search

nus-apr / CrashRepair

Security Vulnerability Repair via Concolic Execution and Code Mutations
16 stars 1 forks source link

Incorrect build configurations lead to fuzzer failures during tracing #159

Closed ChrisTimperley closed 1 year ago

ChrisTimperley commented 1 year ago

I had a closer look into what's going on in cases where we see the following behavior (with no timeouts):

[15-Apr-23 00:00:26-init_log-INFO]: Output Folder: /data/vulnloc/jasper/CVE-2016-8691/fuzzer
[15-Apr-23 00:00:26-concentrate_fuzz-INFO]: Input format: bfile
[15-Apr-23 00:00:26-concentrate_fuzz-INFO]: Store all input files: False
[15-Apr-23 00:00:26-concentrate_fuzz-INFO]: Initialized the random seed -> 3
[15-Apr-23 00:00:26-ifTracer-INFO]: Executing: /opt/fuzzer/deps/dynamorio/build/bin64/drrun -c /opt/fuzzer/deps/iftracer/iftracer/libiftracer.so -- /data/vulnloc/jasper/CVE-2016-8691/src/src/appl/imginfo -f /data/vulnloc/jasper/CVE-2016-8691/fuzzer/tmp/tmp_0
[15-Apr-23 00:00:27-concentrate_fuzz-INFO]: Finish processing the poc!
[15-Apr-23 00:00:27-concentrate_fuzz-INFO]: len(Seed Trace): 0

It turns out that the trace command is failing entirely (the failure isn't recognized by the fuzzer script):

root@b8992326a9ea:/data/vulnloc/jasper/CVE-2016-8691# /opt/fuzzer/deps/dynamorio/build/bin64/drrun -c /opt/fuzzer/deps/iftracer/iftracer/libiftracer.so -- /data/vulnloc/jasper/CVE-2016-8691/src/src/appl/imginfo -f /data/vulnloc/jasper/CVE-2016-8691/fuzzer/tmp/tmp_0
ERROR: Failed to create process for "/data/vulnloc/jasper/CVE-2016-8691/src/src/appl/imginfo":

I'm not sure why this is happening. @yannicnoller mentioned something about build options, so I'll play around with those next week (e.g., double checking that we compile a static binary).

Update: If I rebuild the above example from scratch, I can get it to work (good news!). Notably, I added --enable-static and --disable-shared to the ./configure command; I also DID NOT use any sanitizers. I'll try again with a sanitizer enabled to see if I see bad behaviors.

image
ChrisTimperley commented 1 year ago

I believe that this issue is pretty much wrapped up at this point. Scenarios either run as expected and produce an output or else they run out of memory. In either case, this particular failure mode no longer occurs.