The Aftermath of a Fuzz Run - What to Do About Those Crashes?
Explore effective techniques for analyzing and addressing crashes resulting from fuzz testing in this informative conference talk. Learn about tools, tactics, and strategies for post-fuzz run analysis, with the goal of identifying and fixing vulnerabilities. Delve into memory corruption bugs, exploitability assessment, and mitigation techniques such as ASLR and DEP. Gain insights on workflow optimization, crash corpus minimization, and the use of analysis tools like Valgrind. Examine real-world examples, including invalid reads/writes, stack vs. heap corruption, and use-after-free scenarios. Understand the importance of bug chains in modern exploits and discover how seemingly innocuous issues can lead to significant vulnerabilities, as demonstrated by case studies from Google Project Zero, C-Ares, and Chrome OS.