一句话：提出类型状态引导的模糊测试器 UAFL，用静态类型状态分析与信息流分析引导，高效发现 use-after-free 漏洞。
现有基于覆盖率的模糊测试通常以单个控制流图（CFG）边覆盖为引导，难以发现 use-after-free（UaF）这类需要按特定顺序遍历长边序列才能触发的漏洞。本文将 UaF 漏洞建模为类型状态（typestate）属性，提出类型状态引导的模糊测试器 UAFL。给定类型状态属性后，先进行静态类型状态分析，找出可能违反该属性的操作序列；模糊测试过程则以这些操作序列为引导，逐步生成能够触发属性违反的测试用例；此外还利用信息流分析提升模糊测试效率。作者在 14 个广泛使用的真实程序上进行了充分评估，结果表明 UAFL 在发现漏洞所需时间上显著优于 AFL、AFLFast、FairFuzz、MOpt、Angora 和 QSYM 等先进模糊测试器，共发现 10 个此前未知的漏洞，并获得 5 个新 CVE。
Existing coverage-based fuzzers usually use the individual control flow graph (CFG) edge coverage to guide the fuzzing process, which has shown great potential in finding vulnerabilities. However, CFG edge coverage is not effective in discovering vulnerabilities such as use-after-free (UaF). This is because, to trigger UaF vulnerabilities, one needs not only to cover individual edges, but also to traverse some (long) sequence of edges in a particular order, which is challenging for existing fuzzers. To this end, we propose to model UaF vulnerabilities as typestate properties, and develop a typestate-guided fuzzer, named UAFL, for discovering vulnerabilities violating typestate properties. Given a typestate property, we first perform a static typestate analysis to find operation sequences potentially violating the property. Our fuzzing process is then guided by the operation sequences in order to progressively generate test cases triggering property violations. In addition, we also employ an information flow analysis to improve the efficiency of the fuzzing process. We have performed a thorough evaluation of UAFL on 14 widely-used real-world programs. The experiment results show that UAFL substantially outperforms the state-of-the-art fuzzers, including AFL, AFLFast, FairFuzz, MOpt, Angora and QSYM, in terms of the time taken to discover vulnerabilities. We have discovered 10 previously unknown vulnerabilities, and received 5 new CVEs.
@inproceedings{paperbot5664,
title = {Typestate-guided fuzzer for discovering use-after-free vulnerabilities},
author = {Haijun Wang and Xiaofei Xie and Yi Li and Cheng Wen and Yuekang Li and Yang Liu and Shengchao Qin and Hongxu Chen and Yulei Sui},
booktitle = {ICSE},
year = {2020},
doi = {10.1145/3377811.3380386}
}