ASE 2022★ Distinguished Paper

Efficient Greybox Fuzzing to Detect Memory Errors

Jinsheng Ba, Gregory J. Duck, Abhik Roychoudhury

Abstract

Greybox fuzzing is a proven and effective testing method for the detection of security vulnerabilities and other bugs in modern software systems. Greybox fuzzing can also be used in combination with a sanitizer, such as AddressSanitizer (ASAN), to further enhance the detection of certain classes of bugs such as buffer overflow and use-after-free errors. However, sanitizers also introduce additional performance overheads, and this can degrade the performance of greybox mode fuzzing—measured in the order of 2.36 × for fuzzing with ASAN—partially negating the benefit of using a sanitizer in the first place. Recent research attributes the extra overhead to program startup/teardown costs that can dominate fork-mode fuzzing.

BibTeX

@inproceedings{Ba-al:ASE22,
  author    = {Jinsheng Ba and
               Gregory J. Duck and
               Abhik Roychoudhury},
  title     = {Efficient Greybox Fuzzing to Detect Memory Errors},
  booktitle = {ASE},
  pages     = {37:1--37:12},
  publisher = {{ACM}},
  year      = {2022},
}

Efficient Greybox Fuzzing to Detect Memory Errors

Abstract

Related papers