USENIX Security '24 - OptFuzz: Optimization Path Guided Fuzzing for JavaScript JIT Compilers
OptFuzz: Optimization Path Guided Fuzzing for JavaScript JIT Compilers
Jiming Wang and Yan Kang, SKLP, Institute of Computing Technology, CAS & University of Chinese Academy of Sciences; Chenggang Wu, SKLP, Institute of Computing Technology, CAS & University of Chinese Academy of Sciences & Zhongguancun Laboratory; Yuhao Hu, Yue Sun, and Jikai Ren, SKLP, Institute of Computing Technology, CAS & University of Chinese Academy of Sciences; Yuanming Lai and Mengyao Xie, SKLP, Institute of Computing Technology, CAS; Charles Zhang, Tsinghua University; Tao Li, Nankai University; Zhe Wang, SKLP, Institute of Computing Technology, CAS & University of Chinese Academy of Sciences & Zhongguancun Laboratory
Just-In-Time (JIT) compiler is a core component of JavaScript engines, which takes a snippet of JavaScript code as input and applies a series of optimization passes on it and then transforms it to machine code. The optimization passes often have some assumptions (e.g., variable types) on the target JavaScript code, and therefore will yield vulnerabilities if the assumptions do not hold. To discover such bugs, it is essential to thoroughly test different optimization passes, but previous work fails to do so and mainly focused on exploring code coverage. In this paper, we present the first optimization path guided fuzzing solution for JavaScript JIT compilers, namely OptFuzz, which focuses on exploring optimization path coverage. Specifically, we utilize an optimization trunk path metric to approximate the optimization path coverage, and use it as a feedback to guide seed preservation and seed scheduling of the fuzzing process. We have implemented a prototype of OptFuzz and evaluated it on 4 mainstream JavaScript engines. On earlier versions of JavaScript engines, OptFuzz found several times more bugs than baseline solutions. On the latest JavaScript engines, OptFuzz discovered 36 unknown bugs, while baseline solutions found none.
View the full USENIX Security '24 program at https://www.usenix.org/conference/use...
Auf dieser Seite können Sie das Online-Video USENIX Security '24 - OptFuzz: Optimization Path Guided Fuzzing for JavaScript JIT Compilers mit der Dauer stunde minuten sekunde in guter Qualität ansehen, das der Benutzer USENIX 12 November 2024 hochgeladen hat, den Link mit Freunden und Bekannten teilen, dieses Video wurde auf Youtube bereits 145 Mal angesehen und es wurde von 2 den Zuschauern gefallen. Viel Spaß beim Betrachtenden Zuschauern gefallen!
