honggfuzz

Description

A security oriented, feedback-driven, evolutionary, easy-to-use fuzzer with interesting analysis options. See USAGE for the description of command-line options.

• It's multi-process and multi-threaded: no need to run multiple copies of your fuzzer, as honggfuzz can unlock potential of all your available CPU cores with one process. The file corpus is automatically shared and improved between the fuzzing threads.
• It's blazingly fast when in the persistent fuzzing mode). A simple/empty LLVMFuzzerTestOneInput function can be tested with up to 1mo iterations per second on a relatively modern CPU (e.g. i7-6700K)
• Has a solid track record of uncovered security bugs: the only (to the date) vulnerability in OpenSSL with the critical score mark was discovered by honggfuzz. See the Trophies paragraph for the summary of findings to the date
• Uses low-level interfaces to monitor processes (e.g. ptrace under Linux). As opposed to other fuzzers, it will discover and report hijacked/ignored signals (intercepted and potentially hidden by signal handlers)
• Easy-to-use, feed it a simple corpus directory (can even be empty) and it will work its way up expanding it utilizing feedback-based coverage metrics
• Supports several (more than any other coverage-based feedback-driven fuzzer) hardware-based (CPU: branch/instruction counting, Intel BTS, Intel PT) and software-based feedback-driven fuzzing methods known from other fuzzers (libfuzzer, afl)
• Works (at least) under GNU/Linux, FreeBSD, Mac OS X, Windows/CygWin and Android
• Supports the persistent fuzzing mode (long-lived process calling a fuzzed API repeatedly) with libhfuzz/libhfuzz.a. More on that can be found here
• Can fuzz remote/standalone long-lasting processes (e.g. network servers like Apache's httpd and ISC's bind), though the persistent fuzzing mode is suggested instead: as it's faster and multiple instances of a service can be fuzzed with this
• It comes with the examples directory, consisting of real world fuzz setups for widely-used software (e.g. Apache and OpenSSL)

---

---

Code

• Latest stable version: 1.3, but using the master branch is highly encouraged
• Changelog

Requirements

• Linux - The BFD library (libbfd-dev) and libunwind (libunwind-dev/libunwind8-dev), clang-4.0 or higher for software-based coverage modes
• FreeBSD - gmake, clang-3.6 or newer (clang-devel/4.0 suggested)
• Android - Android SDK/NDK. Also see this detailed doc on how to build and run it
• Windows - CygWin
• Darwin/OS X - Xcode 10.8+
• if Clang/LLVM is used to compile honggfuzz - link it with the BlocksRuntime Library (libblocksruntime-dev)

Trophies

Honggfuzz has been used to find a few interesting security problems in major software packages; An incomplete list:

• Pre-auth remote crash in OpenSSH
• Apache
  • Remote crash in mod_http2 • CVE-2017-7659
  • Use-after-free in mod_http2 • CVE-2017-9789
  • Memory leak in mod_auth_digest • CVE-2017-9788
• SSL
  • Remote OOB read in OpenSSL • CVE-2015-1789
  • Remote Use-after-Free (potential RCE, rated as critical) in OpenSSL • CVE-2016-6309
  • Remote OOB write in OpenSSL • CVE-2016-7054
  • Remote OOB read in OpenSSL • CVE-2017-3731
  • Uninitialized mem use in OpenSSL
  • Crash in LibreSSL
  • Invalid free in LibreSSL
  • Uninitialized mem use in BoringSSL
• Adobe Flash memory corruption • CVE-2015-0316
• Multiple bugs in the libtiff library
• Multiple bugs in the librsvg library
• Multiple bugs in the poppler library
• Multiple exploitable bugs in IDA-Pro
• Remote DoS in Crypto++ • CVE-2016-9939
• Language interpreters
  • PHP/Python/Ruby
  • PHP WDDX
  • PHP
• Double-free in LibXMP
• Heap buffer overflow in SAPCAR • CVE-2017-8852
• Crashes in libbass
• FreeType 2:
  • CVE-2010-2497
  • CVE-2010-2498
  • CVE-2010-2499
  • CVE-2010-2500
  • CVE-2010-2519
  • CVE-2010-2520
  • CVE-2010-2527
• A couple of problems in the MATLAB MAT File I/O Library: 1, 2, 3, 4, 5
• ... and more

Projects utilizing Honggfuzz

• QuickFuzz by CIFASIS
• OSS-Fuzz
• Frog And Fuzz
• dyjakan's interpreters fuzzing project
• riufuzz: honggfuzz with AFL-like UI
• h2fuzz: fuzzing of Apache's HTTP/2 implementation
• honggfuzz-dharma: honggfuzz with dharma grammar fuzzer
• Owl: a system for finding concurrency attacks
• honggfuzz-docker-apps
• FFW - Fuzzing For Worms

Examples

The examples directory contains code demonstrating (among others) how to use honggfuzz to find bugs in the OpenSSL library and in the Apache HTTPD web server.

Other

• User mailing list: honggfuzz@googlegroups.com, sign up with this link.

This is NOT an official Google product