Security patches are essential for enhancing the stability and robustness of
projects in the software community. While vulnerabilities are officially
expected to be patched before being disclosed, patching vulnerabilities is
complicated and remains a struggle for many organizations. To patch
vulnerabilities, security practitioners typically track vulnerable issue
reports (IRs), and analyze their relevant insecure code to generate potential
patches. However, the relevant insecure code may not be explicitly specified
and practitioners cannot track the insecure code in the repositories, thus
limiting their ability to generate patches. In such cases, providing examples
of insecure code and the corresponding patches would benefit the security
developers to better locate and fix the insecure code. In this paper, we
propose PatUntrack to automatically generating patch examples from IRs without
tracked insecure code. It auto-prompts Large Language Models (LLMs) to make
them applicable to analyze the vulnerabilities. It first generates the
completed description of the Vulnerability-Triggering Path (VTP) from
vulnerable IRs. Then, it corrects hallucinations in the VTP description with
external golden knowledge. Finally, it generates Top-K pairs of Insecure Code
and Patch Example based on the corrected VTP description. To evaluate the
performance, we conducted experiments on 5,465 vulnerable IRs. The experimental
results show that PatUntrack can obtain the highest performance and improve the
traditional LLM baselines by +14.6% (Fix@10) on average in patch example
generation. Furthermore, PatUntrack was applied to generate patch examples for
76 newly disclosed vulnerable IRs. 27 out of 37 replies from the authors of
these IRs confirmed the usefulness of the patch examples generated by
PatUntrack, indicating that they can benefit from these examples for patching
the vulnerabilities.