Umeå University's logo

umu.sePublications
Change search
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf
Evaluating the maintainability of forward-porting vulnerabilities in fuzzer benchmarks
Umeå University, Faculty of Science and Technology, Department of Computing Science.ORCID iD: 0000-0001-7486-0538
Umeå University, Faculty of Science and Technology, Department of Computing Science.
Umeå University, Faculty of Science and Technology, Department of Computing Science.
Umeå University, Faculty of Science and Technology, Department of Computing Science.ORCID iD: 0000-0003-1383-0372
2025 (English)In: Proceedings. 2025 IEEE International Conference on Software Maintenance and Evolution,: ICSME 2025, IEEE, 2025, p. 1-12, article id 11185945Conference paper, Published paper (Refereed)
Abstract [en]

Fuzzing is a well-established technique for detecting bugs and vulnerabilities. With the surge of fuzzers and fuzzer platforms being developed such as AFL and OSSFuzz rises the necessity to benchmark these tools' performance. A common problem is that vulnerability benchmarks are based on bugs in old software releases. For this very reason, Magma introduced the notion of forward-porting to reintroduce vulnerable code in current software releases. While their results are promising, the state-of-the-art lacks an update on the maintainability of this approach over time. Indeed, adding the vulnerable code to a recent software version might either break its functionality or make the vulnerable code no longer reachable. We characterise the challenges with forward-porting by reassessing the portability of Magma's CVEs four years after its release and manually reintroducing the vulnerabilities in the current software versions. We find the straightforward process efficient for 17 of the 32 CVEs in our study. We further investigate why a trivial forward-porting process fails in the 15 other CVEs. This involves identifying the commits breaking the forward-porting process and reverting them in addition to the bug fix. While we manage to complete the process for nine of these CVEs, we provide an update on all 15 and explain the challenges we have been confronted with in this process. Thereby, we give the basis for future work towards a sustainable forward-ported fuzzing benchmark.

Place, publisher, year, edition, pages
IEEE, 2025. p. 1-12, article id 11185945
Series
Proceedings - Conference on Software Maintenance, ISSN 1063-6773, E-ISSN 2576-3148
National Category
Software Engineering
Identifiers
URN: urn:nbn:se:umu:diva-246995DOI: 10.1109/ICSME64153.2025.00011Scopus ID: 2-s2.0-105022458364ISBN: 979-8-3315-9587-6 (electronic)ISBN: 979-8-3315-9588-3 (print)OAI: oai:DiVA.org:umu-246995DiVA, id: diva2:2018698
Conference
41st IEEE International Conference on Software Maintenance and Evolution, ICSME 2025, Auckland, New Zealand, September 7-12, 2025
Funder
The Kempe FoundationsWallenberg AI, Autonomous Systems and Software Program (WASP)Available from: 2025-12-03 Created: 2025-12-03 Last updated: 2025-12-03Bibliographically approved

Open Access in DiVA

No full text in DiVA

Other links

Publisher's full textScopus

Authority records

Riom, TimothéeHouy, SabineKreyssig, BrunoBartel, Alexandre

Search in DiVA

By author/editor
Riom, TimothéeHouy, SabineKreyssig, BrunoBartel, Alexandre
By organisation
Department of Computing Science
Software Engineering

Search outside of DiVA

GoogleGoogle Scholar

doi
isbn
urn-nbn

Altmetric score

doi
isbn
urn-nbn
Total: 21 hits
CiteExportLink to record
Permanent link

Direct link
Cite
Citation style
  • apa
  • ieee
  • vancouver
  • Other style
More styles
Language
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Other locale
More languages
Output format
  • html
  • text
  • asciidoc
  • rtf