Squeezing Juicy Variant Bugs Out of Modern Browsers
summary
GRAPE is a ruleable variant analysis pipeline that models bugs with four elements context, assumption, violation, end use and uses pattern rules to scan large codebases. A prototype scans the entire Chromium repo in 12 minutes, finds 24 new bugs, yields four CVEs and $17,500 in Chrome bounties, and also uncovers logic bugs in VSCode Azure Data Studio and issues affecting OpenSSL. The system reports use after free use after return integer overflow–driven buffer overflows and logical flaws and includes exploitability checks via existing bug reports.
AI-written summary · about
chapters (9)
- 0:00Browser spyware threats
- 1:15Browser bugs for access
- 2:38Finding browser vulnerabilities
- 4:45Variant analysis limits
- 6:56Grep for vulnerability hunting
- 9:03Why simple grep fails
- 10:27Four elements of variant bugs
- 13:38Grep framework results
- 14:20Conclusion and future
related talks
29mEvent-based Fuzzing, Patch-based Research, and Comment Police: Finding Bugs Through a Bug
37mReviving JIT Vulnerabilities: Unleashing the Power of Maglev Compiler Bugs on Chrome Browser
34mHow To Find And Prevent Entire Classes Of Security Vulnerabilities
52mStructure aware fuzzing
42mContemporary Automatic Program Analysis
31mNew Wine in an Old Bottle: Attacking Chrome WebSQL
17mTowards Better Semantics Exploration for Browser Fuzzing
47mRAVAGE - Runtime Analysis of Vulnerabilities and Generation of Exploits