Sleuth: A Switchable Dual-Mode Fuzzer to Investigate Bug Impacts Following a Single PoC
This program is tentative and subject to change.
A proof of concept (PoC) is essential for pinpointing a bug within software. However, relying on it alone for the timely and complete repair of bugs is insufficient due to underestimating the bug impacts. The bug impact reflects that a bug may be triggered at multiple positions following the root cause, resulting in different bug types (e.g., use-after-free, heap-buffer-overflow). Current techniques discover bug impacts using fuzzing with a specific coverage-guided strategy: assigning more energy to seeds that cover the buggy code regions. This method can utilize a single PoC to generate multiple PoCs that contain different bug impacts in a short period. Unfortunately, we observe existing techniques are still unreliable, primarily due to their failure in balancing the time between in-depth and breadth exploration: (i) in-depth exploration for bug impacts behind crash regions and (ii) breadth exploration for bug impacts alongside unreached regions. Current techniques only focus on one exploration or conduct two explorations in separate stages leading to low accuracy and efficiency.
Considering the aforementioned problem, we propose Sleuth, an approach for automatically investigating bug impacts following a known single PoC to enhance bug fixing. We design Sleuth on two novel concepts: (i) a dual-mode exploration mechanism built on a fuzzer designed for efficient in-depth and breadth exploration. (ii) a dynamic switchable strategy connecting with the dual-mode exploration that facilitates the reliability of bug impact investigation. We evaluate Sleuth using 50 known CVEs, and the result of experiment shows that Sleuth can efficiently discover new bug impacts in 86% CVEs and find 1.5x more bug impacts than state-of-art tools. Furthermore, Sleuth successfully identifies 13 incomplete fixes using the generated new PoCs.
This program is tentative and subject to change.
Wed 18 SepDisplayed time zone: Amsterdam, Berlin, Bern, Rome, Stockholm, Vienna change
10:30 - 11:50 | |||
10:30 20mTalk | Policy Testing with MDPFuzz (Replicability Study) Technical Papers Quentin Mazouni Simula Research Laboratory, Helge Spieker Simula Research Laboratory, Norway, Arnaud Gotlieb Simula Research Laboratory, Mathieu Acher University of Rennes, France / Inria, France / CNRS, France / IRISA, France | ||
10:50 20mTalk | Fuzzing JavaScript Interpreters with Coverage-Guided Reinforcement Learning for LLM-based Mutation Technical Papers | ||
11:10 20mTalk | Enhancing ROS System Fuzzing through Callback Tracing Technical Papers Yuheng Shen Tsinghua University, Jianzhong Liu ShanghaiTech University, Yiru Xu Tsinghua University, Hao Sun ETH Zurich, Mingzhe Wang Tsinghua University, Heyuan Shi Central South University, Nan Guan City University of Hong Kong, Yu Jiang Tsinghua University DOI | ||
11:30 20mTalk | Sleuth: A Switchable Dual-Mode Fuzzer to Investigate Bug Impacts Following a Single PoC Technical Papers Haolai Wei Institute of Information Engineering, Chinese Academy of Sciences, School of Cyber Security, University of Chinese Academy of Sciences, Liwei Chen Institute of Information Engineering, Chinese Academy of Sciences, Zhijie Zhang Institute of Information Engineering, Chinese Academy of Sciences, School of Cyber Security, University of Chinese Academy of Sciences, Gang Shi Institute of Information Engineering, Chinese Academy of Sciences, School of Cyber Security, University of Chinese Academy of Sciences, Dan Meng Institute of Information Engineering, Chinese Academy of Sciences |