Umeå universitets logga

umu.sePublikationer
Ändra sökning
RefereraExporteraLänk till posten
Permanent länk

Direktlänk
Referera
Referensformat
  • apa
  • ieee
  • vancouver
  • Annat format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annat språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf
Evaluating the maintainability of forward-porting vulnerabilities in fuzzer benchmarks
Umeå universitet, Teknisk-naturvetenskapliga fakulteten, Institutionen för datavetenskap.ORCID-id: 0000-0001-7486-0538
Umeå universitet, Teknisk-naturvetenskapliga fakulteten, Institutionen för datavetenskap.
Umeå universitet, Teknisk-naturvetenskapliga fakulteten, Institutionen för datavetenskap.
Umeå universitet, Teknisk-naturvetenskapliga fakulteten, Institutionen för datavetenskap.ORCID-id: 0000-0003-1383-0372
2025 (Engelska)Ingår i: Proceedings. 2025 IEEE International Conference on Software Maintenance and Evolution,: ICSME 2025, IEEE, 2025, s. 1-12, artikel-id 11185945Konferensbidrag, Publicerat paper (Refereegranskat)
Abstract [en]

Fuzzing is a well-established technique for detecting bugs and vulnerabilities. With the surge of fuzzers and fuzzer platforms being developed such as AFL and OSSFuzz rises the necessity to benchmark these tools' performance. A common problem is that vulnerability benchmarks are based on bugs in old software releases. For this very reason, Magma introduced the notion of forward-porting to reintroduce vulnerable code in current software releases. While their results are promising, the state-of-the-art lacks an update on the maintainability of this approach over time. Indeed, adding the vulnerable code to a recent software version might either break its functionality or make the vulnerable code no longer reachable. We characterise the challenges with forward-porting by reassessing the portability of Magma's CVEs four years after its release and manually reintroducing the vulnerabilities in the current software versions. We find the straightforward process efficient for 17 of the 32 CVEs in our study. We further investigate why a trivial forward-porting process fails in the 15 other CVEs. This involves identifying the commits breaking the forward-porting process and reverting them in addition to the bug fix. While we manage to complete the process for nine of these CVEs, we provide an update on all 15 and explain the challenges we have been confronted with in this process. Thereby, we give the basis for future work towards a sustainable forward-ported fuzzing benchmark.

Ort, förlag, år, upplaga, sidor
IEEE, 2025. s. 1-12, artikel-id 11185945
Serie
Proceedings - Conference on Software Maintenance, ISSN 1063-6773, E-ISSN 2576-3148
Nationell ämneskategori
Programvaruteknik
Identifikatorer
URN: urn:nbn:se:umu:diva-246995DOI: 10.1109/ICSME64153.2025.00011Scopus ID: 2-s2.0-105022458364ISBN: 979-8-3315-9587-6 (digital)ISBN: 979-8-3315-9588-3 (tryckt)OAI: oai:DiVA.org:umu-246995DiVA, id: diva2:2018698
Konferens
41st IEEE International Conference on Software Maintenance and Evolution, ICSME 2025, Auckland, New Zealand, September 7-12, 2025
Forskningsfinansiär
KempestiftelsernaWallenberg AI, Autonomous Systems and Software Program (WASP)Tillgänglig från: 2025-12-03 Skapad: 2025-12-03 Senast uppdaterad: 2025-12-03Bibliografiskt granskad

Open Access i DiVA

Fulltext saknas i DiVA

Övriga länkar

Förlagets fulltextScopus

Person

Riom, TimothéeHouy, SabineKreyssig, BrunoBartel, Alexandre

Sök vidare i DiVA

Av författaren/redaktören
Riom, TimothéeHouy, SabineKreyssig, BrunoBartel, Alexandre
Av organisationen
Institutionen för datavetenskap
Programvaruteknik

Sök vidare utanför DiVA

GoogleGoogle Scholar

doi
isbn
urn-nbn

Altmetricpoäng

doi
isbn
urn-nbn
Totalt: 26 träffar
RefereraExporteraLänk till posten
Permanent länk

Direktlänk
Referera
Referensformat
  • apa
  • ieee
  • vancouver
  • Annat format
Fler format
Språk
  • de-DE
  • en-GB
  • en-US
  • fi-FI
  • nn-NO
  • nn-NB
  • sv-SE
  • Annat språk
Fler språk
Utmatningsformat
  • html
  • text
  • asciidoc
  • rtf