一句话：通过追踪指针元数据并用作覆盖率引导，检测 C 程序中不崩溃的内存漏洞。
C 广泛用于系统软件，但其底层内存控制易引入内存漏洞。已有基于覆盖率引导的灰盒模糊测试（CGF）虽实用有效，却依赖捕获崩溃来判定漏洞，难以发现不导致崩溃的漏洞。本文提出在 C 程序模糊测试中监控指针元数据（状态、边界和指向对象），以识别更多类型的内存漏洞；同时利用 C 中指针与内存操作的紧密关系，设计两个标准，将指针元数据进一步作为 CGF 的引导信息，使模糊测试过程更有针对性地覆盖程序中易受攻击的部分。
C has been regarded as a dominant programming language for system software implementation. Meanwhile, it often suffers from various memory vulnerabilities due to its low-level memory control. Quite massive approaches are proposed to enhance memory security, among which Coverage-based Greybox Fuzzing (CGF) is very popular because of its practicality and satisfactory effectiveness. However, CGF identifies vulnerabilities based on the catched crashes, thus cannot detect vulnerabilities with non-crash. In this paper, we consider to trace pointer metadata (status, bounds and referents) to detect more various vulnerabilities. Additionally, since pointers in C are often directly related to memory operations, we design two standards to further use pointer metadata as the guidance of CGF, making fuzzing process target to the vulnerable part of programs.
DOI 原文 ·
@inproceedings{paperbot7187,
title = {Coverage-based Greybox Fuzzing with Pointer Monitoring for C Programs},
author = {Haibo Chen and Jinfu Chen},
booktitle = {ASE},
year = {2022},
doi = {10.1145/3551349.3559566}
}