Coverage-guided fuzzers like AFL and libFuzzer have led to a "fuzzing renaissance". This is because they made it possible for security researchers to write effective fuzzers for formats without knowing about the format's structure. However, structure-aware (aka structured) fuzzing is far from dead. In fact, the combination of structured and coverage-guided (aka coverage) fuzzing has quietly become the state of the art in automated vulnerability discovery.This talk will:
Explain the problems in coverage fuzzing that structured fuzzing solves and how it solves them, including:
How to ensure fuzzing reaches specific code to find vulnerabilities.
Highlight some of the places where structured coverage fuzzing has shined.
Including Chrome's AppCache where it found a vulnerability used in a full-chain exploit and SQLite+Skia where it found bugs that other kinds of fuzzing did not.
The talk will ultimately benefit anyone who is interested in fuzzing. In particular, it will benefit security researchers trying to go beyond coverage fuzzing to find vulnerabilities in real code.
Jonathan Metzman works on the Chrome security team where he writes fuzzers and infrastructure for running fuzzers (ClusterFuzz and OSS-Fuzz).