Search: onr:"swepub:oai:DiVA.org:umu-198707" >
Confuzzion :
Confuzzion : a Java Virtual Machine Fuzzer for Type Confusion Vulnerabilities
-
- Bonnaventure, William (author)
- SnT, University of Luxembourg, Luxembourg, Luxembourg
-
- Khanfir, Ahmed (author)
- SnT, University of Luxembourg, Luxembourg, Luxembourg
-
- Bartel, Alexandre (author)
- Umeå universitet,Institutionen för datavetenskap
-
show more...
-
- Papadakis, Mike (author)
- SnT, University of Luxembourg, Luxembourg, Luxembourg
-
- Traon, Yves Le (author)
- SnT, University of Luxembourg, Luxembourg, Luxembourg
-
show less...
-
(creator_code:org_t)
- IEEE, 2021
- 2021
- English.
-
In: 2021 IEEE 21st International Conference on Software Quality, Reliability and Security (QRS). - : IEEE. - 9781665458139 - 9781665458146 ; , s. 586-597
- Related links:
-
https://urn.kb.se/re...
-
show more...
-
https://doi.org/10.1...
-
show less...
Abstract
Subject headings
Close
- Current Java Virtual Machine (JVM) fuzzersaim at generating syntactically valid Java programs, without targeting any particular use of the standard Java library. While effective, such fuzzers fail to discover specific kinds of bugs or vulnerabilities, such as type confusion, that are related to the standard API usage. To deal with this issue, we introduce amutation-based feedback-guided black-box JVM fuzzer, called CONFUZZION. CONFUZZION, as the name suggests, targets security-relevant object-oriented flaws with a particular focus on type confusion vulnerabilities. We show that in less than 4 hours, on commodity hardware and without any predefined initialization seed, CONFUZZION automatically generates Java programs that reveal JVM vulnerabilities, i.e., the Common Vulnerabilities and Exposures CVE-2017-3272. We also show that state-of-the-art fuzzers or even traditional automatic testing techniques are not capable of detecting such faults, even after 48 hours of execution in the same environment. To the best of our knowledge, CONFUZZION is the first fuzzer able to detect JVM type confusion vulnerabilities.
Subject headings
- NATURVETENSKAP -- Data- och informationsvetenskap -- Datavetenskap (hsv//swe)
- NATURAL SCIENCES -- Computer and Information Sciences -- Computer Sciences (hsv//eng)
- NATURVETENSKAP -- Data- och informationsvetenskap -- Programvaruteknik (hsv//swe)
- NATURAL SCIENCES -- Computer and Information Sciences -- Software Engineering (hsv//eng)
Keyword
- Fuzzing
- vulnerability
- Java Virtual Machine
Publication and Content Type
- ref (subject category)
- kon (subject category)
Find in a library
To the university's database