Memlock: Memory usage guided fuzzing

Cheng Wen, Haijun Wang, Yuekang Li, Shengchao Qin, Yang Liu, Zhiwu Xu, Hongxu Chen, Xiaofei Xie, Geguang Pu, Ting Liu

研究成果: Chapter in Book/Report/Conference proceedingConference contribution

7 被引用数 (Scopus)

抄録

Uncontrolled memory consumption is a kind of critical software security weaknesses. It can also become a security-critical vulnerability when attackers can take control of the input to consume a large amount of memory and launch a Denial-of-Service attack. However, detecting such vulnerability is challenging, as the stateof- the-art fuzzing techniques focus on the code coverage but not memory consumption. To this end, we propose a memory usage guided fuzzing technique, named MemLock, to generate the excessive memory consumption inputs and trigger uncontrolled memory consumption bugs. The fuzzing process is guided with memory consumption information so that our approach is general and does not require any domain knowledge. We perform a thorough evaluation for MemLock on 14 widely-used real-world programs. Our experiment results show that MemLock substantially outperforms the state-of-the-art fuzzing techniques, including AFL, AFLfast, PerfFuzz, FairFuzz, Angora and QSYM, in discovering memory consumption bugs. During the experiments, we discovered many previously unknown memory consumption bugs and received 15 new CVEs.

本文言語英語
ホスト出版物のタイトルProceedings - 2020 ACM/IEEE 42nd International Conference on Software Engineering, ICSE 2020
出版社IEEE Computer Society
ページ765-777
ページ数13
ISBN(電子版)9781450371216
DOI
出版ステータス出版済み - 6 27 2020
外部発表はい
イベント42nd ACM/IEEE International Conference on Software Engineering, ICSE 2020 - Virtual, Online, 大韓民国
継続期間: 6 27 20207 19 2020

出版物シリーズ

名前Proceedings - International Conference on Software Engineering
ISSN(印刷版)0270-5257

会議

会議42nd ACM/IEEE International Conference on Software Engineering, ICSE 2020
国/地域大韓民国
CityVirtual, Online
Period6/27/207/19/20

All Science Journal Classification (ASJC) codes

  • ソフトウェア

フィンガープリント

「Memlock: Memory usage guided fuzzing」の研究トピックを掘り下げます。これらがまとまってユニークなフィンガープリントを構成します。

引用スタイル