search

panda-re / lava

LAVA: Large-scale Automated Vulnerability Addition
Other
371 stars 60 forks source link

List of Supported Vulnerabilities #3

Closed dgrahn closed 5 years ago

dgrahn commented 6 years ago

All,

Is there a list of which vulnerabilities LAVA can add?

Thanks!

AndrewFasano commented 5 years ago

For now, all the bugs we add focus on corrupting pointers. We can corrupt them as they're dereferenced or when they're passed as arguments to a function. They're conditionally corrupted depending on a trigger or set of triggers matching some constraints.

All the code to do this is in tools/lavaTool/include.

For more information, check out our paper. We've made some improvements since then, but the classes of vulnerabilities we support hasn't changed much.