一句话：提出以内存消耗为反馈的模糊测试 MemLock，无需领域知识即可发现内存耗尽型漏洞。
不可控内存消耗是关键的软件安全弱点，攻击者可通过控制输入耗尽内存并发动拒绝服务攻击。现有模糊测试主要关注代码覆盖，难以发现此类漏洞。本文提出内存使用引导的模糊测试技术 MemLock，以内存消耗信息作为反馈，无需领域知识即可生成导致过量内存消耗的输入并触发相关缺陷。作者在 14 个广泛使用的真实程序上进行了全面评估，与 AFL、AFLfast、PerfFuzz、FairFuzz、Angora 和 QSYM 等先进模糊测试工具比较，MemLock 在发现内存消耗漏洞方面显著更优，并发现大量此前未知的漏洞，获得 15 个新 CVE。
Uncontrolled memory consumption is a kind of critical software security weaknesses. It can also become a security-critical vulnerability when attackers can take control of the input to consume a large amount of memory and launch a Denial-of-Service attack. However, detecting such vulnerability is challenging, as the state-of-the-art fuzzing techniques focus on the code coverage but not memory consumption. To this end, we propose a memory usage guided fuzzing technique, named MemLock, to generate the excessive memory consumption inputs and trigger uncontrolled memory consumption bugs. The fuzzing process is guided with memory consumption information so that our approach is general and does not require any domain knowledge. We perform a thorough evaluation for MemLock on 14 widely-used real-world programs. Our experiment results show that MemLock substantially outperforms the state-of-the-art fuzzing techniques, including AFL, AFLfast, PerfFuzz, FairFuzz, Angora and QSYM, in discovering memory consumption bugs. During the experiments, we discovered many previously unknown memory consumption bugs and received 15 new CVEs.
@inproceedings{paperbot5665,
title = {MemLock},
author = {Cheng Wen and Haijun Wang and Yuekang Li and Shengchao Qin and Yang Liu and Zhiwu Xu and Hongxu Chen and Xiaofei Xie and Geguang Pu and Ting Liu},
booktitle = {ICSE},
year = {2020},
doi = {10.1145/3377811.3380396}
}