ICUFuzzer：对ICU库进行模糊处理以查找多个软件中的可利用错误资源-CSDN文库

137 浏览量 2021-03-12 13:21:13 上传评论收藏 265KB PDF 举报

ICU Fuzzer 是一款针对国际组件 Unicode (ICU) 库进行模糊测试的工具，目的是在多款软件中发现可利用的安全漏洞。模糊测试（Fuzzing）是一种自动化软件测试技术，通过输入大量的随机或半随机的数据来触发程序异常，以便发现潜在的安全缺陷。ICU 是现代软件中广泛使用的通用组件，提供对 Unicode 和全球化的支持，被超过70家公司和机构所使用的软件采用，包括如 Chrome 浏览器、Android、macOS、iOS、Windows 10、Edge 和 Firefox 等流行软件。 ICU 库中的漏洞可能会影响依赖于它的所有软件。在本文中，研究人员提出了一个发现可被上层应用程序软件访问的 ICU 库漏洞的方法，并构建了一个原型工具 ICU Fuzzer，用于发现浏览器 JavaScript 引擎中的可触发漏洞。通过这种方法，研究人员发现了影响 Chrome、Safari 和 Firefox 等流行浏览器的三个零日漏洞。其中一些漏洞可被利用泄露敏感内存信息，以此绕过缓解攻击的安全机制，如地址空间布局随机化（ASLR）和位置无关执行（PIE）。本文对 ICU 库及其在软件中应用的重要性进行了介绍，并指出了通过利用第三方库的安全漏洞来损害现代软件的安全研究是一个有趣的领域。例如，Lokihardt 利用 libANGLE 中的一个缓冲区溢出漏洞在 2016 年的 Pwn2Own 比赛中获取了 Chrome 浏览器的远程代码执行权限；Richard Zhu 利用 libvorbis 中的漏洞在 2018 年 Pwn2Own 比赛中实现了 Firefox 的代码执行；还有研究人员展示了如何利用 DNS 库中的单字节溢出漏洞远程控制 Chrome OS。基于上述案例，我们了解到共享库已成为现代软件中巨大的攻击面。因为第三方库是多个软件之间的共享代码，所以存在于这些库中的漏洞会对所有使用它们的软件构成安全风险。本研究还得到了中国国家自然科学基金（批准号：*** 和 ***）、清华大学自主科研计划（批准号：***）以及中国计算机学会-中国国家自然科学基金委员会联合基金的部分支持。

资源推荐

资源详情

资源评论

ICUFuzzer: Fuzzing ICU Library for Exploitable

Bugs in Multiple Software

⋆

Kun Yang

1,2

, Yuan Deng

, Chao Zhang

1,2

, Jianwei Zhuge

1,2

, and Haixin

Duan

1,2

Tsinghua University, Beijing, China

Tsinghua National Laboratory for Information Science and Technology, Beijing,

China

Ant-ﬁnancial Light-Year Security Lab, Hangzhou, China

Abstract. Software is usually built on top of shared libraries. Vulnera-

bilities that lie in those dependencies may have huge impact on multiple

software. ICU (International Components for Unicode) is one of the most

widely used common components in modern software, providing Unicode

and Globalization support. ICU is used in a wide range of software from

over 70 companies and organizations, including very popular software

such as Chrome, Android, macOS, iOS, Windows 10, Edge, Firefox.

In this paper, we proposed a fuzzing method t o discover vulnerabilities

in ICU library that are reachable from upper layer application software.

We also built a prototype named ICUFuzzer t o uncover triggerable bugs

in browsers’ JavaScript Engine, with which we have detected three zero-

day vulnerabilities aﬀecting popular browsers like Chrome, Safari and

Firefox. According to our further analysis, one of the bugs can be ex-

ploited to leak sensitive memory informations to bypass mitigations like

ASLR and PIE.

Keywords: ICU · Fuzzing · Browser.

