[Paper Review] Static Exploration of Taint-Style Vulnerabilities Found by Fuzzing

Bhargava Shastry, Federico Maggi+3 more|arXiv (Cornell University)|Jun 1, 2017

Web Application Security Vulnerabilities12 references3 citations

TL;DR

This paper proposes a hybrid static analysis technique that uses fuzzer-discovered crashes to generate vulnerability templates, then applies static template matching to uncover recurring taint-style vulnerabilities across codebases. By ranking matches based on untested code coverage, the approach identifies previously unseen flaws—demonstrated by uncovering a new potential vulnerability in Open vSwitch with no existing test harness.

ABSTRACT

Taint-style vulnerabilities comprise a majority of fuzzer discovered program faults. These vulnerabilities usually manifest as memory access violations caused by tainted program input. Although fuzzers have helped uncover a majority of taint-style vulnerabilities in software to date, they are limited by (i) extent of test coverage; and (ii) the availability of fuzzable test cases. Therefore, fuzzing alone cannot provide a high assurance that all taint-style vulnerabilities have been uncovered. In this paper, we use static template matching to find recurrences of fuzzer-discovered vulnerabilities. To compensate for the inherent incompleteness of template matching, we implement a simple yet effective match-ranking algorithm that uses test coverage data to focus attention on those matches that comprise untested code. We prototype our approach using the Clang/LLVM compiler toolchain and use it in conjunction with afl-fuzz, a modern coverage-guided fuzzer. Using a case study carried out on the Open vSwitch codebase, we show that our prototype uncovers corner cases in modules that lack a fuzzable test harness. Our work demonstrates that static analysis can effectively complement fuzz testing, and is a useful addition to the security assessment tool-set. Furthermore, our techniques hold promise for increasing the effectiveness of program analysis and testing, and serve as a building block for a hybrid vulnerability discovery framework.

Motivation & Objective

• Address the limitations of fuzzing in achieving full test coverage and discovering vulnerabilities in code without test harnesses.
• Reduce manual effort in vulnerability auditing by automatically identifying recurring patterns of taint-style flaws.
• Improve the precision of static analysis by focusing on code regions with low or no fuzzer coverage, minimizing false positives.
• Enable early detection of vulnerabilities during development by reusing fuzzer-discovered crash patterns as templates for broader codebase analysis.

Proposed method

• Use a coverage-guided fuzzer (afl-fuzz) to discover initial program crashes in a testable code segment.
• Apply fault localization (via AddressSanitizer or execution slicing) to isolate the root cause of crashes and extract syntactic and semantic features of vulnerable code.
• Automatically generate vulnerability templates from localized faulty code, encoding both structural and semantic characteristics.
• Perform static template matching across the codebase to identify recurring instances of the same vulnerability pattern.
• Rank matching results based on fuzzer test coverage data, prioritizing matches that include untested code paths.
• Integrate the pipeline into the Clang/LLVM toolchain for static analysis and instrumentation, enabling scalable analysis of large C codebases.

Experimental results

Research questions

• RQ1 Can static analysis effectively uncover taint-style vulnerabilities that fuzzing misses due to limited test coverage?
• RQ2 Can fuzzer-discovered crashes be reliably transformed into reusable vulnerability templates for broader codebase scanning?
• RQ3 Does ranking template matches by untested code coverage improve the precision of vulnerability discovery compared to naive pattern matching?
• RQ4 Can this approach detect vulnerabilities in code modules lacking test harnesses, such as asynchronous or stateful APIs?
• RQ5 To what extent can this method detect recurring vulnerabilities across different versions of the same software?

Key findings

• The prototype successfully uncovered a previously unknown potential taint-style vulnerability in Open vSwitch in a module that lacked a test harness.
• The approach detected a recurring vulnerability in a later release of Open vSwitch by reusing a template derived from an older, known vulnerability.
• Template matching with coverage-based ranking significantly reduced noise by prioritizing matches in untested code regions.
• The method achieved high precision with minimal false positives, as the ranking mechanism focused attention on code paths not yet exercised by the fuzzer.
• The entire pipeline, including fault localization and template generation, ran efficiently with negligible runtime overhead.
• The open-sourced prototype enables independent evaluation and integration into existing software security assessment pipelines.