一句话：提出面向操作数变化的差分分析，自动推断 PDF 阅读器绑定调用参数类型并指导模糊测试，发现 38 个新漏洞。
PDF 阅读器内嵌脚本引擎的绑定调用构成了严重攻击面，但要有效测试这些绑定调用，需要知道参数类型。由于文档缺失或不完整、样本不足，自动类型推理十分困难。本文提出一种面向操作数变化的差分分析方法，从执行轨迹中自动提取特征作为 oracle：通过用不同类型的不同值执行绑定调用，观察哪些类型会使指令操作数产生预期变化，从而推断参数类型。推断出的类型信息被用于指导模糊测试的测试生成。作者在 Adobe Reader 和 Foxit Reader 上评估了类型推理的准确性以及类型信息对模糊测试的改进效果，证明其能提升代码覆盖率与漏洞发现能力，并发现 38 个此前未知的安全漏洞，其中 26 个获得 CVE 编号。
Binding calls of embedded scripting engines introduce a serious attack surface in PDF readers. To effectively test binding calls, the knowledge of parameter types is necessary. Unfortunately, due to the absence or incompleteness of documentation and the lack of sufficient samples, automatic type reasoning for binding call parameters is a big challenge. In this paper, we propose a novel operand-variation-oriented differential analysis approach, which automatically extracts features from execution traces as oracles for inferring parameter types. In particular, the parameter types of a binding call are inferred by executing the binding call with different values of different types and investigating which types cause an expected effect on the instruction operands. The inferred type information is used to guide the test generation in fuzzing. Through the evaluation on two popular PDF readers (Adobe Reader and Foxit Reader), we demonstrated the accuracy of our type reasoning method and the effectiveness of the inferred type information for improving fuzzing in both code coverage and vulnerability discovery. We found 38 previously unknown security vulnerabilities, 26 of which were certified with CVE numbers.
@inproceedings{GuoWYLSZHZ23,
title = {Operand-Variation-Oriented Differential Analysis for Fuzzing Binding Calls in PDF Readers},
author = {Suyue Guo and Xinyu Wan and Wei You and Bin Liang and Wenchang Shi and Yiwei Zhang and Jianjun Huang and Jian Zhang},
booktitle = {ICSE},
year = {2023},
doi = {10.1109/icse48619.2023.00020}
}