Smarter fuzzing using sound and precise static analyzers

Size: px

Start display at page:

Download "Smarter fuzzing using sound and precise static analyzers"

Philip Ray
5 years ago
Views:

1 Smarter fuzzing using sound and precise static analyzers Pascal Cuoq, Chief Scientist, TrustInSoft January 31, 2017 Pascal Cuoq, Chief Scientist, TrustInSoft smarter fuzzing January 31, / 8

2 Introduction Basis of this presentation: Result graphs for an abstract interpretation-based static analyzer JFLA 2017 Pascal Cuoq, Chief Scientist, TrustInSoft smarter fuzzing January 31, / 8

3 Fuzzing American Fuzzy Lop (a-fuzz) Work of Michal Zalewski (lcamtuf) Now a constellation of tools, some contributed by others Easy to use compile target with a-gcc (instrumenting compiler) let a-fuzz discover input les that explore program behaviors Pascal Cuoq, Chief Scientist, TrustInSoft smarter fuzzing January 31, / 8

4 Fuzzing American Fuzzy Lop (a-fuzz) Work of Michal Zalewski (lcamtuf) Now a constellation of tools, some contributed by others Easy to use compile target with a-gcc (instrumenting compiler) let a-fuzz discover input les that explore program behaviors Genetic: new inputs are generated by random mutations of existing inputs Pascal Cuoq, Chief Scientist, TrustInSoft smarter fuzzing January 31, / 8

5 Fuzzing Example 1: the ASN.1 parser libksba a-fuzz generates a 1KB le. Parsed as a X.509 certicate on a 128GiB workstation, parser allocates 60GiB several seconds to initialize this memory Denial of Service (details: ) Pascal Cuoq, Chief Scientist, TrustInSoft smarter fuzzing January 31, / 8

6 Fuzzing Example 2: mbedtls ASN.1 parser int main(int c, char*v[]) {... int ret = mbedtls_x509_crt_parse_file( &crt, v[1] ); if( ret!= 0 ) { printf( "failed\n" ); } else { printf( "success\n" ); uint32_t flags; ret = mbedtls_x509_crt_verify( &crt, &crt, NULL, NULL, &flags } Function crt_parse_file is very well-tested by AFL-generated inputs Pascal Cuoq, Chief Scientist, TrustInSoft smarter fuzzing January 31, / 8

7 Fuzzing Example 2: mbedtls ASN.1 parser int main(int c, char*v[]) {... int ret = mbedtls_x509_crt_parse_file( &crt, v[1] ); if( ret!= 0 ) { } else { } printf( "failed\n" ); printf( "success\n" ); uint32_t flags; ret = mbedtls_x509_crt_verify( &crt, &crt, NULL, NULL, &flags Function crt_parse_file is very well-tested by AFL-generated inputs Problem: only a few tests nd their way through to crt_verify Pascal Cuoq, Chief Scientist, TrustInSoft smarter fuzzing January 31, / 8

8 Improving fuzzing First example: dicult to reproduce: requires 60GiB or RAM Pascal Cuoq, Chief Scientist, TrustInSoft smarter fuzzing January 31, / 8

9 Improving fuzzing First example: dicult to reproduce: requires 60GiB or RAM Solution: whole-program dependency analysis Identies bytes in input le that are decoded into a size passed to calloc Pascal Cuoq, Chief Scientist, TrustInSoft smarter fuzzing January 31, / 8

10 Improving fuzzing First example: dicult to reproduce: requires 60GiB or RAM Solution: whole-program dependency analysis Identies bytes in input le that are decoded into a size passed to calloc Second example: adequate coverage requires too much patience Pascal Cuoq, Chief Scientist, TrustInSoft smarter fuzzing January 31, / 8

11 Improving fuzzing First example: dicult to reproduce: requires 60GiB or RAM Solution: whole-program dependency analysis Identies bytes in input le that are decoded into a size passed to calloc Second example: adequate coverage requires too much patience Solution: whole-program dependency analysis Identies input bytes that can be changed while still passing validation focus on exploring second phase of program, with each testcase Pascal Cuoq, Chief Scientist, TrustInSoft smarter fuzzing January 31, / 8

12 Whole-program dependency analysis Whole-program dependencies analysis data dependencies: y is computed from z path dependencies: y is computed dierently depending on c address dependencies: y is dierent depending where p points if (c) y = 0; else y = z + *p; int res = f(); if (res) error(); else g(y); Pascal Cuoq, Chief Scientist, TrustInSoft smarter fuzzing January 31, / 8

13 Conclusion ABS as a metaphor for sound static analysis The Anti-lock Breaking System initially was mostly reserved to aircrafts Concorde sported the rst fully electronic ABS system Pascal Cuoq, Chief Scientist, TrustInSoft smarter fuzzing January 31, / 8

14 Conclusion ABS as a metaphor for sound static analysis The Anti-lock Breaking System initially was mostly reserved to aircrafts Concorde sported the rst fully electronic ABS system Then race cars Pascal Cuoq, Chief Scientist, TrustInSoft smarter fuzzing January 31, / 8

15 Conclusion ABS as a metaphor for sound static analysis The Anti-lock Breaking System initially was mostly reserved to aircrafts Concorde sported the rst fully electronic ABS system Then race cars Then everybody's car Pascal Cuoq, Chief Scientist, TrustInSoft smarter fuzzing January 31, / 8

16 Conclusion ABS as a metaphor for sound static analysis The Anti-lock Breaking System initially was mostly reserved to aircrafts Concorde sported the rst fully electronic ABS system Then race cars Then everybody's car Fuzzing does not guarantee to nd all bugs Wouldn't do a precise, sound dependency analysis just to help with fuzzing But if you have such an analysis, it really helps Pascal Cuoq, Chief Scientist, TrustInSoft smarter fuzzing January 31, / 8

Fuzzing. compass-security.com 1

Fuzzing. compass-security.com 1 Fuzzing compass-security.com 1 Fuzzing Finding bugs by bombarding target with nonconform data Think: Flip a few bits in a PDF, then start Acrobat with that PDF Just more automated Steps: Create input corpus