ovAFLow:Detecting Memory Corruption Bugs with Fuzzing-Based Taint Inference
ovAFLow:Detecting Memory Corruption Bugs with Fuzzing-Based Taint Inference
复制标题
ovAFLow：使用基于模糊测试的污点推断检测内存损坏错误
DOI：
10.1007/s11390-021-1600-9
复制
发表时间：
2022
影响因子：
0.7
通讯作者：
Lu Kai
中科院分区：
文献类型：
--
作者：
Zhang Gen;Wang Pengfei;Yue Tai;Kong Xiangdong;Zhou Xu;Lu Kai
灰盒模糊检测是一种有效的软件漏洞检测技术，如内存损坏。以前的模糊检测内存损坏错误要么使用权重分析，要么使用非定制的内存损坏检测技术。本文提出了一种新的内存错误引导模糊检测器ovAFlow。开始，我们扩大了内存损坏目标，我们经常发现错误。接下来，ovAFlow利用轻量级和有效的方法来建立模糊输入和这些损坏目标之间的连接。基于连接结果，ovAFlow使用定制的技术来指导模糊过程更接近内存损坏。我们对最先进的模糊器，包括AFL进行了评估（american fuzzy lop）、AFLFast、FairFuzz、QSYM、安哥拉、TIFF和TortoiseFuzz的安全漏洞检测性能进行了测试，结果表明ovAFlow具有更好的漏洞检测能力，性能开销在可接受的范围内，并识别出了12个新的内存损坏漏洞和2个常见漏洞暴露（common vulnerability exposure，CVE）。
Grey-box fuzzing is an effective technology to detect software vulnerabilities,such as memory corruption.Previous fuzzers in detecting memory corruption bugs either use heavy-weight analysis,or use techniques which are not customized for memory corruption detection.In this paper,we propose a novel memory bug guided fuzzer,ovAFLow.To begin with,we broaden the memory corruption targets where we frequently identify bugs.Next,ovAFLow utilizes light-weight and effective methods to build connections between the fuzzing inputs and these corruption targets.Based on the connection results,ovAFLow uses customized techniques to direct the fuzzing process closer to memory corruption.We evaluate ovAFLow against state-of-the-art fuzzers,including AFL (american fuzzy lop),AFLFast,FairFuzz,QSYM,Angora,TIFF,and TortoiseFuzz.The evaluation results show better vulnerability detection ability of ovAFLow,and the performance overhead is acceptable.Moreover,we identify 12 new memory corruption bugs and two CVEs (common vulnerability exposures) with the help of ovAFLow.