In theory, yes, this is possible and there have been some attempts to do this. However, the technique is not all that practical because there are just too many variables involved to generalise the approach. What your talking about is really just a subset of static code anlsysis and it has been used for along time. The problem is, it has a lot of limitations
- It is usually language specific. Trying to develop a solution for all software code is too complex
- You often need to work at the AST level to eliminate variable names, code style etc. You need high level abstracted representations, which akes it slow
- It can be difficult to identify issues which are not closely located in the code. for example, a security hole may only exist if there is a set of preconditions spread over multiple code file or modules
- It often gives large numbers of false positives which need to be manually verified.
Having said all of that, there are a number of static analysis tools which can help narrow the search space for potential security holes. These often focus on a specific type of security issue, such as SQL injection or XSS vulnerabilities and are usually restricted to a specific language. Many of the better ones are very expensive.
The potential for such analysis has certainly increased due to the growth in available repositories, such as github. Defining exactly the scope to use can also mean such approaches can be beneficial. This is especially the case due to the growth in the use of open source libraries and frameworks. For example, if you know of a vulnerability in a popular library or framework, it isn't too difficult to identify code which uses those frameworks or ibraries as possible candidates for more intensive search. Likewise, the growth in the use of 'cut n paste' style programming may have some potential - if you find a popular example of how to implement some pattern/algorithm which has a flaw, you may be able to find that pattern in public repositories etc.
This type of static analysis won't automate the process, but it certainly could help in reducing the search space for code with security problems. However, at the end of the day, it will normally require someone to take the results and perform manual analysis and inspection.