Integrity: Finding Integer Errors by Targeted Fuzzing
Integrity: Finding Integer Errors by Targeted Fuzzing
复制标题
DOI：
10.1007/978-3-030-63086-7_20
复制
发表时间：
2020
期刊：
影响因子：
--
通讯作者：
Yuyang Rong;Peng Chen;Hao Chen
中科院分区：
文献类型：
--
作者：
Yuyang Rong;Peng Chen;Hao Chen
算术错误是软件漏洞的主要来源。由于它们很少导致崩溃，如果没有特殊的技术来触发它们，它们不太可能被模糊器发现。我们设计并实现了完整性，它发现整数错误使用模糊。我们的主要贡献是，通过有针对性的仪器，我们赋予模糊器触发整数错误的能力。在我们的评估中，Integrity发现了Juliet测试套件中的所有整数错误，没有误报。在9个流行的开源程序中，Integrity共发现了174个真正的错误，包括8个崩溃和166个非崩溃错误。错误审查期间的一个主要挑战是如何确定非崩溃错误是否有害。虽然精确地解决这个问题是具有挑战性的，因为它取决于程序的语义，我们提出了两种方法来找到潜在的有害错误，基于模糊器产生的痕迹的统计数据和比较相同算法的独立实现的输出。我们的评估表明，完整性是有效的发现整数错误。
Integer arithmetic errors are a major source of software vulnerabilities. Since they rarely cause crashes, they are unlikely found by fuzzers without special techniques to trigger them. We design and implementIntegrity, which finds integer errors using fuzzing. Our key contribution is that, by targeted instrumentation, we empower fuzzers with the ability to trigger integer errors. In our evaluation,Integrity found all the integer errors in the Juliet test suite with no false positive. On 9 popular open source programs,Integrity found a total of 174 true errors, including 8 crashes and 166 non-crashing errors. A major challenge during error review was how to determine if a non-crashing error was harmful. While solving this problem precisely is challenging because it depends on the semantics of the program, we propose two methods to find potentially harmful errors, based on the statistics of traces produced by the fuzzer and on comparing the output of independent implementations of the same algorithm. Our evaluation demonstrated thatIntegrity is effective in finding integer errors.