Umeå University's logo

umu.sePublikasjoner
Endre søk
RefereraExporteraLink to record
Permanent link

Direct link
Referera
Referensformat
  • apa
  • ieee
  • vancouver
  • Annet format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annet språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf
Evaluating the maintainability of forward-porting vulnerabilities in fuzzer benchmarks
Umeå universitet, Teknisk-naturvetenskapliga fakulteten, Institutionen för datavetenskap.ORCID-id: 0000-0001-7486-0538
Umeå universitet, Teknisk-naturvetenskapliga fakulteten, Institutionen för datavetenskap.
Umeå universitet, Teknisk-naturvetenskapliga fakulteten, Institutionen för datavetenskap.
Umeå universitet, Teknisk-naturvetenskapliga fakulteten, Institutionen för datavetenskap.ORCID-id: 0000-0003-1383-0372
2025 (engelsk)Inngår i: Proceedings. 2025 IEEE International Conference on Software Maintenance and Evolution,: ICSME 2025, IEEE, 2025, s. 1-12, artikkel-id 11185945Konferansepaper, Publicerat paper (Fagfellevurdert)
Abstract [en]

Fuzzing is a well-established technique for detecting bugs and vulnerabilities. With the surge of fuzzers and fuzzer platforms being developed such as AFL and OSSFuzz rises the necessity to benchmark these tools' performance. A common problem is that vulnerability benchmarks are based on bugs in old software releases. For this very reason, Magma introduced the notion of forward-porting to reintroduce vulnerable code in current software releases. While their results are promising, the state-of-the-art lacks an update on the maintainability of this approach over time. Indeed, adding the vulnerable code to a recent software version might either break its functionality or make the vulnerable code no longer reachable. We characterise the challenges with forward-porting by reassessing the portability of Magma's CVEs four years after its release and manually reintroducing the vulnerabilities in the current software versions. We find the straightforward process efficient for 17 of the 32 CVEs in our study. We further investigate why a trivial forward-porting process fails in the 15 other CVEs. This involves identifying the commits breaking the forward-porting process and reverting them in addition to the bug fix. While we manage to complete the process for nine of these CVEs, we provide an update on all 15 and explain the challenges we have been confronted with in this process. Thereby, we give the basis for future work towards a sustainable forward-ported fuzzing benchmark.

sted, utgiver, år, opplag, sider
IEEE, 2025. s. 1-12, artikkel-id 11185945
Serie
Proceedings - Conference on Software Maintenance, ISSN 1063-6773, E-ISSN 2576-3148
HSV kategori
Identifikatorer
URN: urn:nbn:se:umu:diva-246995DOI: 10.1109/ICSME64153.2025.00011Scopus ID: 2-s2.0-105022458364ISBN: 979-8-3315-9587-6 (digital)ISBN: 979-8-3315-9588-3 (tryckt)OAI: oai:DiVA.org:umu-246995DiVA, id: diva2:2018698
Konferanse
41st IEEE International Conference on Software Maintenance and Evolution, ICSME 2025, Auckland, New Zealand, September 7-12, 2025
Forskningsfinansiär
The Kempe FoundationsWallenberg AI, Autonomous Systems and Software Program (WASP)Tilgjengelig fra: 2025-12-03 Laget: 2025-12-03 Sist oppdatert: 2025-12-03bibliografisk kontrollert

Open Access i DiVA

Fulltekst mangler i DiVA

Andre lenker

Forlagets fulltekstScopus

Person

Riom, TimothéeHouy, SabineKreyssig, BrunoBartel, Alexandre

Søk i DiVA

Av forfatter/redaktør
Riom, TimothéeHouy, SabineKreyssig, BrunoBartel, Alexandre
Av organisasjonen

Søk utenfor DiVA

GoogleGoogle Scholar

doi
isbn
urn-nbn

Altmetric

doi
isbn
urn-nbn
Totalt: 36 treff
RefereraExporteraLink to record
Permanent link

Direct link
Referera
Referensformat
  • apa
  • ieee
  • vancouver
  • Annet format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annet språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf