MemLock: Memory Usage Guided Fuzzing

Cheng Wen, Haijun Wang, Yuekang Li, Shengchao Qin, Yang Liu, Zhiwu Xu, Hongxu Chen, Xiaofei Xie, GeGuang Pu, Ting Liu

Research output: Chapter in Book/Report/Conference proceedingConference contribution

220 Downloads (Pure)

Abstract

Uncontrolled memory consumption is a kind of critical software security weaknesses. It can also become a security-critical vulnerability when attackers can take control of the input to consume a large amount of memory and launch a Denial-of-Service attack. However, detecting such vulnerability is challenging, as the state-of-the-art fuzzing techniques focus on the code coverage but not memory consumption. To this end, we propose a memory usage guided fuzzing technique, named MemLock, to generate the excessive memory consumption inputs and trigger uncontrolled memory consumption bugs. The fuzzing process is guided with memory consumption information so that our approach is general and does not require any domain knowledge. We perform a thorough evaluation for MemLock on 14 widely-used real-world programs. Our experiment results show that MemLock substantially outperforms the state-of-the-art fuzzing techniques, including AFL, AFLfast, PerfFuzz, FairFuzz, Angora and QSYM, in discovering memory consumption bugs. During the experiments, we discovered many previously unknown memory consumption bugs and received 15 new CVEs.
Original languageEnglish
Title of host publicationProceedings - 2020 ACM/IEEE 42nd International Conference on Software Engineering, ICSE 2020
PublisherACM
Pages765-777
Number of pages13
ISBN (Electronic)9781450371216
ISBN (Print)9781450371216
DOIs
Publication statusPublished - 27 Jun 2020
Event42nd International Conference on Software Engineering - Seoul, Korea, Republic of
Duration: 5 Oct 202011 Oct 2020
Conference number: ICSE 2020
https://conf.researchr.org/home/icse-2020

Publication series

NameProceedings of the ACM/IEEE 42nd International Conference on Software Engineering
ISSN (Print)0270-5257

Conference

Conference42nd International Conference on Software Engineering
Country/TerritoryKorea, Republic of
CitySeoul
Period5/10/2011/10/20
Internet address

Bibliographical note

Funding Information:
This work was supported in part by the National Natural Science Foundation of China under Grants No. 61772347, 61836005, 61972260, 61772408, 61721002, Ant Financial Services Group through Ant Financial Research Program, Guangdong Basic and Applied Basic Research Foundation under Grant No. 2019A1515011577, National Key R&D Program of China under Grant No. 2018YFB0803501.

Publisher Copyright:
© 2020 Association for Computing Machinery.

Copyright:
Copyright 2020 Elsevier B.V., All rights reserved.

Fingerprint

Dive into the research topics of 'MemLock: Memory Usage Guided Fuzzing'. Together they form a unique fingerprint.

Cite this