Write a Blog >>
Tue 11 Oct 2022 11:40 - 12:00 at Banquet B - Technical Session 3 - Fuzzing I Chair(s): Aravind Machiry

Greybox fuzzing is a proven effective testing method for the detection of security vulnerabilities and other bugs in modern software systems. Greybox fuzzing can also be used in combination with a sanitizer, such as AddressSanitizer (ASAN), to further enhance the detection of certain classes of bug such as buffer overflow and use-after-free errors. However, sanitizers also introduce additional performance overheads, and this can degrade the performance of greybox fuzzing—measured in the order of 2.36x for fuzzing with ASAN—potentially negating the benefit of using a sanitizer in the first place. Recent research attributes this to extra overheads to additional page faults that are generated when the disjoint sanitizer metadata is accessed at runtime.

In this paper, we present a new design that can detect memory errors without a proliferation of page faults. The basic idea is to track memory validity using randomized tokens that are stored directly in the memory itself, rather than in disjoint metadata. All read/write operations are instrumented to check for the token, and if present, a memory error will be detected. We implement our design in the form of the ReZZan—a sanitizer specifically optimized for fuzz testing. Since there is no disjoint metadata access, no additional page faults are generated, minimizing the performance overhead to around 1.14-1.27x (depending on the configuration).

Tue 11 Oct

Displayed time zone: Eastern Time (US & Canada) change

10:30 - 12:30
Technical Session 3 - Fuzzing IResearch Papers / Tool Demonstrations / NIER Track at Banquet B
Chair(s): Aravind Machiry Purdue University
10:30
20m
Research paper
LawBreaker: An Approach for Specifying Traffic Laws and Fuzzing Autonomous Vehicles
Research Papers
Yang Sun Singapore Management University, Singapore, Chris Poskitt Singapore Management University, Jun Sun Singapore Management University, Yuqi Chen ShanghaiTech University, China, Zijiang Yang Xi'an Jiaotong University and GuardStrike Inc
DOI Pre-print
10:50
20m
Research paper
Fuzzle: Making a Puzzle for FuzzersACM SIGSOFT Distinguished Paper Award
Research Papers
Haeun Lee KAIST, Soomin Kim KAIST, Sang Kil Cha KAIST, South Korea
11:10
10m
Demonstration
ADEPT: A Testing Platform for Simulated Autonomous DrivingVirtual
Tool Demonstrations
Sen Wang Nanjing University, Zhuheng Sheng Nanjing University, Jingwei Xu , Taolue Chen University of Surrey, UK, Junjun Zhu Nanjing University, Shuhui Zhang Nanjing University, Yuan Yao Nanjing University, Xiaoxing Ma Nanjing University
11:20
20m
Research paper
HTFuzz: Heap Operation Sequence Sensitive FuzzingVirtual
Research Papers
Yuanping Yu Institute of Software, Chinese Academy of Sciences, Xiangkun Jia Institute of Software Chinese Academy of Sciences, Yuwei Liu Institute of Software, Chinese Academy of Sciences, Yanhao Wang Qi An Xin Group Corp., Qian Sang Institute of Software, Chinese Academy of Sciences, Chao Zhang Tsinghua University, Purui Su Institute of Software/CAS China
11:40
20m
Research paper
Efficient Greybox Fuzzing to Detect Memory ErrorsVirtualACM SIGSOFT Distinguished Paper Award
Research Papers
Jinsheng Ba National University of Singapore, Gregory J. Duck National University of Singapore, Abhik Roychoudhury National University of Singapore
12:00
20m
Research paper
Griffin: Grammar-Free DBMS FuzzingVirtual
Research Papers
Jingzhou Fu School of Software, Tsinghua University, Jie Liang School of Software, Tsinghua University, Zhiyong Wu Tsinghua University, China, Mingzhe Wang Tsinghua University, Yu Jiang Tsinghua University
12:20
10m
Vision and Emerging Results
A Novel Coverage-gudied Greybox Fuzzing based on Power Schedule Optimization with Time ComplexityVirtual
NIER Track
Shengran Wang School of Computer Science and Communication Engineering, Jiangsu University, Jinfu Chen Jiangsu University, Saihua Cai School of Computer Science and Communication Engineering, Jiangsu University, Chi Zhang Jiangsu University, Haibo Chen School of Computer Science and Communication Engineering, Jiangsu University, Jingyi Chen School of Computer Science and Communication Engineering, Jiangsu University