This program is tentative and subject to change.
USB is an interface standard widely used in modern operating systems to connect computers to various external devices. External devices can launch attacks by injecting random data into the host via USB, resulting in memory errors or even system-level crashes. Fuzzing has been proven to be an effective method to detect USB driver vulnerabilities. However, existing fuzzing methods generate testing inputs without considering the format and semantic of USB descriptors, which define device functionalities. Thus, many test cases fail to pass the host’s input validation mechanism, resulting in ineffective testing. In this paper, we propose DNAFuzz, a USB driver fuzzer that generates descriptor-aware payload. First, it utilizes USB specifications to parse USB descriptors and extracts the precise input types, tags, and range constraints of each descriptor item. Then, based on the extracted item attributes and the interpreted semantic information of the descriptors, DNAFuzz guides the payload generation. This approach improves the quality of test cases and the fuzzing effectiveness. Currently, we have tested DNAFuzz on multiple versions of Linux kernel USB drivers, and compared it with state-of-the-art fuzzers such as USBFuzz and Syzkaller. Results show that DNAFuzz significantly improves input quality, successfully increasing the proportion of tests with execution times exceeding 2 seconds by 358% and 65%. In addition, DNAFuzz detected 15 bugs, 11 of which have been fixed or confirmed by the corresponding maintainers.
This program is tentative and subject to change.
Tue 18 NovDisplayed time zone: Seoul change
14:00 - 15:30 | |||
14:00 10mTalk | RSFuzz: A Robustness-Guided Swarm Fuzzing Framework Based on Behavioral Constraints Research Papers Ruoyu Zhou School of Computer Science and Technology, Xidian University, Xi'an, China; Shaanxi Key Laboratory of Network and System Security, Xidian University, Xi'an, China, Zhiwei Zhang School of Computer Science and Technology, Xidian University, Xi'an, China; Shaanxi Key Laboratory of Network and System Security, Xidian University, Xi'an, China, Haocheng Han School of Computer Science and Technology, Xidian University, Xi'an, China; Shaanxi Key Laboratory of Network and System Security, Xidian University, Xi'an, China, Xiaodong Zhang University of Chinese Academy of Science, Zehan Chen School of Computer Science and Technology, Xidian University, Xi’an, China; Shaanxi Key Laboratory of Network and System Security , Xidian University, Jun Sun Singapore Management University, Yulong Shen Xidian University, Dehai Xu Yiqiyin (Hangzhou) Technology Co., Ltd. Xi'an Branch, Xi'an, China | ||
14:10 10mTalk | DualFuzz: Detecting Vulnerability in Wi-Fi NICs through Dual-Directional Fuzzing Research Papers Yuanliang Chen Tsinghua University, Fuchen Ma Tsinghua University, Yanyang Zhao Tsinghua University, Yuanyi Li Shuimu Yulin Technology Co., Ltd, Yu Jiang Tsinghua University | ||
14:20 10mTalk | ORFuzz: Fuzzing the "Other Side" of LLM Safety – Testing Over-Refusal Research Papers Haonan Zhang Zhejiang University, Dongxia Wang Zhejiang University, Yi Liu Nanyang Technological University, Kexin Chen Zhejiang University, Jiashui Wang Zhejiang University, Xinlei Ying Ant Group, Long Liu Ant Group, Wenhai Wang Zhejiang University Pre-print | ||
14:30 10mTalk | DNAFuzz: Descriptor-Aware Fuzzing for USB Drivers Research Papers Zhengshu Wang Hubei University, Peng He Hubei University, Fuchen Ma Tsinghua University, Yuanliang Chen Tsinghua University, Shuoshuo Duan Shuimu Yulin Technology Co., Ltd, Yiyuan Bai Shuimu Yulin Technology Co., Ltd, Yu Jiang Tsinghua University | ||
14:40 10mTalk | ARG: Testing Query Rewriters via Abstract Rule Guided Fuzzing Research Papers Dawei Li Beihang University, Yuxiao Guo Beihang University, Qifan Liu Beihang University, Jie Liang Beihang University, Zhiyong Wu Tsinghua University, China, Jingzhou Fu School of Software, Tsinghua University, Chi Zhang Tsinghua University, Yu Jiang Tsinghua University | ||
14:50 10mTalk | Algernon: A Flag-Guided Hybrid Fuzzer for Unlocking Hidden Program Paths Research Papers Peng Deng Fudan University, Lei Zhang Fudan University, Jingqi Long Fudan University, Wenzheng Hong Independent, Zhemin Yang Fudan University, Yuan Zhang Fudan University, Donglai Zhu Fudan University, Min Yang Fudan University | ||
15:00 10mTalk | Interleaved Learning and Exploration: A Self-Adaptive Fuzz Testing Framework for MLIR Research Papers Zeyu Sun Institute of Software, Chinese Academy of Sciences, Jingjing Liang East China Normal University, Weiyi Wang Institute of Software, Chinese Academy of Sciences, Chenyao Suo Tianjin University, Junjie Chen Tianjin University, Fanjiang Xu Institute of Software at Chinese Academy of Sciences | ||
15:10 10mTalk | RCFuzz: Recommendation-based Collaborative Fuzzer Journal-First Track | ||
15:20 10mTalk | WingMuzz: Blackbox Testing of IoT Protocols via Two-dimensional Fuzzing Schedule Research Papers Xiaogang Zhu The University of Adelaide, Enze Dai Shenzhen International Graduate School, Tsinghua University, Xiaotao Feng 360 Vulnerability Research Institute, Shaohua Wang Central University of Finance and Economics, Xin Xia Zhejiang University, Sheng Wen Swinburne University of Technology, Kwok-Yan Lam Nanyang Technological University, Singapore, Yang Xiang Digital Research & Innovation Capability Platform, Swinburne University of Technology | ||