Expanding the Reach of Fuzzing Caroline Lemieux September 8 th , - PowerPoint PPT Presentation

Expanding the Reach of Fuzzing Caroline Lemieux September 8 th , 2020 Fuzzcon Europe

Coverage-Guided Fuzzing Greybox, Mutational seeds Input Input Input Input Initial Input pick mutate Input execute Input Input Input n ’ save Execution Execution Feedback Execution Input 2 ’ Interesting Feedback? Feedback Execution Feedback Input n ’ Feedback n 1 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

Coverage-Guided Fuzzing Can we modify CGF tools for: Greybox, Mutational seeds Different Bugs Input Input Input Input Initial Input pick mutate Input execute Input Input Input n ’ Deeper Exploration save Execution Execution Feedback Execution Input 2 ’ Interesting Feedback? Feedback Execution Feedback Input n ’ Feedback n 2 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

Different Bugs Deeper Exploration 3 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

Pe PerfFuzz https://github.com/carolemieux/perffuzz Fu FuzzF zzFactor ory https://github.com/rohanpadhye/FuzzFactory Deeper Exploration 4 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

Nobody Expects Performance Problems 5 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

Alleviating Performance Problems DEV DE Pathological Input Profiling Tool 6 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

Alleviating Performance Problems DEV DE Pathological Input Profiling Tool 7 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

PerfFuzz Goal Automatically generate pathological inputs DEV DE Pathological Input Profiling Tool 8 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

Can We Use Coverage-Guided Fuzzing? seeds Input Input Input Input Initial Input pick mutate Input execute Input Input Input n ’ save Execution Execution Feedback Execution Input 2 ’ Interesting Feedback? Feedback Execution Feedback Input n ’ Feedback n Input executes for longer? Execution time of input 9 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

Can We Use Coverage-Guided Fuzzing? seeds Input Input ✗ Input Input Initial Input pick mutate Input execute Input Input Input n ’ Too coarsed-grained! save Execution Execution Feedback Execution Input 2 ’ Interesting Feedback? Feedback Execution Feedback Input n ’ Feedback n Input executes for longer? Execution time of input 10 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

Can We Use Coverage-Guided Fuzzing? seeds Input Input Input Input Initial Input pick mutate Input execute Input Input Input n ’ save Execution Execution Feedback Execution Input 2 ’ Interesting Feedback? Feedback Execution Feedback Input n ’ Feedback n 11 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

PerfFuzz seeds Input Input Input Input Initial Input pick mutate Input execute Input Input Input n ’ save Ed Edge # # Hits Ed Edge # # Hits Ed Edge # Hits # Edge Ed # Hits # Input 2 ’ Interesting Feedback? Input n ’ ... ... ... ... ... ... ... ... 12 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

PerfFuzz seeds Input Input Input Input Initial Input pick mutate Input execute Input Input Input n ’ save Ed Edge # # Hits Ed Edge # # Hits Maximizes # hits Edge Ed # Hits # for some edge? Edge Ed # Hits # Input 2 ’ Input n ’ ... ... ... ... ... ... ... ... 13 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

PerfFuzz pick input seeds maximizing # hits for Input Input Input Input Initial some edge Input mutate Input execute Input Input Input n ’ save Edge Ed # # Hits Edge Ed # Hits # Maximizes # hits Edge Ed # # Hits for some edge? Ed Edge # # Hits Input 2 ’ Input n ’ ... ... ... ... ... ... ... ... 14 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

PerfFuzz: Algorithmic Complexity • Maximum path length for varying input sizes Insertion Sort PCRE URL regex Word Frequency 500 3erI)uzz 3erI)uzz 3erI)uzz 0axLPuP 3ath Length 0axLPuP 3ath Length 0axLPuP 3ath Length 300k 6low)uzz 6low)uzz 6low)uzz 3000 400 300 200k 2000 200 1000 100k 100 0 10 20 30 40 50 60 10 20 30 40 50 60 10 20 30 40 50 60 0ax InSut Length (bytes) 0ax InSut Length (bytes) 0ax InSut Length (bytes) 15 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

