Combining BMC and Fuzzing Techniques for Finding Software Vulnerabilities in Concurrent Programs

Abstract

Finding software vulnerabilities in concurrent programs is a challenging task due to the size of the state-space exploration, as the number of interleavings grows exponentially with the number of program threads and statements. We propose and evaluate EBF (Ensembles of Bounded Model Checking with Fuzzing) -a technique that combines Bounded Model Checking (BMC) and Gray-Box Fuzzing (GBF) to find software vulnerabilities in concurrent programs. Since there are no publicly-available GBF tools for concurrent code, we first propose OpenGBF -a new open-source concurrency-aware gray-box fuzzer that explores different thread schedules by instrumenting the code under test with random delays. Then, we build an ensemble of a BMC tool and OpenGBF in the following way. On the one hand, when the BMC tool in the ensemble returns a counterexample, we use it as a seed for OpenGBF, thus increasing the likelihood of executing paths guarded by complex mathematical expressions. On the other hand, we aggregate the outcomes of the BMC and GBF tools in the ensemble using a decision matrix, thus improving the accuracy of EBF. We evaluate EBF against state-of-the-art pure BMC tools and show that it can generate up to 14.9% more correct verification witnesses than the corresponding BMC tools alone. Furthermore, we demonstrate the efficacy of OpenGBF, by showing that it can find 24.2% of the vulnerabilities in our evaluation suite, while non-concurrency-aware GBF tools can only find 0.55%. Finally, thanks to our concurrency-aware OpenGBF, EBF detects a data race in the open-source wolfMqtt library and reproduces known bugs in several other real-world programs, which demonstrates its effectiveness in finding vulnerabilities in realworld software.

LF-checker: Machine Learning Acceleration of Bounded Model Checking for Concurrency Verification (Competition Contribution)

“…However, when the software features concurrent execution, the main challenge becomes exploring the exponentially growing program state space. For this reason, there have been many efforts to improve BMC for concurrent software, including sequentialization [5], dedicated theories for multi-threaded programs [4] or combining BMC with fuzzing [1]. A state-of-the-art example of such efforts is ESBMC, an efficient SMT-based bounded model checker for C and C++ programs [3].…”

EBF 4.2: Black-Box Cooperative Verification for Concurrent Programs

“…In EBF [9], we are the first to implement a cooperative approach that combines Bounded Model Checking (BMC) and concurrency-aware Gray-Box Fuzzing (GBF) for finding vulnerabilities in concurrent C programs. In order to simplify the communication interface between the cooperating tools, we adopt a black-box design philosophy where verification artifacts are implicitly shared via appropriate transformation and instrumentation of the program under test (PUT).…”

“…During this stage, EBF checks whether the PUT contains any vulnerabilities by fuzzing its inputs and thread interleavings. Due to the current lack of open-source GBF tools for concurrent programs [9], EBF uses our own concurrencyaware gray-box fuzzer OpenGBF. Its implementation extends AFL++, a state-of-theart GBF for single-threaded programs, by introducing the following concurrency-aware lightweight instrumentation in the PUT.…”

The Cubicle Fuzzy Loop: A Fuzzing-Based Extension for the Cubicle Model Checker

“…For example in [2], BMC is used to generate paths that the fuzzer would not have found on its own. In [1], the authors combine BMC and Gray-Box Fuzzing to find vulnerabilities in concurrent programs. To our knowledge, no previous works combine fuzzing with parameterized model checking.…”