1 Introduction

In recent years, secur ity researchers have done some interesting vulnerability

research in compromising modern software by exploiting security ﬂaws from third

party libraries. lokihardt success fully turned a buﬀer overﬂow bug in libANGLE

to get remote code execution in Chrome br owser in Pwn2Own 2016. Richard Zhu

leveraged a bug in libvorbis to achieve code execution in Firefox in Pwn2O w n

2018. Some researcher demonstrated how to use a o ne byte overﬂow in DNS

library to take remote control of Chrome OS. From the cases above, we can learn

that those shared libraries have become huge attack surfaces in modern software.

Since third party libraries are shared code among multiple software , the bugs that

⋆

This work was partially supported by the National Natural Science Foundation of

China (Grant No.61472209 and No. 61772308), Tsinghua University Initiative Sci-

entiﬁc Research Program (Grant No.20151080436), the CCF-NSFOCUS Kunpeng

Award, and the Young Talent Development Program by CCF.

2 Y. Kun et al.

lie in tho se dependencies are also shared. Bugs in fundamental libraries may have

higher impact than bugs in code that is not shared. Designing new techniques

for automatically ﬁnding hidden ﬂaws in those fundamental dependencies now

bec ome important task, especially the bugs that are reachable in upper level

applications.

Our research focus on a mature, widely us e d libraries named ICU [10]. ICU is

short for Inter national C ompo nents for Unicode, providing Unicode and Glob-

alization support for so ftware applications. ICU is widely portable and gives

applications the same results on all platforms and between C/C++ and Java

software. IC U library is used everywhere, including document processing soft-

ware like OpenOﬃce and LibreOﬃce, browsers like Chrome, Safa ri and Firefox,

operating systems like Android, macOS, iOS, Windows and Linux. ICU is inte-

grated as a fundamental component through high level APIs in var ious software

stack. Only security ﬂaws in ICU that is r e achable from the input through API

calls could result in security impact. So our methodology is designed for ﬁnding

bugs in ICU that is triggerable fr om the entry point of application software.

Fuzzing is a widely used technique to detect vulnerabilities in software. We

designed a fuzzing based method to eﬀectively ﬁnd exploitable bugs in ICU

libraries. In our method, we will do a in-depth analysis on the connection between

target s oftware and ICU librar y. Target software mostly use part o f APIs from

ICU, and does some parameter ﬁltering before invoking. So the analysis result

will help us infer the input generation rules for fuzzing, so that we can get rid

of useless mutations as many as possible while fuzzing. Moreover, we combine

covera ge-guided fuzzing technique to improve the code coverage.

Evaluation. To evaluate the eﬀective ness of o ur design. We implemented a pro-

totype ICUFuzzer to detect v ulnerabilities in ICU that can be trig gered from

browsers’ JavaScript engine. We have studied how the browsers implement EC-

MAScript Internationalization API with the underlying support of ICU and

ﬁgured out how parameters are passed from the ECMAScript API to low level

ICU functions, and how the browsers ﬁlter them for security concerns. With

our ﬁndings, we developed a dedicated input generation engine inside the fuzzer

which produces inputs that can bypass the ﬁlter s. With our methodology, we

signiﬁcantly improve the eﬀectiveness of fuzzing and quickly ﬁnd three zer o-day

bugs, 2 of them can be triggered in Chrome and 1 can be triggered in Chrome,

Safari, and Firefox.

Contribution. This paper makes the following contributions:

– We are the ﬁrst to conduct fuzzing research on ICU library.

– We designed a fuzzer for ﬁnding bugs in ICU that is reachable from a pplica-

tion software. By analyzing the data ﬂow from the input in target application

to the arguments passed down to ICU, we turn fuzzing target applications

into fuzzing ICU directly to a chieve better performance and keep zero false

positive at the same time. Coverage guided fuzzing technique is also applied

here to further improve the code coverage.

