SAND: Decoupling Sanitization from Fuzzing for Low Overhead

2024-02-26

arXiv.org

AI Summary

To address the high runtime overhead imposed by instrumentation-based sanitizers in fuzzing, this paper proposes a lightweight, on-demand detection framework that decouples taint analysis from the fuzzing loop. Methodologically, it introduces (1) a novel execution-mode analysis to precisely identify inputs with potential vulnerability-triggering behavior; (2) dynamic deferred scheduling of sanitizer invocations—enabling sanitizer-augmented builds only for “interesting” inputs; and (3) a synergistic integration of lightweight execution trace capture, pattern matching, and conditional triggering, ensuring compatibility with multiple sanitizers including ASan and UBSan. Implemented atop AFL++, the framework demonstrates superior vulnerability discovery—outperforming all baseline fuzzers across 12 real-world programs within 24 hours—while achieving zero missed detections on known bugs. Crucially, it reduces average overhead by several orders of magnitude compared to conventional sanitizer-integrated fuzzing.

Technology Category

• Constraint Satisfaction and Optimization: Satisfiability Modulo Theories
• Search and Optimization: Sampling/Simulation-based Search
• Planning, Routing, and Scheduling: Model-Based Reasoning

Application Category

• Security and Privacy: Large-scale security measurements
• Systems and Infrastructure for Web, Mobile and WoT: Web performance, measurement, and characterization
• Responsible Web: Measurement, analysis, and circumvention of Web censorship

Abstract

Sanitizers provide robust test oracles for various software vulnerabilities. Fuzzing on sanitizer-enabled programs has been the best practice to find software bugs. Since sanitizers need to heavily instrument a target program to insert run-time checks, sanitizer-enabled programs have much higher overhead compared to normally built programs. In this paper, we present SAND, a new fuzzing framework that decouples sanitization from the fuzzing loop. SAND performs fuzzing on a normally built program and only invokes sanitizer-enabled programs when input is shown to be interesting. Since most of the generated inputs are not interesting, i.e., not bug-triggering, SAND allows most of the fuzzing time to be spent on the normally built program. To identify interesting inputs, we introduce execution pattern for a practical execution analysis on the normally built program. We realize SAND on top of AFL++ and evaluate it on 12 real-world programs. Our extensive evaluation highlights its effectiveness: in 24 hours, compared to all the baseline fuzzers, SAND significantly discovers more bugs while not missing any.

Problem

• Software Testing
• Disinfectant Usage
• Resource Consumption

Innovation

• Fuzz Testing
• Disinfectant Decoupling
• Efficiency Enhancement