarms. Our work validates a practical, two-stage approach for SSC security: first, generate an accurate SBOM using lock files and strong package managers, and second, enrich it with function call analysis to produce actionable, low-noise vulnerability reports that alleviate developers' alert fatigue.