Introducing Microsoft’s New Open Source Fuzzing Platform
summary
Microsoft releases OneFuzz, an open source, self‑hosted Azure platform that runs libFuzzer-based tests with ASan and sancov, launches cloud jobs from a single-command cloud launch, and ensembles multiple fuzzers by default. Targets compile as libFuzzer unit tests, run at hundreds of thousands of iterations per second, and OneFuzz performs programmatic triage, deduplication and on-demand live debugging. Real results include 72% coverage in 30s on DHCP and four vulnerabilities (two RCE) discovered during continuous fuzzing.
AI-written summary · about
chapters (9)
- 0:00Introducing OneFuzz
- 1:35Fuzzing at Windows scale
- 7:09Coverage guided fuzzing basics
- 13:10Using LibFuzzer for fuzzing
- 18:45Compiler fuzzing revolution
- 27:13OneFuzz framework overview
- 36:54Security engineering with OneFuzz
- 44:05Thanking the OneFuzz team
- 46:12Q&A session
related talks
01h 15mMake your programs more reliable with Fuzzing
50mC++ Sanitizers & Fuzzing for the Windows Platform Using New Compilers...
31m“Fuzz or lose..."
53mFuzzing 101
39mMaking Fuzzing Part of Your Software Development Lifecycle
01h 00mClusterFuzz: Fuzzing at Google Scale
24mWhy you should be using automated fuzzing to test for security issues in your code
39mFuzzing Session: Finding Bugs and Vulnerabilities Automatically