  Software vulnerabilities pose significant risks to the security and integrity
of software systems. Prior studies have proposed various approaches to
vulnerability detection using deep learning or pre-trained models. However,
there is still a lack of detailed explanations for understanding
vulnerabilities beyond merely detecting their occurrence, which fails to truly
help software developers understand and remediate the issues. Recently, large
language models (LLMs) have demonstrated remarkable capabilities in
comprehending complex contexts and generating content, presenting new
opportunities for both detecting and explaining software vulnerabilities. In
this paper, we conduct a comprehensive study to investigate the capabilities of
LLMs in both detecting and explaining vulnerabilities, and we propose
LLMVulExp, a framework that utilizes LLMs for these tasks. Under specialized
fine-tuning for vulnerability explanation, our LLMVulExp not only detects the
types of vulnerabilities in the code but also analyzes the code context to
generate the cause, location, and repair suggestions for these vulnerabilities.
These detailed explanations are crucial for helping developers quickly analyze
and locate vulnerability issues, providing essential guidance and reference for
effective remediation. We find that LLMVulExp can effectively enable the LLMs
to perform vulnerability detection (e.g., achieving over a 90\% F1 score on the
SeVC dataset) and provide detailed explanations. We also explore the potential
of using advanced strategies such as Chain-of-Thought (CoT) to guide the LLMs
in concentrating on vulnerability-prone code, achieving promising results.