PerfFuzz: Algorithmic Complexity • Maximum path length for varying input sizes All hash collisions Insertion Sort PCRE URL regex Word Frequency 500 3erI)uzz 3erI)uzz 3erI)uzz 0axLPuP 3ath Length 0axLPuP 3ath Length 0axLPuP 3ath Length 300k 6low)uzz 6low)uzz 6low)uzz ? 3000 400 300 200k 2000 200 1000 Many short words 100k 100 0 10 20 30 40 50 60 10 20 30 40 50 60 10 20 30 40 50 60 0ax InSut Length (bytes) 0ax InSut Length (bytes) 0ax InSut Length (bytes) 16 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

PerfFuzz pick input seeds maximizing https://github.com/carolemieux/perffuzz # hits for Input Input Input Input Initial some edge Input mutate Input execute Input Input Input n ’ Built on top of AFL • Comes with afl-showmax tool to • identify bad inputs save Edge Ed # Hits # Ed Edge # # Hits Maximizes # hits Requires building with afl-clang- • Ed Edge # Hits # for some edge? Edge Ed # # Hits Input 2 ’ Input n ’ fast ... ... ... ... ... ... ... ... 17 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

PerfFuzz pick input seeds maximizing # hits for Input Input Input Input Initial some edge Input mutate Input execute Input Input Input n ’ save Edge Ed # # Hits Edge Ed # Hits # Maximizes # hits Edge Ed # # Hits for some edge? Ed Edge # # Hits Input 2 ’ Input n ’ ... ... ... ... ... ... ... ... 18 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

Observation: Algorithm is More General pick input seeds maximizing # hits for Input Input Input Input Initial some edge Input mutate Input execute Input Input Input n ’ save Edge Ed # # Hits Edge Ed # Hits # Maximizes # hits Edge Ed # # Hits for some edge? Ed Edge # # Hits Input 2 ’ Input n ’ ... ... ... ... ... ... ... ... 19 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

Observation: Algorithm is More General pick input seeds maximizing value for va Input Input Input Input Initial some ke key Input mutate Input execute Input Input Input n ’ save Ke Key Value Va Ke Key Va Value Maximizes va value Ke Key Va Value for some ke key ? Key Ke Va Value Input 2 ’ Input n ’ ... ... ... ... ... ... ... ... 20 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

What Other Problems Can We Solve? Ke Key Va Value ... ... ... ... ... ... ... ... 21 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

What Other Problems Can We Solve? e.g. finding memory-allocation maximizing inputs Ke Key Va Value ... ... Memory Allocation Location: Cumulative amount of memory ... ... allocated Line 247: x = malloc(…); ... ... ... ... 22 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

What Other Problems Can We Solve? e.g. going through “hard” comparisons Ke Key Va Value ... ... “Hard” Comparison Location: ... ... Number of bits matched if ( x == 0xBAD0CAFE) ... ... ... ... 23 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

Observation: Algorithm is More General pick input seeds maximizing value for va Input Input Input Input Initial some ke key Input mutate Input execute Input Input Input n ’ save Ke Key Value Va Ke Key Va Value Maximizes va value Ke Key Va Value for some ke key ? Key Ke Va Value Input 2 ’ Input n ’ ... ... ... ... ... ... ... ... 24 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

FuzzFactory pick input seeds maximizing value for va Input Input Input Input Initial some ke key Input mutate Input execute Input Input Input n ’ save Ke Key Value Va Ke Key Va Value Maximizes va value Ke Key Va Value for some ke key ? Key Ke Va Value Input 2 ’ Input n ’ ... ... ... ... ... ... ... ... 25 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe

FuzzFactory, Step 1: Generalize Algorithm pick input with newest seeds aggregate va value for Input Input Input Input Initial some ke key Input mutate Input execute Input Input Input n ’ save Key Ke Value Va Ke Key Va Value New aggregate va value Ke Key Va Value for some ke key Key Ke Va Value Input 2 ’ Input n ’ ... ... ... ... ... ... ... ... 26 9/10/20 Caroline Lemieux -- Expanding the Reach of Fuzzing @ FuzzCon Europe