期刊
出版社
ASSOC COMPUTING MACHINERY
DOI: 10.1145/3319535.3363225
关键词
fuzzing; optimization; taint analysis; vulnerability detection
资金
- National Science Foundation [1801751]
- Combat Capabilities Development Command Army Research Laboratory [W911NF-13-2-0045]
- Direct For Computer & Info Scie & Enginr [1801751] Funding Source: National Science Foundation
- Division Of Computer and Network Systems [1801751] Funding Source: National Science Foundation
Greybox fuzzing has made impressive progress in recent years, evolving from heuristics-based random mutation to solving individual branch constraints. However, they have difficulty solving path constraints that involve deeply nested conditional statements, which are common in image and video decoders, network packet analyzers, and checksum tools. We propose an approach for addressing this problem. First, we identify all the control flow-dependent conditional statements of the target conditional statement. Next, we select the taint flow-dependent conditional statements. Finally, we use three strategies to find an input that satisfies all conditional statements simultaneously. We implemented this approach in a tool called Matryoshka(1) and compared its effectiveness on 13 open source programs with other state-of-the-art fuzzers. Matryoshka achieved significantly higher cumulative line and branch coverage than AFL, QSYM, and Angora. We manually classified the crashes found by Matryoshka into 41 unique new bugs and obtained 12 CVEs. Our evaluation demonstrates the key technique contributing to Matryoshka's impressive performance: among the nesting constraints of a target conditional statement, Matryoshka collects only those that may cause the target unreachable, which greatly simplifies the path constraint that it has to solve.
作者
我是这篇论文的作者
点击您的名字以认领此论文并将其添加到您的个人资料中。
推荐
暂无数据