SlowFuzz: Automated Domain-Independent Detection of Algorithmic Complexity Vulnerabilities

Abstract

Algorithmic complexity vulnerabilities occur when the worst-case time/space complexity of an application is significantly higher than the respective average case for particular user-controlled inputs. When such conditions are met, an attacker can launch Denial-of-Service attacks against a vulnerable application by providing inputs that trigger the worst-case behavior. Such attacks have been known to have serious effects on production systems, take down entire websites, or lead to bypasses of Web Application Firewalls. Unfortunately, existing detection mechanisms for algorithmic complexity vulnerabilities are domain-specific and often require significant manual effort. In this paper, we design, implement, and evaluate SlowFuzz, a domain-independent framework for automatically finding algorithmic complexity vulnerabilities. SlowFuzz automatically finds inputs that trigger worst-case algorithmic behavior in the tested binary. SlowFuzz uses resource-usage-guided evolutionary search techniques to automatically find inputs that maximize computational resource utilization for a given application.

arXiv commentACM CCS '17, October 30-November 3, 2017, Dallas, TX, USA

Cited by in corpus (18)

• Magma: A Ground-Truth Fuzzing Benchmark
• Badger: Complexity Analysis with Fuzzing and Symbolic Execution
• V-Fuzz: Vulnerability-Oriented Evolutionary Fuzzing
• Understanding Performance Problems in Deep Learning Systems
• UNIFUZZ: A Holistic and Pragmatic Metrics-Driven Platform for Evaluating Fuzzers
• EnFuzz: Ensemble Fuzzing with Seed Synchronization among Diverse Fuzzers
• The Progress, Challenges, and Perspectives of Directed Greybox Fuzzing
• Evolutionary Fuzzing of Android OS Vendor System Services
• Automatic Techniques to Systematically Discover New Heap Exploitation Primitives
• Superion: Grammar-Aware Greybox Fuzzing
• Evaluating Susceptibility of VPN Implementations to DoS Attacks Using Adversarial Testing
• NEUZZ: Efficient Fuzzing with Neural Program Smoothing
• SoK: A Literature and Engineering Review of Regular Expression Denial of Service (ReDoS)
• SynFuzz: Efficient Concolic Execution via Branch Condition Synthesis
• Adversarial Attacks on Optimization based Planners
• A Generative Neural Network Framework for Automated Software Testing
• Fuzzing Based on Function Importance by Interprocedural Control Flow Graph
• Worst-Case Input Generation for Concurrent Programs under Non-Monotone Resource Metrics