Abstract
Uncontrolled memory consumption is a kind of critical software security weaknesses. It can also become a security-critical vulnerability when attackers can take control of the input to consume a large amount of memory and launch a Denial-of-Service attack. However, detecting such vulnerability is challenging, as the state-of-the-art fuzzing techniques focus on the code coverage but not memory consumption. To this end, we propose a memory usage guided fuzzing technique, named MemLock, to generate the excessive memory consumption inputs and trigger uncontrolled memory consumption bugs. The fuzzing process is guided with memory consumption information so that our approach is general and does not require any domain knowledge. We perform a thorough evaluation for MemLock on 14 widely-used real-world programs. Our experiment results show that MemLock substantially outperforms the state-of-the-art fuzzing techniques, including AFL, AFLfast, PerfFuzz, FairFuzz, Angora and QSYM, in discovering memory consumption bugs. During the experiments, we discovered many previously unknown memory consumption bugs and received 15 new CVEs.
Original language | English |
---|---|
Title of host publication | 42nd International Conference on Software Engineering (ICSE 2020) |
Publisher | ACM |
Number of pages | 13 |
ISBN (Electronic) | 9781450371216 |
DOIs | |
Publication status | Accepted/In press - 1 May 2020 |
Event | 42nd International Conference on Software Engineering - Seoul, Korea, Republic of Duration: 5 Oct 2020 → 11 Oct 2020 Conference number: ICSE 2020 https://conf.researchr.org/home/icse-2020 |
Conference
Conference | 42nd International Conference on Software Engineering |
---|---|
Country | Korea, Republic of |
City | Seoul |
Period | 5/10/20 → 11/10/20 |
Internet address |
Fingerprint Dive into the research topics of 'MemLock: Memory Usage Guided Fuzzing'. Together they form a unique fingerprint.
Profiles
-
Shengchao Qin
- Department of Computing & Games - Professor of Computer Science
- Centre for Digital Innovation
Person: Professorial