Binary-level directed fuzzing for use-after-free vulnerabilities - CEA - Commissariat à l’énergie atomique et aux énergies alternatives Accéder directement au contenu
Communication Dans Un Congrès Année : 2020

Binary-level directed fuzzing for use-after-free vulnerabilities

Résumé

Directed fuzzing focuses on automatically testing specific parts of the code by taking advantage of additional information such as (partial) bug stack trace, patches or risky operations. Key applications include bug reproduction, patch testing and static analysis report verification. Although directed fuzzing has received a lot of attention recently, hard-to-detect vulnerabilities such as Use-After-Free (UAF) are still not well addressed, especially at the binary level. We propose UAFUZZ, the first (binary-level) directed greybox fuzzer dedicated to UAF bugs. The technique features a fuzzing engine tailored to UAF specifics, a lightweight code instrumentation and an efficient bug triage step. Experimental evaluation for bug reproduction on real cases demonstrates that UAFUZZ significantly outperforms state-of-the-art directed fuzzers in terms of fault detection rate, time to exposure and bug triaging. UAFUZZ has also been proven effective in patch testing, leading to the discovery of 30 new bugs (7 CVEs) in programs such as Perl, GPAC and GNU Patch. Finally, we provide to the community a large fuzzing benchmark dedicated to UAF, built on both real codes and real bugs
Fichier principal
Vignette du fichier
raid-camera-01.pdf (356.18 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Licence : CC BY - Paternité

Dates et versions

cea-04477056 , version 1 (26-02-2024)

Identifiants

  • HAL Id : cea-04477056 , version 1

Citer

Manh-Dung Nguyen, Sébastien Bardin, Richard Bonichon, Roland Groz, Matthieu Lemerre. Binary-level directed fuzzing for use-after-free vulnerabilities. RAID 2020 - 23rd International Symposium on Research in Attacks, Intrusions and Defenses, Oct 2020, Saint Sebastien, Spain. pp.47-62. ⟨cea-04477056⟩
4 Consultations
9 Téléchargements

Partager

Gmail Facebook X LinkedIn More