ICUFuzzer: Fuzzing ICU Library for Exploitable Bugs in Multiple Software 3

– We implemented ICUFuzzer based on our fuzzer design and eﬀective ly ﬁnd

three zero-day bugs that are exploitable in modern browsers.

Paper organization. The pa per is organized as follows. In Section 2, we give

brief introduction on ICU, including the attack surfaces of ICU. In Section 3, we

use V8 JavaScript engine as an example to describe how ICU is integrated into

other applications. In Section 4, we will introduce our system design, a nd how

we build the prototype ICUfuzzer. In Section 5, we show the results of ﬁnding

bugs by ICUFuzzer. In the last part of Section 6 and 7, we conclude our work

and give a summary on other related work.

2 Preliminaries

2.1 ICU Basics

International Components for Unicode (ICU) is an open source project of mature

C/C++ and Java libraries for Unicode support, software internationalization,

and software globalization. It is widely portable to many operating systems and

environments. It gives applications the same results on all platforms and be tween

C, C++, and J ava softwa re. The ICU project is sponsored, supported, and used

by IBM and ma ny other companies.

Here are a few highlights of the se rvices provided by ICU:

– Code Page Conversion: Convert text data to or from Unicode and nearly

any other character set or encoding

– Collation: Compare str ings according to the conventions and standards of a

particular language, region or country.

– Formatting: Format numbers, dates, times and currency amounts according

the conventions of a chosen locale.

– Time Calculations: Multiple typ e s of calendars are provided beyond the tra-

ditional Gregorian

– Unicode Support: ICU closely tracks the Unicode standard, providing easy

access to all of the many Unicode character pr operties

2.2 Who Uses ICU?

ICU is used in almost every popular operation systems. In Apple macOS, ICU

library is going with the default install under the name libicucore.A.dylib. In

Microsoft Windows 10, ICU library is distributed in two dynamic link libraries,

icuin.dll and icuuc.dll. In Ubuntu, the package of ICU conta ins multiple shared

libraries named libicu*.so.

ICU is heav ily used in document processing software like LibreOﬃce, OpenOf-

ﬁce, PDF Box and products from Adobe. Document processing software have

bee n large attack surfaces used in real world APT attacks for ye ars. Document

剩余17页未读，继续阅读

评论收藏

内容反馈

weixin_38666753

粉丝: 7
资源: 909

ICUFuzzer：对ICU库进行模糊处理以查找多个软件中的可利用错误

用vs2010编译好的ICU库

icu4c-57_1(编译QtWebkit所需要的第三方库)

医药行业专题报告系列之一：环ICU医疗设备链迎来增量窗口期-0311-东兴证券-21页.pdf

ICU源码(C/C++版)

icu-dotnet:用于ICU4C的C＃包装器

icu-csdet:从ICU中提取的字符集检测引擎库

vs2017编译的ICU库

2009中华医院信息网络大会:构建ICU (危重病监护)临床信息系统 (CIS) 的几点战略思考

QT 5.2.0 Release库，取消ICU，包含3个数据库连接插件

vs2015编译的ICU库

stringi, R 和ICU的字符串处理包.zip

icu4c-4_4_1-src.zip_C++ icu4c_C++ icu4c使用_icu_icu for java

icu.cr：ICU库的Cystal绑定包装器

icu4c-4_6-src

icu4c-52_1-src

Icu4c 73 brew自定义版本安装源

icu4c-51_rc-data

ICU源码(支持软件国际化的开源中间件)

基于CORDIC的反正弦和反余弦计算的FPGA实现

BA无标度网络中的SIR模型

使用3DCNN和卷积LSTM进行手势识别学习时空特征

基于三次贝塞尔曲线的类汽车曲率连续路径平滑

基于机器学习的设备剩余寿命预测方法综述

基于FPGA的奇异值和特征值分解的快速实现。

磁悬浮系统自适应模糊PID控制器的设计

最新资源