Binary-level Directed Fuzzing for Use-After-Free Vulnerabilities

Abstract

Directed fuzzing focuses on automatically testing specific parts of the code by taking advantage of additional information such as (partial) bug stack trace, patches or risky operations. Key applications include bug reproduction, patch testing and static analysis report verification. Although directed fuzzing has received a lot of attention recently, hard-to-detect vulnerabilities such as Use-After-Free (UAF) are still not well addressed, more especially at the binary level. We propose UAFUZZ, the first (binary-level) directed greybox fuzzer dedicated to UAF bugs. The technique features a fuzzing engine tailored to UAF specifics, a lightweight code instrumentation and an efficient bug triage step. Experimental evaluation for bug reproduction on real cases demonstrates that UAFUZZ significantly outperforms state-of-the-art directed fuzzers in terms of fault detection rate, time to exposure and bug triaging. UAFUZZ has also been proven effective in patch testing, leading to the discovery of 20 new bugs in Perl, GPAC and GNU Patch (including a buggy patch) -all of them have been acknowledged and 14 have been fixed. Last but not least, we provide to the community the first fuzzing benchmark dedicated to UAF, built on both real codes and real bugs.

The Progress, Challenges, and Perspectives of Directed Greybox Fuzzing

“…For example, selecting critical sites, such as memory allocation function malloc() or string manipulation function strcpy(), as targets are more likely to trigger memory corruption bugs. Besides, we can leverage the relationship among targets to accelerate detecting complex behavioral bugs, such as use-after-free [22,28]. Thus, the involvement of targets gives more chance to optimize DGF by applying customized techniques that are specific to DGF.…”

“…For example, in order to trigger use-after-free vulnerabilities, a sequence of operations (e.g., allocate memory, use memory, and free memory) must be executed in a specific order. UAFuzz [22] and UAFL [28] leverages target sequences instead of target sites to find use-after-free vulnerabilities. LOLLY [23] also uses target statement sequences to guide greybox fuzzing to trigger bugs that resulted from the sequential execution of multiple statements.…”

“…In the exploration phase, the low-frequency seeds are prioritized to improve the coverage, and for the exploitation phase, the low distance seeds are preferred to achieve the target code areas. UAFuzz is a tailored directed greybox fuzzer for complex behavioral use-after-free vulnerabilities [22]. Different from the distance based on the control-flow graph, it uses a distance metric of call chains leading to the target functions that are more likely to include both allocation and free functions.…”

“…UAFL [28] uses the operation sequence coverage as the feedback to guide the testcase generation to progressively cover the operation sequences that are likely to trigger use-after-free vulnerabilities. UAFuzz [22] also uses a sequenceness-aware target similarity metric to measure the similarity between the execution of a seed and the target UAF bug trace. The sequenceness-aware target similarity metric concretely assesses how many targets a seed execution trace covers at runtime and takes ordering of the targets into account.…”

“…For now, DGF has evolved beyond the primary pattern that depends on manually labeled target sites and distance-based metrics to prioritize the seeds. A great number of variations have been realized to boost software testing under different scenarios, such as fuzzers directed by target sequence [22][23][24], by semantic information [25,26], by parser [27], by typestate [28], by sanitizer checks [29,30], by memory usage [31], and by vulnerable probability [32]. Complex deep behavioral testing scenes, such as use-afterfree bugs [22,28], memory consumption bugs [31], memory violation bugs [33], algorithmic complexity vulnerabilities [5], input validation bugs in robotic vehicles [34], and deep stateful bugs [35].…”