3

I am currently fuzzing various open-source libraries and programs in order to find buffer overflows, underruns, memory leaks, crashes, etc.

I am using an ARM system to perform this fuzzing. The programs are compiled from source using my local system.

Will the vulnerabilities I find also work on x86_64 systems, and other architectures?

The true question I'm asking is whether these sort of memory-level vulnerabilities are dependent on the architecture or not?

Will the vulnerabilities:

  • Always work?
  • Sometimes work?
  • Never work?
6

Sometimes yes, sometimes no. It isn't just a matter of processor architecture: the compiler matters, the compiler version matters, the optimization options matter, the system libraries matter...

If the code (including any potentially-buggy dependency) is written in a memory-safe language (i.e. most programming languages in widespread use other than C and C++), its behavior is largely predictable and platform-independent. But if the code is not written in a memory-safe language, then whether a bug in the source code translates into a runtime bug depends on the exact details of how the code is compiled and executed.

For example, suppose that the code copies a null-terminated string but omits the null terminator. Whether this turns out to be a problem depends on what is immediately after the result in memory. It may happen that in a certain build, the buffer containing the string previously contained all-zero, and therefore there is no vulnerability. But in a different build, or with a different runtime environment, you won't have this luck.

Tools like Address Sanitizer (ASan) and Valgrind instrument the binary to try to make memory problems more likely to manifest, at the expense of performance and memory usage. They use techniques such as reserving space between buffers so that a buffer overflow affects the reserved space rather than some other variable, and keeping copies of the expected content of some memory and checking them to detect if they're modified when they shouldn't be. First run those tools on sample inputs to weed out the most obvious problems. Then run those tools on inputs produced by your fuzzer.

x86 is usually a better platform for fuzzing because there are more tools available and because fuzzing is very demanding in CPU time. But if you have an arm cluster, you can use an arm cluster. When you combine the diversity of inputs from a fuzzer and the memory organization of a memory error detection tool, few memory errors will go undetected no matter what the platform is.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.