Uncontrolled memory consumption is a kind of critical software security weaknesses. It can also become a security-critical vulnerability when attackers can take control of the input to consume a large amount of memory and launch a Denial-of-Service attack. However, detecting such vulnerability is challenging, as the state-of-the-art fuzzing techniques focus on the code coverage but not memory consumption. To this end, we propose a memory usage guided fuzzing technique, named MemLock, to generate the excessive memory consumption inputs and trigger uncontrolled memory consumption bugs. The fuzzing process is guided with memory consumption information so that our approach is general and does not require any domain knowledge. We perform a thorough evaluation for MemLock on 14 widely-used real-world programs. Our experiment results show that MemLock substantially outperforms the state-of-the-art fuzzing techniques, including AFL, AFLfast, PerfFuzz, FairFuzz and QSYM, in discovering memory consumption bugs. During the experiments, we discovered many previously unknown memory consumption bugs and received 15 new CVEs.
Fri 10 JulDisplayed time zone: (UTC) Coordinated Universal Time change
08:05 - 09:05 | I22-TestingTechnical Papers / Demonstrations at Baekje Chair(s): Phil McMinn University of Sheffield | ||
08:05 3mTalk | FuRong: Fusing Report of Automated Android Testing on Multi-DevicesDemo Demonstrations Yuanhan Tian Nanjing University, Shengcheng Yu Nanjing University, China, Chunrong Fang Nanjing University, Peiyuan Li Nanjing University | ||
08:08 12mTalk | MemLock: Memory Usage Guided Fuzzing Technical Papers Cheng Wen Shenzhen University, Haijun Wang Ant Financial Services Group, China; CSSE, Shenzhen University, China, Yuekang Li Nanyang Technological University, Shengchao Qin University of Teesside, Yang Liu Nanyang Technological University, Singapore, Zhiwu Xu Shenzhen University, Hongxu Chen Research Associate, Xiaofei Xie Nanyang Technological University, Geguang Pu East China Normal University, Ting Liu Xi'an Jiaotong University DOI Pre-print Media Attached | ||
08:20 12mTalk | Symbolic Verification of Message Passing Interface Programs Technical Papers Hengbiao Yu National University of Defense Technology, Zhenbang Chen College of Computer, National University of Defense Technology, Changsha, PR China, Xianjin Fu National University of Defense Technology, Ji Wang School of Computer, National University of Defense Technology, China, Zhendong Su ETH Zurich, Switzerland, Jun Sun Singapore Management University, Chun Huang National University of Defense Technology, Wei Dong School of Computer, National University of Defense Technology, China Pre-print | ||
08:32 12mTalk | SAVER: Scalable, Precise, and Safe Memory-Error Repair Technical Papers Seongjoon Hong Korea University, Junhee Lee Korea University, South Korea, Jeongsoo Lee Korea University, Hakjoo Oh Korea University, South Korea | ||
08:44 12mTalk | A Large-Scale Empirical Study on Vulnerability Distribution within Projects and the Lessons LearnedTechnical Technical Papers Bingchang Liu Key Laboratory of Network Assessment Technology, Institute of Information Engineering, Chinese Academy of Sciences, China; School of CyberSpace Security at University of Chinese Academy of Sciences, China, Guozhu Meng Institute of Information Engineering, Chinese Academy of Sciences, Chao Zhang Institute for Network Sciences and Cyberspace of Tsinghua University, Feng Li Key Laboratory of Network Assessment Technology, Institute of Information Engineering, Chinese Academy of Sciences, China; School of CyberSpace Security at University of Chinese Academy of Sciences, China, Qi Gong Key Laboratory of Network Assessment Technology, Institute of Information Engineering, Chinese Academy of Sciences, China, Min Lin Institute for Network Sciences and Cyberspace of Tsinghua University, Dandan Sun Key Laboratory of Network Assessment Technology, Institute of Information Engineering, Chinese Academy of Sciences, China, Wei Huo Institute of Information Engineering, Chinese Academy of Sciences, Wei Zou Key Laboratory of Network Assessment Technology, Institute of Information Engineering, Chinese Academy of Sciences, China; School of CyberSpace Security at University of Chinese Academy of Sciences, China | ||
08:56 3mTalk | MPI-SV: A Symbolic Verifier for MPI ProgramsDemo Demonstrations Zhenbang Chen College of Computer, National University of Defense Technology, Changsha, PR China, Hengbiao Yu National University of Defense Technology, Xianjin Fu National University of Defense Technology, Ji Wang School of Computer, National University of Defense Technology, China Pre-print | ||