HDR-Fuzz: Detecting Buffer Overruns using AddressSanitizer Instrumentation and Fuzzing

Abstract

Buffer-overruns are a prevalent vulnerability in software libraries and applications. Fuzz testing is one of the effective techniques to detect vulnerabilities in general. Greybox fuzzers such as AFL automatically generate a sequence of test inputs for a given program using a fitness-guided search process. A recently proposed approach in the literature introduced a buffer-overrun specific fitness metric called "headroom", which tracks how close each generated test input comes to exposing the vulnerabilities. That approach showed good initial promise, but is somewhat imprecise and expensive due to its reliance on conservative points-to analysis. Inspired by the approach above, in this paper we propose a new ground-up approach for detecting buffer-overrun vulnerabilities. This approach uses an extended version of ASAN (Address Sanitizer) that runs in parallel with the fuzzer, and reports back to the fuzzer test inputs that happen to come closer to exposing bufferoverrun vulnerabilities. The ASAN-style instrumentation is precise as it has no dependence on points-to analysis. We describe in this paper our approach, as well as an implementation and evaluation of the approach.

The progress, challenges, and perspectives of directed greybox fuzzing

“…Meanwhile, CVE information, commit changes, binary diffing techniques, and tools such as UBSan and AddressSanitizer, are adopted to label various potential vulnerable code regions. Examples include DrillerGo [28], TortoiseFuzz [27], AFLChurn [26], GREY-HOUND [15], DeltaFuzz [25], 1DVUL [23], SAVIOR [100] and HDR-Fuzz [101]. • The fuzzing process has been enhanced with various approaches, such as using data-flow analysis and semantic analysis to generate valid input, using symbolic execution to pass complex constraints.…”

“…It defines the distance of constraints as how well a given seed satisfies the constraints and prioritizes the seeds that better satisfy the constraints in order. AFL-HR [81] and HDR-Fuzz [101] adopt a vulnerability-oriented fitness metric called headroom, which indicates how closely a test input can expose a hard-to-manifest vulnerability (e.g. buffer or integer overflow) at a given vulnerability location.…”

“…For example, AFLChurn [26] leverages lightweight ant colony optimization instead of expensive taint analysis to find "interesting bytes" and realize a byte-level power scheduling; -Leverage parallel computing. For example, HDR-Fuzz [101] uses another core to run AddressSanitizer in parallel and provides guidance to the directedness. Large-scale parallel fuzzing [109,110] can also be adopted to improve efficiency further.…”

“…Multi-dimensional fitness metrics are also proposed to detect hardto-manifest vulnerabilities. Examples include AFL-HR [81], HDRFuzz [101] and AFLPro [86]. • To facilitate target identification, tools based on machine learning can predict and label potential targets automatically, examples include SUZZER [31], V-Fuzz [30], DeFuzz [32], and SemFuzz [22].…”

An In-Depth Survey of Bypassing Buffer Overflow Mitigation Techniques

“…It helps the administrator to detect the attack and catch the intruder in real-time by sending a real-time message and email. The tool named Address Sanitizer has been implemented in GCC by Google to detect errors in memory [54]. It is used to detect Out-of-bounds, Use-after-free, and memory leaks.…”