Sökning: onr:"swepub:oai:DiVA.org:umu-198707" >
Confuzzion :
Confuzzion : a Java Virtual Machine Fuzzer for Type Confusion Vulnerabilities
-
- Bonnaventure, William (författare)
- SnT, University of Luxembourg, Luxembourg, Luxembourg
-
- Khanfir, Ahmed (författare)
- SnT, University of Luxembourg, Luxembourg, Luxembourg
-
- Bartel, Alexandre (författare)
- Umeå universitet,Institutionen för datavetenskap
-
visa fler...
-
- Papadakis, Mike (författare)
- SnT, University of Luxembourg, Luxembourg, Luxembourg
-
- Traon, Yves Le (författare)
- SnT, University of Luxembourg, Luxembourg, Luxembourg
-
visa färre...
-
(creator_code:org_t)
- IEEE, 2021
- 2021
- Engelska.
-
Ingår i: 2021 IEEE 21st International Conference on Software Quality, Reliability and Security (QRS). - : IEEE. - 9781665458139 - 9781665458146 ; , s. 586-597
- Relaterad länk:
-
https://urn.kb.se/re...
-
visa fler...
-
https://doi.org/10.1...
-
visa färre...
Abstract
Ämnesord
Stäng
- Current Java Virtual Machine (JVM) fuzzersaim at generating syntactically valid Java programs, without targeting any particular use of the standard Java library. While effective, such fuzzers fail to discover specific kinds of bugs or vulnerabilities, such as type confusion, that are related to the standard API usage. To deal with this issue, we introduce amutation-based feedback-guided black-box JVM fuzzer, called CONFUZZION. CONFUZZION, as the name suggests, targets security-relevant object-oriented flaws with a particular focus on type confusion vulnerabilities. We show that in less than 4 hours, on commodity hardware and without any predefined initialization seed, CONFUZZION automatically generates Java programs that reveal JVM vulnerabilities, i.e., the Common Vulnerabilities and Exposures CVE-2017-3272. We also show that state-of-the-art fuzzers or even traditional automatic testing techniques are not capable of detecting such faults, even after 48 hours of execution in the same environment. To the best of our knowledge, CONFUZZION is the first fuzzer able to detect JVM type confusion vulnerabilities.
Ämnesord
- NATURVETENSKAP -- Data- och informationsvetenskap -- Datavetenskap (hsv//swe)
- NATURAL SCIENCES -- Computer and Information Sciences -- Computer Sciences (hsv//eng)
- NATURVETENSKAP -- Data- och informationsvetenskap -- Programvaruteknik (hsv//swe)
- NATURAL SCIENCES -- Computer and Information Sciences -- Software Engineering (hsv//eng)
Nyckelord
- Fuzzing
- vulnerability
- Java Virtual Machine
Publikations- och innehållstyp
- ref (ämneskategori)
- kon (ämneskategori)
Hitta via bibliotek
Till lärosätets databas