Efficient Greybox Fuzzing to Detect Memory Errors

TL;DR

This paper introduces ReZZan, a lightweight memory error sanitizer optimized for fork-mode greybox fuzzing, significantly reducing performance overhead and improving bug detection efficiency.

Contribution

The paper presents a novel sanitizer design that uses randomized tokens for object boundaries, minimizing overhead in fork-mode fuzzing compared to traditional sanitizers.

Findings

ReZZan reduces fuzzing overhead to 1.14-1.27X from 2.36X with ASAN.

The new sanitizer effectively detects memory errors during fuzzing.

ReZZan enhances fuzzing performance without sacrificing bug detection capabilities.

Abstract

Greybox fuzzing is a proven and effective testing method for the detection of security vulnerabilities and other bugs in modern software systems. Greybox fuzzing can also be used in combination with a sanitizer, such as AddressSanitizer (ASAN), to further enhance the detection of certain classes of bugs such as buffer overflow and use-after-free errors. However, sanitizers also introduce additional performance overheads, and this can degrade the performance of greybox mode fuzzing -- measured in the order of 2.36X for fuzzing with ASAN -- partially negating the benefit of using a sanitizer in the first place. Recent research attributes the extra overhead to program startup/teardown costs that can dominate fork-mode fuzzing. In this paper, we present a new memory error sanitizer design that is specifically optimized for fork-mode fuzzing. The basic idea is to mark object boundaries using randomized tokens rather than disjoint metadata (as used by traditional sanitizer designs). All read/write operations are then instrumented to check for the token, and if present, a memory error will be detected. Since our design does not use a disjoint metadata, it is also very lightweight, meaning that program startup and teardown costs are minimized for the benefit of fork-mode fuzzing. We implement our design in the form of the ReZZan tool, and show an improved fuzzing performance overhead of 1.14-1.27X, depending on the configuration.