Fuzzing Session: Finding Bugs and Vulnerabilities Automatically
Talkat KubeCon + CloudNativeCon North America 2022 · on Friday, 2022-10-28· at 16:00· Portside Ballroom (Room 260)·
summary
Fuzzers run across CNCF projects and find thousands of real defects, with more than 200 projects fuzzed and bug reports triaged into fixes. Integration with OSS-Fuzz and use of language tooling (Go’s native fuzzer, sanitizers, fuzz introspection) powers long runs — for Istio about 60,000 hours and 300 billion executions of ~60 fuzzers — producing ~40 crashes and 60 crashes and 1 CVE (7.5): an unauthenticated control‑plane DoS from a Go JSON nil‑pointer via double‑pointer handling.
AI-written summary · about
chapters (17)
- 0:00Introduction to fuzzing
- 1:47What is fuzzing
- 3:33How fuzzing works
- 5:19Fuzzing tooling
- 6:20Bugs and vulnerabilities
- 8:27Fuzzing memory-safe languages
- 10:54Future fuzzing improvements
- 13:02Live demo: Go fuzzer
- 16:59Fuzzing CNCF results
- 19:07Maintainers' experiences
- 21:34Setting up fuzzing
- 24:24Case study: Istio fuzzing
- 28:50Lessons from Istio fuzzing
- 29:33Assessing fuzzing coverage
- 30:36Getting started with fuzzing
- 31:40Future fuzzing directions
- 32:27Q&A
related talks
36mFuzzing the CNCF Landscape
31m“Fuzz or lose..."
27mPractical Fuzzing in Go
01h 00mClusterFuzz: Fuzzing at Google Scale
44mOSS-Fuzz - Google's continuous fuzzing service for open source software
01h 15mMake your programs more reliable with Fuzzing
39mMaking Fuzzing Part of Your Software Development Lifecycle
53mFuzz Testing for Fun and Profit