一句话：提出 Atlas，为 Android 闭源原生库自动生成跨语言 fuzzing harness 并提供模拟器 Java 运行时，发现大量安全缺陷。
Android 上的模糊测试已有不少工作，但面向闭源原生库、特别是在模拟器中自动 fuzzing 仍未被充分探索。其挑战在于 Android 的多语言编程模型以及模拟器缺少 Java 运行时环境。本文提出 Atlas，一个面向 Android 闭源原生库的实用自动化 fuzz 框架，由自动 harness 生成器和含必要运行时环境的 fuzzer 组成。生成器利用静态分析，从 native world 与 Java world 的信息推断 native API 的正确调用序列与参数，并通过启发式优化提升 harness 的实用性；fuzzer 在模拟器中提供必要的 Java 运行时环境，使多核服务器上 fuzzing 闭源原生库成为可能。作者在来自四家 Android 厂商的 17 个预装应用上评估 Atlas，生成了 820 个 harness，覆盖 767 个 native API，其中 78% 具有实用性，并发现 74 个新安全缺陷，获得 16 个 CVE。
Fuzzing is an effective method for detecting security bugs in software, and there have been quite a few effective works on fuzzing Android. Researchers have developed methods for fuzzing open-source native APIs and Java interfaces on actual Android devices. However, the realm of automatically fuzzing Android closed-source native libraries, particularly on emulators, remains insufficiently explored. There are two key challenges: firstly, the multi-language programming model inherent to Android; and secondly, the absence of a Java runtime environment within the emulator. To address these challenges, we propose Atlas, a practical automated fuzz framework for Android closed-source native libraries. Atlas consists of an automatic harness generator and a fuzzer containing the necessary runtime environment. The generator uses static analysis techniques to deduce the correct calling sequences and parameters of the native API according to the information from the "native world" and the "Java world". To maximize the practicality of the generated harness, Atlas heuristically optimizes the generated harness. The Fuzzer provides the essential Java runtime environment in the emulator, making it possible to fuzz the Android closed-source native libraries on a multi-core server. We have tested Atlas on 17 pre-installed apps from four Android vendors. Atlas generates 820 harnesses containing 767 native APIs, of which 78% is practical. Meanwhile, Atlas has discovered 74 new security bugs with 16 CVEs assigned. The experiments show that Atlas can efficiently generate high-quality harnesses and find security bugs.
DOI 原文 ·
@inproceedings{paperbot8483,
title = {Atlas: Automating Cross-Language Fuzzing on Android Closed-Source Libraries},
author = {Hao Xiong and Qinming Dai and Rui Chang and Mingran Qiu and Renxiang Wang and Wenbo Shen and Yajin Zhou},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3652133}
}