一句话：提出可切换双模式模糊测试器 Sleuth，在已有单个 PoC 基础上高效挖掘同一根因引发的多种缺陷影响，并借此发现不完整修复。
仅凭一个 PoC 难以完整修复缺陷，因为同一根因可能在多个位置触发，产生 use-after-free、heap-buffer-overflow 等不同类型的缺陷影响。现有基于覆盖率引导的模糊测试通过给覆盖缺陷代码区域的种子分配更多能量来发现这些影响，但在“深度探索”（崩溃区域之后的缺陷影响）与“广度探索”（未到达区域旁的缺陷影响）之间难以平衡：要么只关注一种，要么分阶段进行，导致准确性与效率偏低。为此，作者提出 Sleuth，其核心是两点新设计：(i) 内建于模糊测试器的双模式探索机制，可高效开展深度与广度探索；(ii) 与双模式探索相连接的动态可切换策略，用以保障缺陷影响调查的可靠性。作者在 50 个已知 CVE 上评估 Sleuth，结果显示其能在 86% 的 CVE 上高效发现新的缺陷影响，发现的缺陷影响数量比当前最先进工具多 1.5 倍，并利用新生成的 PoC 成功识别出 13 处不完整修复。
A proof of concept (PoC) is essential for pinpointing a bug within software. However, relying on it alone for the timely and complete repair of bugs is insufficient due to underestimating the bug impacts. The bug impact reflects that a bug may be triggered at multiple positions following from the root cause, resulting in different bug types (e.g., use-after-free, heap-buffer-overflow). Current techniques discover bug impacts using fuzzing with a specific coverage-guided strategy: assigning more energy to seeds that cover the buggy code regions. This method can utilize a single PoC to generate multiple PoCs that contain different bug impacts in a short time. Unfortunately, we observe existing techniques are still unreliable, primarily due to their failure in balancing the time between in-depth and breadth exploration: (i) in-depth exploration for bug impacts behind crash regions and (ii) breadth exploration for bug impacts alongside unreached regions. Current techniques only focus on one exploration or conduct two explorations in separate stages leading to low accuracy and efficiency. Considering the aforementioned problem, we propose Sleuth, an approach for automatically investigating bug impacts following a known single PoC to enhance bug fixing. We design Sleuth on two novel concepts: (i) a dual-mode exploration mechanism built on a fuzzer designed for efficient in-depth and breadth exploration. (ii) a dynamic switchable strategy connecting with the dual-mode exploration that facilitates the reliability of bug impact investigation. We evaluate Sleuth using 50 known CVEs, and the result of experiment shows that Sleuth can efficiently discover new bug impacts in 86% CVEs and find 1.5x more bug impacts than state-of-art tools. Furthermore, Sleuth successfully identifies 13 incomplete fixes using the generated new PoCs.
DOI 原文 ·
@inproceedings{paperbot8467,
title = {Sleuth: A Switchable Dual-Mode Fuzzer to Investigate Bug Impacts Following a Single PoC},
author = {Haolai Wei and Liwei Chen and Zhijie Zhang and Gang Shi and Dan Meng},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3680316}
}