Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Triggering and Detecting Exploitable Library Vulnerability from the Client by Directed Greybox Fuzzing

Yukai Zhao, Menghan Wu, Xing Hu, Shaohua Wang, Meng Luo, Xin Xia

Abstract

Developers utilize third-party libraries to improve productivity, which also introduces potential security risks. Existing approaches generate tests for public functions to trigger library vulnerabilities from client programs, yet they depend on proof-of-concepts (PoCs), which are often unavailable. In this paper, we propose a new approach, LiveFuzz, based on directed greybox fuzzing (DGF) to detect the exploitability of library vulnerabilities from client programs without PoCs. LiveFuzz exploits a target tuple to extend existing DGF techniques to cross-program scenarios. Based on the target tuple, LiveFuzz introduces a novel Abstract Path Mapping mechanism to project execution paths, mitigating the preference for shorter paths. LiveFuzz also proposes a risk-based adaptive mutation to mitigate excessive mutation. To evaluate LiveFuzz, we construct a new dataset including 61 cases of library vulnerabilities exploited from client programs. Results show that LiveFuzz increases the number of target-reachable paths compared with all baselines and improves the average speed of vulnerability exposure. Three vulnerabilities are triggered exclusively by LiveFuzz.

Triggering and Detecting Exploitable Library Vulnerability from the Client by Directed Greybox Fuzzing

Abstract

Developers utilize third-party libraries to improve productivity, which also introduces potential security risks. Existing approaches generate tests for public functions to trigger library vulnerabilities from client programs, yet they depend on proof-of-concepts (PoCs), which are often unavailable. In this paper, we propose a new approach, LiveFuzz, based on directed greybox fuzzing (DGF) to detect the exploitability of library vulnerabilities from client programs without PoCs. LiveFuzz exploits a target tuple to extend existing DGF techniques to cross-program scenarios. Based on the target tuple, LiveFuzz introduces a novel Abstract Path Mapping mechanism to project execution paths, mitigating the preference for shorter paths. LiveFuzz also proposes a risk-based adaptive mutation to mitigate excessive mutation. To evaluate LiveFuzz, we construct a new dataset including 61 cases of library vulnerabilities exploited from client programs. Results show that LiveFuzz increases the number of target-reachable paths compared with all baselines and improves the average speed of vulnerability exposure. Three vulnerabilities are triggered exclusively by LiveFuzz.

Paper Structure

This paper contains 27 sections, 4 equations, 5 figures, 4 tables.

Table of Contents

  1. Introduction
  2. Background
  3. Vulnerability Management in TPLs
  4. Fuzzing
  5. Approach
  6. Target Tuple Construction
  7. Abstract Path Mapping.
  8. Function Calculation
  9. Basic Block Calculation
  10. Seed Risk Evaluation
  11. Risk-Based Adaptive Mutation
  12. Power Schedule
  13. Mutation Operator Schedule
  14. Evaluation
  15. Dataset Collection
  16. ...and 12 more sections

Figures (5)

  • Figure 1: Example is a library vulnerability that is exploitable with $type = 1$ and $num = 5$.
  • Figure 2: The Overall of LiveFuzz. Module A is Section \ref{['targetanalyzis']}, Module B is Section \ref{['distance']}, and Module C is Section \ref{['ams']}.
  • Figure 3: The Details of the Dataset.
  • Figure 4: The Static Analysis Time (s) for Different Cases.
  • Figure 5: Extracting information from the vulnerability description of CVE-2022-3341.