{"id":4316,"date":"2020-10-23T13:17:54","date_gmt":"2020-10-23T04:32:54","guid":{"rendered":"https:\/\/www.inforsec.org\/wp\/?p=4316"},"modified":"2020-10-23T13:17:54","modified_gmt":"2020-10-23T04:32:54","slug":"%e3%80%90usenix-security2020%e8%ae%ba%e6%96%87%e5%88%86%e4%ba%ab%e3%80%91%e7%99%be%e5%ba%a6%e7%a0%94%e7%a9%b6%e9%99%a2%e9%ab%98%e7%ba%a7%e5%ae%89%e5%85%a8%e7%a0%94%e7%a9%b6%e5%91%98%e9%83%ad%e7%94%9f","status":"publish","type":"post","link":"http:\/\/202.112.238.40\/wp\/?p=4316","title":{"rendered":"\u3010USENIX Security2020\u8bba\u6587\u5206\u4eab\u3011\u767e\u5ea6\u7814\u7a76\u9662\u9ad8\u7ea7\u5b89\u5168\u7814\u7a76\u5458\u90ed\u751f\u5065\u2014\u2014MUZZ\uff1aThread-aware Grey-box Fuzzing for Effective Bug Hunting in Multithreaded Programs"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">8\u670813\u65e5\uff0c\u6765\u81ea\u767e\u5ea6\u7814\u7a76\u9662\u7684\u9ad8\u7ea7\u5b89\u5168\u7814\u7a76\u5458\u90ed\u751f\u5065\u5206\u4eab\u4e86\u4ed6\u4eec\u53d1\u8868\u5728USENIX Security2020\u7684 \u300aMUZZ: Thread-aware Grey-box Fuzzing for Effective Bug Hunting in Multithreaded Programs\u300b\uff0c\u5728\u8fd9\u7bc7\u8bba\u6587\u4e2d\uff0c\u4f5c\u8005\u63d0\u51fa\u4e86\u4e00\u4e2a\u4e13\u7528\u7684\u7070\u76d2\u6a21\u7cca\u6d4b\u8bd5\u6846\u67b6Muzz\uff0c\u5176\u901a\u8fc7\u63a2\u7d22\u7a0b\u5e8f\u8f93\u5165\u4e0e\u7ebf\u7a0b\u4ea4\u9519\u76f8\u5173\u7684\u591a\u7ebf\u7a0b\u7a0b\u5e8f\u6267\u884c\u72b6\u6001\u6765\u68c0\u6d4b\u5e76\u53d1\u9519\u8bef\u6587\u4e2d\u5c06\u591a\u7ebf\u7a0b\u76f8\u5173\u7684\u76ee\u6807\u5e76\u53d1\u9519\u8bef\u5206\u4e3a\uff1a1.\u5e76\u53d1\u6f0f\u6d1e\uff1b2.\u5e76\u53d1\u9519\u8bef\uff0cMuzz\u901a\u8fc7\u91cd\u653e\u751f\u6210\u7684\u6a21\u7cca\u6d4b\u8bd5\u79cd\u5b50\u5e76\u4f7f\u7528\u4f8b\u5982TSan\u7684\u5e76\u53d1\u9519\u8bef\u68c0\u6d4b\u5de5\u5177\u6765\u68c0\u6d4b\u8fd9\u4e9b\u9519\u8bef\u3002 <\/p>\n\n\n\n<iframe id=\"video\" src=\"\/\/player.bilibili.com\/player.html?aid=457572259&#038;bvid=BV1u5411L7pF&#038;cid=247608312&#038;page=1\" style=\"width:96%\" height=498 width=510 frameborder=\"0\" allowfullscreen=\"allowfullscreen\"><\/iframe>\n<script>\nvd = document.getElementById(\"shipin\");\nif (vd != null) {\n    vd.style.height = vd.scrollWidth*0.8+\"px\";\n}\n<\/script>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u6f14\u8bb2\u4e3b\u9898\uff1aMUZZ: Thread-aware Grey-box Fuzzing for Effective Bug Hunting in Multithreaded Programs<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Grey-box fuzz testing has revealed thousands of vulnerabilities in real-world software owing to its lightweight instrumentation, fast coverage feedback, and dynamic adjusting strategies. However, directly applying grey-box fuzzing to input-dependent multithreaded programs can be extremely inefficient. In practice, multithreading-relevant bugs are usually buried in the sophisticated program flows. Meanwhile, existing grey-box fuzzing techniques do not stress thread-interleavings that affect execution states in multithreaded programs. Therefore, mainstream grey-box fuzzers cannot adequately test problematic segments in multithreaded software, although they might obtain high code coverage statistics.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">To this end, we propose Muzz, a new grey-box fuzzing technique that hunts for bugs in multithreaded programs. Muzz owns three novel thread-aware instrumentations, namely coverage-oriented instrumentation, thread-context instrumentation, and schedule-intervention instrumentation. During fuzzing, these instrumentations engender runtime feedback to accentuate execution states caused by thread interleavings. By leveraging such feedback in the dynamic seed selection and execution strategies, Muzz preserves more valuable seeds that expose bugs under a multithreading context.