honggfuzz

Description

A security oriented, feedback-driven, evolutionary, easy-to-use fuzzer with interesting analysis options. See USAGE for more data on the usage.

• It's multi-threaded and multi-process: no need to run multiple copies of your fuzzer, as honggfuzz can unlock potential of all your available CPU cores. The file corpus is shared between threads (and fuzzed instances)
• It's blazingly fast (esp. in the persistent fuzzing mode). A simple LLVMFuzzerTestOneInput function can be tested with up to 1mo iterations per second on a relatively modern CPU (e.g. i7-6700K)
• Has a nice track record of uncovered security bugs: e.g. the only (to the date) vulnerability in OpenSSL with the critical score mark was discovered by honggfuzz. See the Throphies paragraph for the summary of findings to the date
• Uses low-level interfaces to monitor processes (e.g. ptrace under Linux). As opposed to other fuzzers, it will discover and report hidden signals (caught and potentially hidden by signal handlers)
• Easy-to-use, feed it a simple input corpus (can even consist of a single, 1-byte file) and it will work its way up expanding it utilizing feedback-based coverage metrics
• Supports several (more than any other coverage-based feedback-driven fuzzer) hardware-based (CPU: branch/instruction counting, Intel BTS, Intel PT) and software-based feedback-driven fuzzing methods known from other fuzzers (libfuzzer, afl)
• Works (at least) under GNU/Linux, FreeBSD, Mac OS X, Windows/CygWin and Android
• Supports persistent fuzzing mode (long-lived process calling a fuzzed API repeatedly) with libhfuzz/libhfuzz.a. More on that can be found here
• Can fuzz remote/standalone long-lasting processes (e.g. network servers like Apache's httpd and ISC's bind), though the persistent fuzzing mode is suggested instead: as it's faster and multiple instances of a service can be fuzzed at once in this mode
• It comes with the examples directory, consisting of real world fuzz setups for widely-used software (e.g. Apache and OpenSSL)

Code

• Latest stable version: 1.2, but using the master branch is highly encouraged
• Changelog

Requirements

• Linux - The BFD library (libbfd-dev) and libunwind (libunwind-dev/libunwind8-dev), clang-4.0 or higher for software-based coverage modes
• FreeBSD - gmake, clang-3.6 or newer (clang-devel/4.0 suggested)
• Android - Android SDK/NDK. Also see this detailed doc on how to build and run it
• Windows - CygWin
• Darwin/OS X - Xcode 10.8+
• if Clang/LLVM is used to compile honggfuzz - link it with the BlocksRuntime Library (libblocksruntime-dev)

Trophies

Honggfuzz has been used to find a few interesting security problems in major software packages; An incomplete list:

• Pre-auth remote crash in OpenSSH
• Apache
  • Remote crash in mod_http2 • CVE-2017-7659
  • Use-after-free in mod_http2 • CVE-2017-9789
  • Memory leak in mod_auth_digest • CVE-2017-9788
• SSL
  • Remote OOB read in OpenSSL • CVE-2015-1789
  • Remote Use-after-Free (potential RCE, rated as critical) in OpenSSL • CVE-2016-6309
  • Remote OOB write in OpenSSL • CVE-2016-7054
  • Remote OOB read in OpenSSL • CVE-2017-3731
  • Uninitialized mem use in OpenSSL
  • Crash in LibreSSL
  • Invalid free in LibreSSL
  • Uninitialized mem use in BoringSSL
• Adobe Flash memory corruption • CVE-2015-0316
• Multiple bugs in the libtiff library
• Multiple bugs in the librsvg library
• Multiple bugs in the poppler library
• Multiple exploitable bugs in IDA-Pro
• Remote DoS in Crypto++ • CVE-2016-9939
• Language interpreters
  • PHP/Python/Ruby
  • PHP WDDX
  • PHP
• Double-free in LibXMP
• Heap buffer overflow in SAPCAR • CVE-2017-8852
• Crashes in libbass
• FreeType 2:
  • CVE-2010-2497
  • CVE-2010-2498
  • CVE-2010-2499
  • CVE-2010-2500
  • CVE-2010-2519
  • CVE-2010-2520
  • CVE-2010-2527
• ... and more

Projects utilizing Honggfuzz

• QuickFuzz by CIFASIS
• OSS-Fuzz
• Frog And Fuzz
• dyjakan's interpreters fuzzing project
• riufuzz: honggfuzz with AFL-like UI
• h2fuzz: fuzzing of Apache's HTTP/2 implementation
• honggfuzz-dharma: honggfuzz with dharma grammar fuzzer
• Owl: a system for finding concurrency attacks
• honggfuzz-docker-apps

Examples

The examples directory contains code demonstrating (among others) how to use honggfuzz to find bugs in the OpenSSL library and in the Apache HTTPD web server.

Other

• User mailing list: honggfuzz@googlegroups.com, sign up with this link.

This is NOT an official Google product