[Paper Review] IvySyn: Automated Vulnerability Discovery in Deep Learning Frameworks

Neophytos Christou, Di Jin+3 more|arXiv (Cornell University)|Sep 29, 2022

Security and Verification in Computing4 citations

TL;DR

IvySyn is a fully automated framework that discovers memory safety vulnerabilities in deep learning frameworks by performing type-aware, mutation-based fuzzing on low-level C/C++ kernels and automatically generating high-level proof-of-vulnerability (PoV) code snippets in Python. It identified 61 previously unknown vulnerabilities in TensorFlow and PyTorch, resulting in 39 unique CVEs.

ABSTRACT

We present IvySyn, the first fully-automated framework for discovering memory error vulnerabilities in Deep Learning (DL) frameworks. IvySyn leverages the statically-typed nature of native APIs in order to automatically perform type-aware mutation-based fuzzing on low-level kernel code. Given a set of offending inputs that trigger memory safety (and runtime) errors in low-level, native DL (C/C++) code, IvySyn automatically synthesizes code snippets in high-level languages (e.g., in Python), which propagate error-triggering input via high(er)-level APIs. Such code snippets essentially act as "Proof of Vulnerability", as they demonstrate the existence of bugs in native code that an attacker can target through various high-level APIs. Our evaluation shows that IvySyn significantly outperforms past approaches, both in terms of efficiency and effectiveness, in finding vulnerabilities in popular DL frameworks. Specifically, we used IvySyn to test TensorFlow and PyTorch. Although still an early prototype, IvySyn has already helped the TensorFlow and PyTorch framework developers to identify and fix 61 previously-unknown security vulnerabilities, and assign 39 unique CVEs.

Motivation & Objective

• To address the challenge of detecting memory safety vulnerabilities in deep learning frameworks that propagate from high-level APIs to low-level, memory-unsafe kernel code.
• To overcome limitations of prior semi-automated or manual approaches that require expert annotations or custom driver code.
• To enable fully automated, actionable vulnerability disclosure by generating high-level code snippets that reproduce crashes in native kernel code.
• To improve the security posture of widely used DL frameworks like TensorFlow and PyTorch by enabling early detection of exploitable memory errors.

Proposed method

• IvySyn performs mutation-based fuzzing on low-level C/C++ kernel implementations using type-aware mutations derived from statically-typed native APIs.
• It identifies crashing inputs in native kernels by analyzing runtime and memory safety errors during fuzzing.
• Using the crash-inducing inputs and framework-specific API mappings, IvySyn automatically synthesizes high-level Python code snippets that propagate these inputs through high-level APIs.
• The synthesized code snippets serve as Proof of Vulnerability (PoV), demonstrating that attackers can trigger native kernel bugs via standard, user-facing APIs.
• The framework integrates directly with the framework's API stack, leveraging existing type information and binding structures to ensure semantic correctness of generated PoVs.
• It operates without requiring manual annotations, driver code, or domain expert input, enabling full automation of the vulnerability discovery pipeline.

Experimental results

Research questions

• RQ1 Can we automatically discover memory safety vulnerabilities in deep learning frameworks without requiring manual annotations or developer-provided drivers?
• RQ2 How can we effectively map crashing inputs from low-level kernel code back to high-level APIs to generate actionable Proof of Vulnerability (PoV) code?
• RQ3 To what extent can type-aware, mutation-based fuzzing on native kernels outperform existing high-level API fuzzing techniques in vulnerability detection?
• RQ4 Can a fully automated, bottom-up approach detect previously unknown, exploitable memory errors in production-grade DL frameworks like TensorFlow and PyTorch?

Key findings

• IvySyn discovered 61 previously unknown security vulnerabilities in TensorFlow and PyTorch, all of which were confirmed and patched by framework developers.
• The framework resulted in 39 unique CVE assignments, demonstrating its effectiveness in identifying exploitable memory safety issues.
• IvySyn outperformed prior approaches in both efficiency and effectiveness, uncovering more crashing inputs than low-level fuzzers and more actionable PoVs than high-level API fuzzers.
• The framework successfully generated semantically correct, executable Python code snippets that reproduce crashes in native kernel code, serving as valid Proof of Vulnerability.
• The approach required no manual annotations or custom driver code, making it fully automated and scalable to complex, multi-layered DL frameworks.
• IvySyn’s prototype implementation, available on GitLab, has already improved the security of widely deployed DL frameworks used by millions of users globally.