ClusterFuzz: Fuzzing at Google Scale

on YouTube ↗01h 00m

" summary

ClusterFuzz runs fuzzing at Google scale: a public infrastructure powering OSS-Fuzz and Google fuzzing across 25,000 cores, about 2,500 targets, and finds over 8,000 security vulnerabilities (40,000 total bugs reported, ~91% fixed). It uses libFuzzer/AFL, sanitizers (ASan/UBSan/LSan), protobuf mutators, corpus distillation, preemptible VMs and automated triage (dedupe, grouping, bisection, variant analysis) to minimize testcases, prioritize targets, file bugs automatically and verify fixes.

AI-written summary · about

" chapters (53)

1. 0:00Introduction
2. 0:43History
3. 2:33Fuzzing Myths
4. 4:24How to Scale
5. 5:52Ideal Fuzzing Workflow
6. 7:11ClusterFuzz Overview
7. 8:32What to Fuzz
8. 10:11Blackbox Fuzzing
9. 11:16Chrome Blackbox Fuzzing
10. 12:21AFL
11. 13:25Fuzzer
12. 16:48Example
13. 17:39Educating Developers
14. 18:37Build Pipeline
15. 19:20Optimization
16. 20:55Fuzzy Machines
17. 21:54Fuzzing Targets
18. 23:09Corpus
19. 24:52Search
20. 25:32Strategy Selection
21. 26:39Deduplication
22. 27:33Deduplication example
23. 28:17Grouping
24. 28:59Minimize
25. 30:09Continuous Version
26. 31:00Variant Analysis
27. 33:08Unique Crashes
28. 34:14Examples
29. 34:33Test Case Report
30. 35:11Prioritization
31. 36:29Verification
32. 37:22External Reports
33. 38:33Reporters
34. 38:46Execution Speed
35. 39:22Crash Statistics
36. 39:43Code Coverage
37. 40:46More Applications
38. 43:25Chrome
39. 44:53OSS Security
40. 45:29Whats next
41. 47:22Key takeaways
42. 49:05Questions
43. 49:25concurrency issues
44. 51:00bugs
45. 53:03Corpus Sharing
46. 54:04Other Questions
47. 54:16Mutator
48. 55:02Hybrid Fighting
49. 55:27Future Plans
50. 56:38Corrupted Stack
51. 57:10Address Sanitizer
52. 57:52The biggest challenge
53. 58:23How we made it simple

" related talks

• 44mOSS-Fuzz - Google's continuous fuzzing service for open source softwareKostya Serebryany · 26th USENIX Security Symposium (USENIX Security '17)
• 39mMaking Fuzzing Part of Your Software Development LifecycleJonathan Metzman · SupplyChainSecurityCon at Open Source Summit Europe 2022
• 53mFuzzing 101Kamil Frankowicz · 4Developers 2022 Online
• 39mFuzzing Session: Finding Bugs and Vulnerabilities AutomaticallyDavid Korczynski, Adam Korczynski · KubeCon + CloudNativeCon North America 2022
• 31m“Fuzz or lose..."Kostya Serebryany · CppCon 2017
• 25mHow fuzzing helps to find bugsZbigniew Jędrzejewski-Szmek · DevConf.CZ 2019
• 36mFuzzing the CNCF LandscapeDavid Korczynski, Adam Korczynski · Cloud Native SecurityCon Europe 2022
• 01h 15mMake your programs more reliable with FuzzingMarshall Clow · ACCU Autumn 2019 Belfast