NASA’s new dark energy space telescope can also detect killer asteroids
technologyreview.com·2h ago
Security
Google Project Zero·5 min read
On the Effectiveness of Mutational Grammar Fuzzing
TL;DR
Coverage-guided grammar fuzzing, a technique that mutates samples while adhering to predefined grammar rules, has limitations in bug detection. The Jackalope fuzzer was used to demonstrate that increased code coverage does not necessarily correlate with finding more bugs, particularly in structured languages.
✦ Why It Matters
Engineers should recognize that increased coverage does not guarantee bug discovery, especially in structured languages.
Key Takeaways
- Combine independent fuzzing sessions with sample syncing for better results.
- Monitor coverage metrics but don't rely solely on them for bug discovery.
- Experiment with different fuzzing setups tailored to your target.
- Use the Jackalope fuzzer for structured fuzzing tasks.
How It Works
Fuzzing workers generate samples independently for a set duration, then sync with a server to exchange coverage data and samples. This method increases sample diversity and improves bug discovery.