Dynamically Discovering Likely Memory Layout to Perform Accurate Fuzzing

ISCAS OpenIR

	Dynamically Discovering Likely Memory Layout to Perform Accurate Fuzzing
	Chen, K; Zhang, YJ; Liu, P
	2016
发表期刊	IEEE TRANSACTIONS ON RELIABILITY
ISSN	0018-9529
卷号	65 期号:3 页码:1180-1194
摘要	Malicious Input through Buffer Overflow (MiBO) vulnerabilities play important roles in cyber security. To identify MiBO vulnerabilities, white-box testing approaches analyze instructions in all possible execution paths. Black-box testing approaches try to trigger MiBO vulnerabilities using different inputs. However, only limited coverage can be achieved: the identified MiBO vulnerabilities, when being "hit" by a test input, must cause exceptions (e.g., crashes). Type information could help to catch the non-crash MiBO vulnerabilities, but such information is not contained in binary code. In this paper, we present a white-box fuzzing method to detect non-crash MiBO vulnerabilities. Without source code, we dynamically discover likely memory layouts to help the fuzzing process. This is very challenging since memory addresses and layouts keep changing with the running of software. In different executions with different inputs, the layouts may also change. To address these challenges, we selectively analyze memory operations to identify memory layouts. If a buffer border identified from the memory layout is exceeded, an error will be reported. The fuzzing results will be compared with the layout for future input generation, which greatly increases the opportunity to expose MiBO vulnerabilities. We implemented a prototype called ArtFuzz and performed several evaluations. ArtFuzz discovered 23 real MiBO vulnerabilities (including 8 zero-day MiBO vulnerabilities) in nine applications.; Malicious Input through Buffer Overflow (MiBO) vulnerabilities play important roles in cyber security. To identify MiBO vulnerabilities, white-box testing approaches analyze instructions in all possible execution paths. Black-box testing approaches try to trigger MiBO vulnerabilities using different inputs. However, only limited coverage can be achieved: the identified MiBO vulnerabilities, when being "hit" by a test input, must cause exceptions (e.g., crashes). Type information could help to catch the non-crash MiBO vulnerabilities, but such information is not contained in binary code. In this paper, we present a white-box fuzzing method to detect non-crash MiBO vulnerabilities. Without source code, we dynamically discover likely memory layouts to help the fuzzing process. This is very challenging since memory addresses and layouts keep changing with the running of software. In different executions with different inputs, the layouts may also change. To address these challenges, we selectively analyze memory operations to identify memory layouts. If a buffer border identified from the memory layout is exceeded, an error will be reported. The fuzzing results will be compared with the layout for future input generation, which greatly increases the opportunity to expose MiBO vulnerabilities. We implemented a prototype called ArtFuzz and performed several evaluations. ArtFuzz discovered 23 real MiBO vulnerabilities (including 8 zero-day MiBO vulnerabilities) in nine applications.
收录类别	SCI
关键词	Dynamic Testing Fuzzing Memory Layout Vulnerability White-box
部门归属	Chinese Acad Sci, State Key Lab Informat Secur, Inst Informat Engn, Beijing 100195, Peoples R China. Chinese Acad Sci, Inst Software, Trusted Comp & Informat Assurance Lab, Beijing 100190, Peoples R China. Penn State Univ, Coll Informat Sci & Technol, State Coll, PA 16801 USA.
语种	英语
WOS记录号	WOS:000382714400006
引用统计
内容类型	期刊论文
URI标识	http://ir.iscas.ac.cn/handle/311060/17305
专题	中国科学院软件研究所
推荐引用方式 GB/T 7714	Chen, K,Zhang, YJ,Liu, P. Dynamically Discovering Likely Memory Layout to Perform Accurate Fuzzing[J]. IEEE TRANSACTIONS ON RELIABILITY,2016,65(3):1180-1194.
APA	Chen, K,Zhang, YJ,&Liu, P.(2016).Dynamically Discovering Likely Memory Layout to Perform Accurate Fuzzing.IEEE TRANSACTIONS ON RELIABILITY,65(3),1180-1194.
MLA	Chen, K,et al."Dynamically Discovering Likely Memory Layout to Perform Accurate Fuzzing".IEEE TRANSACTIONS ON RELIABILITY 65.3(2016):1180-1194.

条目包含的文件
文件名称/大小	文献类型	版本类型	开放类型	使用许可
07386711.pdf（1849KB）			开放获取	使用许可	请求全文