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">We evaluate Muzz on twelve real-world multithreaded programs. Experiments show that Muzz outperforms AFL in both multithreading-relevant seed generation and concurrency-vulnerability detection. Further, by replaying the target programs against the generated seeds, Muzz also reveals more concurrency-bugs (e.g., data-races, thread-leaks) than AFL. In total, Muzz detected eight new concurrency-vulnerabilities and nineteen new concurrency-bugs. At the time of writing, four reported issues have received CVE IDs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u90ed\u751f\u5065 &nbsp;\u767e\u5ea6\u7814\u7a76\u9662\uff08\u7f8e\u56fd\u7845\u8c37\uff09\u5b89\u5168\u7ec4<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image is-resized\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2020\/08\/10.jpg\" alt=\"\" class=\"wp-image-4138\" width=\"103\" height=\"142\" srcset=\"http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2020\/08\/10.jpg 412w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2020\/08\/10-218x300.jpg 218w, http:\/\/202.112.238.40\/wp\/wp-content\/uploads\/2020\/08\/10-109x150.jpg 109w\" sizes=\"auto, (max-width: 103px) 100vw, 103px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u90ed\u751f\u5065\u535a\u58eb\u7cfb\u767e\u5ea6\u7814\u7a76\u9662\uff08\u7f8e\u56fd\u7845\u8c37\uff09\u5b89\u5168\u7ec4\u9ad8\u7ea7\u5b89\u5168\u7814\u7a76\u5458\uff0c\u5176\u4e3b\u8981\u7814\u7a76\u65b9\u5411\u4e3a\u529f\u80fd\u7279\u6027\u9a71\u52a8\u7684\u591a\u7ebf\u7a0b\/\u591a\u4efb\u52a1\u8f6f\u4ef6\u7684\u72b6\u6001\u7a7a\u95f4\u89c4\u7ea6\u53ca\u526a\u679d\uff0c\u9762\u5411\u5de5\u4e1a\u7ea7\u65e0\u4eba\u9a7e\u9a76\u8f6f\u4ef6\u7cfb\u7edf\u7684\u5b89\u5168\u5206\u6790\uff0c\u57fa\u4e8e\u7b26\u53f7\u6267\u884c\u7684CPU\u7f13\u5b58\u4fa7\u4fe1\u9053\u6cc4\u9732\u7684\u5206\u6790\u548c\u68c0\u6d4b\uff0c\u4ee5\u53ca\u57fa\u4e8eFuzzing\u7684\u6df7\u5408\u6d4b\u8bd5\u53ca\u6f0f\u6d1e\u68c0\u6d4b\u3002\u90ed\u535a\u58eb\u8fd1\u5e74\u6765\u5728\u8f6f\u4ef6\u5de5\u7a0b\u4ee5\u53ca\u5b89\u5168\u9886\u57dfA\u7c7b\u4f1a\u8bae\u53d1\u8868\u7814\u7a76\u957f\u6587\u5341\u4f59\u7bc7\uff0c\u662f\u8f6f\u5de5\u9876\u4f1aFSE 2018\u7684 Distinguished Paper Award\u4ee5\u53ca\u767e\u5ea62019\u5e74\u5ea6TPG TC\u6280\u672f\u521b\u65b0\u5956\u83b7\u5f97\u8005\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"<p>8\u670813\u65e5\uff0c\u6765\u81ea\u767e\u5ea6\u7814\u7a76\u9662\u7684\u9ad8\u7ea7\u5b89\u5168\u7814\u7a76\u5458\u90ed\u751f\u5065\u5206\u4eab\u4e86\u4ed6\u4eec\u53d1\u8868\u5728USENIX Security202&#8230; <a class=\"continue-reading-link\" href=\"http:\/\/202.112.238.40\/wp\/?p=4316\"> Continue reading <span class=\"meta-nav\">&rarr; <\/span><\/a><\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-4316","post","type-post","status-publish","format-standard","hentry","category-9"],"_links":{"self":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/4316","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4316"}],"version-history":[{"count":1,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/4316\/revisions"}],"predecessor-version":[{"id":4317,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/4316\/revisions\/4317"}],"wp:attachment":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4316"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4316"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4316"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}