Multi-level Directed Fuzzing for Detecting Use-after-Free Vulnerabilities
Yuntao Zhang, Zhongru Wang, Weiqiang Yu, Binxing Fang · 2021 IEEE 20th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · 2021
Greybox fuzzing has been widely used in vulnerabilities detection. Most greybox fuzzing tools are coverage-based, which usually use basic block transition to gain code coverage and focus on improving it to trigger more bugs. However, only increasing code coverage is insufficient to find some heap-based vulnerabilities such as use-after-free (UAF) and double-free (DF). This is because, to trigger these vulnerabilities, one needs not only to cover more code, but also to execute special heap operations to satisfy a particular temporal constraint (i.e., allocating heap memory, free memory, and accessing the heap memory). In this paper, we propose an approach, namely MDFuzz, to detect heap-based vulnerabilities adopting multi-level directed greybox fuzzing. The key idea is identifying different targets to guide the fuzzing process to cover specific heap operations without wasting resources exploring unrelated program components. We first perform a static analysis to automatically recognize three critical targets related to heap operations and then calculate each basic block's distance to the targets. Moreover, we propose a probability-based multi-level seed queue and a novel seed selection strategy to augment the guidance of directed fuzzing. To evaluate MDFuzz, we have performed an evaluation on 7 real-world applications. The experimental results demonstrate that MDFuzz significantly outperforms the state-of-the-art fuzzers, including AFL, AFLFast and VUzzer, in terms of the time consumed to discover heap-based vulnerabilities. Moreover, MD-Fuzz found 4 previously unknown vulnerabilities in real-world programs.