Waltzz: WebAssembly Runtime Fuzzing with Stack-Invariant Transformation
summary
Waltzz implements a stack-invariant transformation so mutations preserve Wasm stack types, plus control-flow and data-flow mutators, a splicing mutator, and a skeleton-based generator to create rare sequences. It runs against an instrumented Wasm runtime, measures AFL++ edge coverage, and compares to AFL++, RedQueen, WasmSmith and others across seven runtimes. Results show 12.4% higher coverage, 1.38× more unique bugs, 20 newly confirmed bugs with 17 CVEs, and hundreds of thousands of valid inputs (100% validity rate).
AI-written summary · about
chapters (11)
- 0:00Waltzz and WebAssembly intro
- 1:17Traditional fuzzers' WebAssembly limits
- 3:07Stack-invariant transformation
- 4:33Waltzz workflow and architecture
- 5:36Control flow mutators
- 7:20Data flow mutators design
- 9:30Skeleton-based input generator
- 12:19Evaluation setup and baselines
- 14:51Performance results and bugs
- 15:12Mutator effectiveness analysis
- 16:18Input validity and conclusion
related talks
28mSecurity and Correctness in Wasmtime
27mAttacking the WebAssembly Compiler of WebKit
52mStructure aware fuzzing
40mFull-Stack Correctness in Wasm: Eliminating Bugs Inside and Outside the Sandbox
43mMeet Your Future - WebAssembly
01h 15mMake your programs more reliable with Fuzzing
20mAFL++ : Combining Incremental Steps of Fuzzing Research
43mWebAssembly Is All You Need:Exploiting Chrome and the V8 Sandbox 10+ times with WASM