Fuzzing the CNCF Landscape
summary
Over the last year the team integrates fuzzers into more than ten CNCF projects (Kubernetes, Argo, Etcd, Containerd, Vitess, Linkerd2‑proxy, runc, Flux and more) aiming for OSS-Fuzz integration and continuous runs via CNCF fuzzing repo and ClusterFuzzLite. More than a hundred bugs are filed and fixed overall, C/C++ projects like Envoy and Fluent Bit show 200+ reported issues each, and results follow an initial bug spike then a logarithmic decline as maintainers absorb ownership.
AI-written summary · about
chapters (6)
- 0:00Start
- 2:51Testing versus fuzzing
- 6:09Coverage guided fuzzing
- 13:52CNCF projects being fuzzed
- 15:31High level process when fuzzing a CNCF project
- 31:56Better bug detection
related talks
39mFuzzing Session: Finding Bugs and Vulnerabilities Automatically
01h 00mClusterFuzz: Fuzzing at Google Scale
39mMaking Fuzzing Part of Your Software Development Lifecycle
23mContinuous Fuzzing Best Practices
31m“Fuzz or lose..."
01h 39mFuzzing in the open: Integrate your project in OSS-Fuzz for continuous fuzzing
28mFuzz Testing of Envoy
44mOSS-Fuzz - Google's continuous fuzzing service for open source software